We've rolled out Identity Connect for out domain successfully and everything has been working just fine.  Now, all of a sudden at random times, people will authenticate but then get a "
Your login attempt using single sign-on with an identity provider certificate has failed. Please contact your salesforce.com administrator for more information"

Going in to SAML Validator I see the following error:  "
InResponseTo must be empty for Idp-init Browser POST Profile"

Under Miscellaneous format confirmations.  When a user gets that, I can log in as them on a different PC with no issue, and sometimes they need to hit back in browser and it authenticate and goes to landing page.  It's becoming more frequent and I've not been able to find anything to help.  Any thoughts?
 

We've rolled out Identity Connect for out domain successfully and everything has been working just fine.  Now, all of a sudden at random times, people will authenticate but then get a "
Your login attempt using single sign-on with an identity provider certificate has failed. Please contact your salesforce.com administrator for more information"

Going in to SAML Validator I see the following error:  "
InResponseTo must be empty for Idp-init Browser POST Profile"

Under Miscellaneous format confirmations.  When a user gets that, I can log in as them on a different PC with no issue, and sometimes they need to hit back in browser and it authenticate and goes to landing page.  It's becoming more frequent and I've not been able to find anything to help.  Any thoughts?