Does this look familiar? https://issues.shibboleth.net/jira/browse/JOST-220 TL;DR we spotted a potential bug in OpenSAML and fixed it. We don't know if this is the cause because we never reproduced the problem. This potential fix is available in 2.4.2. Also you might want to check your container logs.