...
- Too few attributes sent from the IdP
- Required attribute valued value is not sent from the IdP
- The service requires REFEDS MFA capability of the IdP but not supported by IdP (according to IdP Metadata)
- The IdP doesn't seem to support the forceAuthn SAML flag (either a SAML error from the errorURL or the AuthenticationInstant is not refreshed
...