<html><body><div dir="ltr">After a restart, our primary IdP node was rejecting SAML requests as “replays”, e.g.,<blockquote style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex" class="gmail_quote" type="cite"><div dir="ltr"><p style="margin:0px;font-style:normal;font-variant-caps:normal;font-stretch:normal;line-height:normal;font-family:Menlo;font-size-adjust:none;font-kerning:auto;font-variant-alternates:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-feature-settings:normal"><span style="font-variant-ligatures:no-common-ligatures">16:59:30:069 WARN [IP] org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler:158 > Message Handler: Replay detected of message 'a8caafa5jfeeaec390b0fhfi80h01c' from issuer 'https://...</span></p></div></blockquote><div dir="ltr"><br></div><div dir="ltr">or “Unable to decode”, e.g.,</div><blockquote style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex" class="gmail_quote" type="cite"><div dir="ltr"><p style="margin:0px;font-style:normal;font-variant-caps:normal;font-stretch:normal;line-height:normal;font-family:Menlo;font-size-adjust:none;font-kerning:auto;font-variant-alternates:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-feature-settings:normal"><span style="font-variant-ligatures:no-common-ligatures;color:#ffffff;background-color:#000000">ERROR</span><span style="font-variant-ligatures:no-common-ligatures"> [IP] org.opensaml.profile.action.impl.DecodeMessage:73 > Profile Action DecodeMessage: Unable to decode incoming request</span></p></div><div dir="ltr"><p style="margin:0px;font-style:normal;font-variant-caps:normal;font-stretch:normal;line-height:normal;font-family:Menlo;font-size-adjust:none;font-kerning:auto;font-variant-alternates:normal;font-variant-ligatures:normal;font-variant-numeric:normal;font-variant-east-asian:normal;font-feature-settings:normal"><span style="font-variant-ligatures:no-common-ligatures">org.opensaml.messaging.decoder.MessageDecodingException: No SAMLRequest or SAMLResponse query path parameter, invalid SAML 2 HTTP Redirect message </span>at org.opensaml.saml.saml2.binding.decoding.impl.HTTPRedirectDeflateDecoder.doDecode(HTTPRedirectDeflateDecoder.java:114)</p></div></blockquote><div dir="ltr"><br></div><div dir="ltr">Any suggestions welcome.</div><div dir="ltr"><br></div><div dir="ltr">David</div></div></body></html>