detected a problem with assertion: Unable to establish security of incoming assertion.

[Cantor, Scott]

It is in a log, just not that one. The documentation is all there to point you at all the logs that exist.

It's seeing a variable in the request that is supposed to be set by  the SP and flagging it for a security violation.

I know of no way to get that error without literally feeding it a header name from the client that collides.

You shouldn't need to use headers to begin with. Turn them off, use system variables, and that  detection code doesn't run. All of that is defaulted, you have to turn headers on now and nobody ever should.

-- Scott