Problems with Attribute Consent Release Page

[Bryan K. Walton]

Recently, many of our employees have started experiencing a problem
where they are being asked almost every day, to consent to the
attribute release.  This is in spite of the fact that they have
selected "Do not ask me again" on the attribute release page.
Additionally, we have confirmed that BEFORE they authenticate,
they have a current, non-expired shib_idp_persistent_ss cookie that has
an expiration date that is a year in advance.

Sometimes, the attribute consent release page appears every day.
Sometimes, it appears every other day or every few days.

We are seeing this across multiple web browsers (Firefox, Chrome, Edge),
as well as in some applications, like Rocket Chat, that don't run in the
browser and have their own cookie repo.

It seems like shibboleth IdP is randomly ignoring the existence of 
and/or the expiration date of the shib_idp_persistent_ss cookie.

Has anybody else experienced this?  How would I go about troubleshooting
this issue?

Thanks,
Bryan Walton

-- 
Bryan K. Walton                                           319-337-3877 
Linux Systems Administrator                 Leepfrog Technologies, Inc