Authentication failing intermittently in IdP 5 for Ellucian Banner 9

[Peter Schober]

Lipscomb, Gary via users <users at shibboleth.net> [2024-12-16 22:24 CET]:
> Falling back to IdP 4 and everything works fine.

I know nothing about Banner and your problem description can only be
understood by someone who at least has access to the application but:

How exactly do you "fall back" to your old IDP?
If there are no changes involved on the SP side then I'd treat that as
a black box and focus on checking SAML authn requests coming into the
IDP and SAML Reponses/Assertions going out of your IDP.

Besides logging and checking protocol messges in the web browser using
the SAMLtracer extention using both your IDPv4's and v5's aacli tool
might also help in determining any differences wrt what each of your
IDPs is sending to that SP for a given subject.

If none of that reveals any significant differences in the protocol
messages sent by the IDP I suppose you'd have to re-work your test
cases reprocuding the issue.

-peter