'InResponseTo: Invalid' SAML assertions fail

Service Provider Initiated Flow

In a SAML Service Provider (SP) initiated login flow, when an unauthenticated user attempts to access a Salesforce URL, Salesforce generates a SAML request and sends it to the configured Identity Provider (IdP). The IdP must then authenticate the user and send back a SAML response that includes an InResponseTo value matching the ID of the original SAML request.
A SAML SSO login may fail with 'InResponseTo: Invalid' in the SP-initiated flow in the following scenarios:

1. InResponseTo mismatch: The SAML response contains an InResponseTo value that does not match the ID of the SAML request that Salesforce generated. This can happen if the IdP is replaying an old response or if the request ID was altered.
2. Expired InResponseTo value: The InResponseTo value is generated when the My Domain login page loads and expires after 8 minutes. If the SAML response is sent to Salesforce more than 8 minutes after the user loaded the My Domain login page, Salesforce rejects it with this error. Ask users to complete the login process promptly without leaving the page idle.

Identity Provider Initiated Flow

In the IdP initiated flow, the same 'InResponseTo: Invalid' error message may be returned if the SAML response contains an InResponseTo value — which is unexpected in this flow. In an IdP-initiated flow, the IdP sends a SAML assertion to Salesforce without a prior SAML request from Salesforce, so no InResponseTo value should be present. Configure your IdP to omit the InResponseTo field when sending IdP-initiated assertions to Salesforce.