sp4a1, SubjectConfirmationData/@InResponseTo did not match the valid value: null

[Scott Cantor]

> Not sure that clears anything up?

Partly, I misunderstood one of your comments. But I definitely don't know why it's setting MaxAge that way.

We do set it to -1 by default, but that's in Java, per the long-stable Javadoc:

"A negative value means that the cookie is not stored persistently and will be deleted when the Web browser exits. A zero value causes the cookie to be deleted."

That is definitely not the HTTP definition, where -1 and 0 are both "to be deleted". It's just how it all works.

What you might do is change the sp.cookieMaxAge setting and not use -1 there, and see what happens if it's set to 300 or something.

Is this Jetty or Tomcat?

-- Scott