sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Scott Cantor]

> On Mar 9, 2026, at 4:57 PM, Peter Schober via dev <dev at shibboleth.net> wrote:
> 
> On the inbound HTTP POST of the Response to /Shibboleth.sso/Validate I don't
> see any cookie headers at all, so you're right, it's not in the request.
> (Neither on non-SSO "manual" requests to / or /Shibboleth.sso/Session)

Aside from that, the log message you posted doesn't match the RelayState value that it was using to compute the name of the cookie to look for either, so even if it were there, it wasn't lining up.

The cookie name should have the RelayState value on the end.

Perhaps the log was from a different roundtrip.

(This also assumes the IdP is returning the RelayState properly, not anything I've heard being a problem very often.)

-- Scott