Should 'auth' plugins be singletons?

[mwood]

The deeper I go into authentication plugins the more confused I get.

AuthPlugin defines a required method getInstance(settings,authId). What's it supposed to do? LDAPAuthPlugin (the only 'auth' plugin that ships with OJS) just implements it as an alias for 'new LDAPAuthPlugin'. There's no reason to have (effectively) two constructors with the same signature. Typically if you have a method called getInstance, the constructor is private and getInstance always returns a reference to a single instance generated internally, to make the class a singleton. But I can add the same 'auth' plugin more than once, with different settings (which are passed to the constructor and to getInstance) to create different authentication sources, which ought to mean that multiple instances can exist concurrently. What have I failed to understand?

The reason for all this handwringing is that I'm trying to work out how to get an instance of an 'auth' plugin initialized with the settings and authId for a given authentication source, before knowing the username. This is for building an SSO plugin -- when using an SSO provider, the most frequent case is that the user is already authenticated and we'll get the username from the provider, not the user.