sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Peter Schober]

The initial request to the protected ressource (via TLS):
  GET /secure
yields this cookie response header:
  set-cookie: __Host-shibsp_req_dc997c8834241275c3050ad8050f4b19=_10dcb66c73797f1471ee182aa3c98dd0; HttpOnly; Max-Age=-1; Path=/; SameSite=None; Secure
plus a redirect to the external IDP.

On the inbound HTTP POST of the Response to /Shibboleth.sso/Validate I don't
see any cookie headers at all, so you're right, it's not in the request.
(Neither on non-SSO "manual" requests to / or /Shibboleth.sso/Session)

Everything browser-facing is on TLS (SP, IDP), web PKIX certificates,
same as for all our prod services. No changes to any cookie/samesite
defaults, neither on the IDP (also Shibboleth) nor SP side.

Scott Cantor via dev <dev at shibboleth.net> [2026-03-09 21:11 CET]:
> On DEBUG, the action that extracts the value includes logging either way:

Found the message, once I turned up logging for net.shibboleth.sp (d'oh):

2026-03-09 20:42:37,837 - 127.0.0.1 - DEBUG [net.shibboleth.sp.profile.impl.DecodeAgentRequest:125] - Profile Action DecodeAgentRequest: Decoded message with transaction ID 'a2c5e28591f260a1'
2026-03-09 20:42:37,838 - 127.0.0.1 - DEBUG [net.shibboleth.sp.profile.impl.ResolveApplication:63] - Profile Action ResolveApplication: Request from agent 'localhost' mapped to application 'default'
2026-03-09 20:42:37,846 - 127.0.0.1 - DEBUG [net.shibboleth.sp.profile.impl.SelectTokenConsumerFlow:102] - Profile Action SelectTokenConsumerFlow: Token consumer flow saml2/post handling request
2026-03-09 20:42:37,948 - 127.0.0.1 - DEBUG [net.shibboleth.sp.profile.impl.MapStateTokenToResource:123] - Profile Action MapStateTokenToResource: Requested resource recovered from state token: [104, 116, 116, 112, 115, 58, 47, 47, 115, 112, 52, 46, 108, 97, 98, 46, 97, 99, 111, 46,
110, 101, 116, 47, 115, 101, 99, 117, 114, 101]
2026-03-09 20:42:37,957 - 127.0.0.1 - DEBUG [net.shibboleth.sp.profile.impl.ProcessCorrelationCookie:157] - Profile Action ProcessCorrelationCookie: No correlation cookie found for state token '794381cbc915c9b89101b72c5a23b855'
2026-03-09 20:42:37,962 - 127.0.0.1 - DEBUG [net.shibboleth.sp.profile.impl.SelectRelyingPartyConfiguration:129] - Profile Action SelectRelyingPartyConfiguration: Found relying party configuration localhost for request
2026-03-09 20:42:37,989 - 127.0.0.1 - INFO [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:313] - Profile Action ValidateAssertions: Assertion validation failure(s): [SubjectConfirmationData/@InResponseTo for assertion '_ff5adc8596763460716c82c73f4c6c43' did not match the va
lid value: null, No subject confirmation methods were met for assertion with ID '_ff5adc8596763460716c82c73f4c6c43']
2026-03-09 20:42:37,994 - 127.0.0.1 - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:227] - Profile Action ProcessAssertionsForAuthentication: No valid SAML Assertions suitable for authentication were found
2026-03-09 20:42:37,999 - 127.0.0.1 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidMessage

This only confirms what you already new: The cookie is not there.
Thanks, I'll have to continue this later/another time.
-p