Troubleshooting the "Unable to decode" (IdP 3.3)

[O'Dowd, Josh]

> That probably just means it's banging the bare URL with no parameters, which fits a robot, but again, the access log should tell you.

Good suggestion.  I am working with new Sysadmin these days, but I got into the access logs on the Apache.  The request content is encrypted, obviously but the access header looks like:
GET /idp/profile/SAML2/Redirect/SLO?RelayState=..
or
GET /idp/profile/SAML2/Redirect/SSO?RelayState=...

The one difference I see between these and successful GET requests to these endpoints is the successful ones all have ?SAMLRequest= and all the failing ones have the ?RelayState= parameter.  I don't know if that means anything important.

Josh