sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Peter Schober]

Scott Cantor via dev <dev at shibboleth.net> [2026-02-24 17:17 CET]:
> I will send a formal announcement to announce@ tomorrow, but this
> list is where any discussion will be.

Haven't seen any SP4 discussions anywhere, yet? Anyway: I have a fresh
Rocky 10 box (after not really having touched RHEL and clones in 2
decades) with both agend & hub installed, as per the simplest possible
case in the docs. The /Shibboleth.sso/Status ping shows all OKs.
Trying to initiate SSO an external IDP fails at the assertion
validation stage, though:

# agent via syslog/systemd journal

Mar  9 19:29:44 sp4 shibboleth-sp[17509]: [Shibboleth.Apache] - token validation error: SubjectConfirmationData/@InResponseTo for assertion '_531f28e333e42baf0d905ccb1f094747' did not match the valid value: null
Mar  9 19:29:44 sp4 shibboleth-sp[17509]: [Shibboleth.Apache] - token validation error: No subject confirmation methods were met for assertion with ID '_531f28e333e42baf0d905ccb1f094747'
Mar  9 19:29:44 sp4 shibboleth-sp[17509]: [Shibboleth.Apache] - Remote operation (token-consumer) failed with event: InvalidMessage [, target=https://sp4.lab.aco.net/secure, operation=token-consumer, handlerType=TokenConsumer, event=InvalidMessage]

# hub logs

2026-03-09 19:29:44,124 - 127.0.0.1 - INFO [net.shibboleth.sp.saml.saml2.profile.impl.AddAuthnRequest:351] - Profile Action AddAuthnRequest: Generated AuthnRequest with ID _826973a7cd48730ff80d698bdd32715e from https://sp4.example.org
2026-03-09 19:29:44,472 - 127.0.0.1 - INFO [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:313] - Profile Action ValidateAssertions: Assertion validation failure(s): [SubjectConfirmationData/@InResponseTo for assertion '_531f28e333e42baf0d905ccb1f094747' did not match the valid value: null, No subject confirmation methods were met for assertion with ID '_531f28e333e42baf0d905ccb1f094747']
2026-03-09 19:29:44,473 - 127.0.0.1 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:227] - Profile Action ProcessAssertionsForAuthentication: No valid SAML Assertions suitable for authentication were found
2026-03-09 19:29:44,474 - 127.0.0.1 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidMessage

Using SAMLtracer I see auth request and response and
SubjectConfirmationData/@InResponseTo contains the correct
AuthnRequest/@ID, which it seems is seen as the problem here:

> did not match the valid value: null

None of the issues I see in
https://shibboleth.atlassian.net/jira/software/c/projects/JSHIBD/issues
seem to match that and
https://codeberg.org/Shibboleth/java-plugin-shibd is not being used
for issues. I may still be looking in the wrong place?

Best,
-p