Users intermittently land on WAYF page

[Mike Flynn]

Howdy folks.  I am running 2.3.1 SP on Windows. I have a client who sees the incommon WAYF page intermittently when they send an assertion.  Currently, I use one session init for everything and this is it:
   <SessionInitiator type="Chaining" Location="/InCommon" isDefault="true" id="InCommon" relayState="cookie">             <SessionInitiator type="SAML2" acsByIndex="false" acsIndex="1" template="bindingTemplate.html"/>             <SessionInitiator type="Shib1" acsIndex="2"/> <SessionInitiator type="WAYF" acsIndex="2" URL="https://wayf.incommonfederation.org/DS/WAYF" />         </SessionInitiator>

ALL of my clients use an SP link with the entityID embedded so WAYF is not needed.  When a user manages to strip the entityID out of the URL, they land on the WAYF page as expected.
This customer gets to the WAYF page after they send the assertion back to me.  What might be wrong in the assertion that would make Shib send them to WAYF like that?  The assertion is encrypted and I know the issue is on their side (as do they) - They are looking for some guidance as to where to look...
TIA!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150312/6e70f916/attachment.html