My organization uses SSO for authentication, and it works properly except after a session timeout. Once that happens, and we're directed to log in again, SSO fails with this error:
We can't log you in because of an issue with single sign-on. Contact your Salesforce admin for help.
We're then required to back up to the previous page, refresh it, then click the SSO login button. This works properly.
Is there some misconfiguration that causes the problem?
The SAML assertation is generated when the page is loaded, not when the button is clicked. The assertation has a time limit of 5 +- 3 minutes (quote and link below), what is likely happening is the user is timing out and coming back to login using SSO AFTER that time limit. The assertation is now invalid, hence SSO fails.
Timestamps
The identity provider generates a timestamp to indicate when it sent the assertion. Salesforce must receive the assertion from your identity provider within 5 minutes of the timestamp, plus or minus 3 minutes. In practice, this constraint means Salesforce can receive the assertion up to 8 minutes after the timestamp or 3 minutes before it. If the assertion specifies a shorter validity period, the validator checks this requirement too. The NotBefore and NotOnOrAfter constraints must also be defined and valid.
https://help.salesforce.com/s/articleView?id=sf.sso_saml_validation_errors.htm&type=5
