Strange Shib SP behaviour during service access from UAE

[Peter Schober]

* Stefan Santesson <stefan at aaa-sec.com> [2016-10-09 15:03]:
> The result is strange.
> 
> - When changing webpages within the protected domain/host shib does not recognize that I have a valid authenticated session and sends me to the discovery service.
> - Sometimes, the web application does not receive authenticated attributes from shib even if the assertion contains all attributes (using AJP headers).

Does the IP address change between requests, as per your server logs?
Are the HTTP Cookies set by the Shib SP present in those requests?
-peter