SP/IdP not honoring SSO session

[Cantor, Scott]

One way or another, it's a cookie issue, that's a given.

As Andy said, SameSite would be the usual guess if you didn't already deal with it. It's using POST to get to your IdP, which implicates SameSite pretty directly, we describe that on our SameSite page.

But, it only manifests like that when server-side sessions are being used (or client side with the non-recommended use of only cookies and not HTML storage). If you fell into either case though, that would almost ensure it's SameSite causing problems.

Most of the browsers botched their SameSite implementations with that ridiculous heuristic where it will sort of not care for some number of minutes and then start caring. There are no words for how dumb that is if you have to support production services the way we do.

So you will absolutely get random-seeming outcomes based on timing when that's the culprit.

Outside of SameSite, framing would be a possibility I suppose, but you'd generally get outright errors with that.

I want to be clear that I'm happy to debug this sort of thing for members (assuming I can get traces or access to run tests). I won't do it otherwise, sorry.

-- Scott