I am trying to integrate Microsoft Entra ID for MFA with a Web App, and so far have completed the cycle of MFA and got the session authenticated. However, post authentication when the redirection action happens from Shibboleth I am receiving the below error:

opensaml::SecurityPolicyException
The system encountered an error at Thu Aug 1 14:57:03 2024
To report this problem, please contact the site administrator at root@localhost.
Please include the following message in any email:
opensaml::SecurityPolicyException at (https://DemoEntraIDIntegration/safeselfservice)
Attempt to spoof header (HTTP_SHIBSESSIONID:) was detected.

Can anyone please help find the cause and address the header spoofing issue ?

1. Ensured the Shibboleth Configurations are in place.
2. Ensured the Attribute mapping is in the right order.
3. Ensured that the right metadata is used and Reply URL is correctly configured.
4. Tried to trace log information in IIS for the error – nothing could be found.