Shib IdP: Box app failing on iOS 13

[Phil Pishioneri]

We're getting reports of people not being able to log into the Box
application from iOS/iPadOS 13. One screen shot I've seen has the IdP
error of "NoSuchFlowExecutionException".

Box support pointed us to new TLS certificate requirements at

https://support.apple.com/en-us/HT210176

but our cert and its CA pass by my reckoning. That page also says Safari
on iOS13 would fail, and I've had someone tried a protected website from
Safari and that works.

We're running IdP 3.4.3 on tomcat 8. Any ideas? (SameSite maybe?)

-Phil