Session Cookie Domain Not Set

Make sure to set both the domain AND the web-host-name. If you fail to do that on an appliance that has multiple interfaces, your session cookie will not randomly have a domain or not on standard junctions, based on how the appliance auto-detected it's host name. Confusingly, it meanwhile works as intended on VHost junctions leaving SSO to fail when you move between the two types.

web-host-name =
domain =