google apps work in chrome, but not FF, Safari

[Liam Hoekenga]

We're prepping for our upgrade to IdP v3.1.2.  I've noticed something
confounding.

My normal everyday browser is Chrome on OSX.  All the google apps seem to
work find (mail, drive, docs, sheets, slides, etc)... and everything
*seems* to work fine from my windows 7 VM (IE, FF, Chrome)

But... if I try safari or FF in OSX, from the chrome launcher, I can access
"My Account", "Search", "Google+", "Mail", "Calendar", "Sites", "Groups",
and "Contacts".    "Drives", "Docs", "Sheets" and "Slides" all send the
browser into an authentication loop.

Accesses from chrome seem to generate a single authentication event.  I see
the initial authentication in idp-process.log.  I do not see further
traffic if I go to additional google apps.

Accesses from FF, Safari - the browser goes through a loop, requesting the
same stuff over and over again.  Here's a fun entry from my idp-process.log:

2015-09-28 10:21:54,714 - DEBUG
[org.opensaml.saml.saml2.binding.encoding.impl.HTTPPostEncoder:220] -
Setting RelayState parameter to: '
https://accounts.google.com/CheckCookie?continue=https%3A%2F%2Fdrive.google.com%2Faccounts%3FcontinueUrl%3Dhttps%253A%252F%252Fdrive.google.com%252F%253Ftab%253Dwo%2526authuser%253D1%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%23&followup=https%3A%2F%2Fdrive.google.com%2Faccounts%3FcontinueUrl%3Dhttps%253A%252F%252Fdrive.google.com%252F%253Ftab%253Dwo%2526authuser%253D1%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%252Fdrive.google.com%252Faccounts%253Fauthuser%253D1%2526conti&service=wise&ltmpl=drive',
encoded as 'https://accounts.google.com
/CheckCookie?continue=https%3A%2F%
2Fdrive.google.com
%2Faccounts%3FcontinueUrl%3Dhttps%253A%252F%
252Fdrive.google.com
%252F%253Ftab%253Dwo%2526authuser%253D1%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%23&followup=https%3A%2F%
2Fdrive.google.com
%2Faccounts%3FcontinueUrl%3Dhttps%253A%252F%
252Fdrive.google.com
%252F%253Ftab%253Dwo%2526authuser%253D1%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti%26urp%3Dhttps%253A%252F%
252Fdrive.google.com
%252Faccounts%253Fauthuser%253D1%2526conti&service=wise&ltmpl=drive'


any ideas?
Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150928/73b9608a/attachment.html>