IDP 5 - NoSuchConversationException when clicking URL link from email and _saml_idp cookie set.

[Cantor, Scott]

Your message presents two conflicting claims: It both says that the discovery cookie (which doesn't inherently obviously have anything to do with the IdP) causes the error and then later the message says it prevents the error.

My guess is you're seeing CDN caching. I have seen cases where an SP's redirect to the IdP gets cached by CDNs and they start presenting stale redirects to clients. Usually it causes a replayed AuthnRequest, but in principle it could just as easily end up playing back a URL from later in the conversation.

By definition, there is no circumstance in which an initial request to the IdP with the execution key would ever work (as there is no conversation yet).

The first request has to be with the SAML parameters, not a webflow key.

The discovery cookie if it's not set could bypass that by forcing the client to hit the DS first, busting the cache.

-- Scott