Problems with OIDC authentication response must contain a state parameter when using oidc-rp-plugin for shibboleth.

[Cantor, Scott]

> Everything works fine except for sometimes, when many
> students are logging in at the same time to the same SP.

That sounds like a race condition, but it's too early to assume where.

> Users also get the message about "Web Login Service - Stale
> Request" on the login page and never get a chance to log in.

That goes hand in hand if there's actually no state token, the token value is how the IdP recovers the right conversation to resume after it comes back from the OP.

> Does anyone have any hint on where to look for further error 
> investigation.

You should be at minimum determining if the responses do in fact have a state token or not from web logs.

-- Scott