Tracking down intermittent stale request errors from the IdP

[Wessel, Keith]

All,

Hoping someone can point me in the right direction. We have a technical user here on campus who has been getting intermittent stale request messages from the IdP. He'll sign into a service behind Shib then, when he signs into another, he'll be prompted to re-enter his password even though forced reauth wasn't requested and he still has a valid IdP session. After clicking the login button on that page, he'll get a stale request message in his browser instead of being prompted for 2FA.

When this happens, he can go back to the same starting point for logging into the service several times in a row and get the same results until, after a few tries, it randomly works. He can even try in a private browsing window and get the same results while it's still happening.

So far, this has all been in Chrome and hasn't been happening to other customers, or at least they're not reporting it. But he's been putting up with it every couple days for the last couple months. It happens to a variety of SPs, but he's never had it happen when logging into AWS (which he does frequently) which uses IDP-initiated SSO.

He's tried the obvious clearing his cache and disabling browser extensions.

All that the IdP reports in the log is a no such flow exception.

I suspect his browser is doing some funny caching that it shouldn't be. I'm tempted to have him re-install Chrome or spend a few days in another browser. Before I do, wondered if anyone had suggestions of other things I might try to help troubleshoot this.

Thanks,
Keith