idp RemoteUser url-parameters jsession occasional-login-failures

[Cantor, Scott]

> I'm thinking client because it's an occasional thing.  Most requests do not
> come in with the jsession parameter; and those that do do not usually add it
> to the redirects.

That's due to the client already sending up a JSESSIONID cookie. I suspect if it's that infrequent, the container may be smart enough to look for the cookie even if the actual value doesn't match a real session, but in the old days, you'd see the URL decorated any time the client came in without a valid container session, which is of course quite common in the IdP, depending on your session timeout.

-- Scott