> We're currently using JPA session storage. Don't, unless you have some odd need for back channel logout and apps that would support it. > What is it looking for that it can't find? Probably a match on the NameID that isn't technically correct due to a broken app (if it's not a Shibboleth SP) but there's not enough here to conclude anything. -- Scott