sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Peter Schober]

Scott Cantor via dev <dev at shibboleth.net> [2026-03-11 14:59 CET]:
> I can't fathom what is up with your cookies. I would want to see
> somebody else run into this before I conclude there's anything
> really wrong.
> 
> You say it got set and returned, but then didn't get set and
> returned, so I'm not sure what to conclude.

Not sure I said that: I said I'm seeing the Set-Cookie response header
but only ever with MaxAge=-1, so the cookie is not actually being
set. (The U-A doesn't persist it and so never returns it in subsequent
request headers). Then that cookie is searched for and compared with
the SAML response data. The values from the cookie would match all
values mentioned in the logs but it's simply not there (MaxAge).

The full example includingn all values and verbatim copies of cookie
request and response headers I posted was just to show that it's
*that* cookie (value) that's not being persisted that's then later
expected to be found (in vain). I.e., it matches everything
everywhere, except for not having been set, but deleted.
Not sure that clears anything up?

Best,
-peter