SAML Authentication with Cloud Identity Engine (CIE) is failed with "CSP ID mismatch" message in System Logs

• Authentication Profile is configured to use Cloud Identity Engine (CIE) as SAML provider.
• Client Authentication fails with the following message in System Log (show log system) and authd.log.

Failed to parse CAS token from client 'xxx.xxx.xxx.xxx' from 'https://cloud-auth.jp.apps.paloaltonetworks.com/auth' with auth_session_id 
'********-****-****-****-************' : CSP ID mismatch (received AAA vs on-device BBB) for CAS profile "********-****-****-****-************" ; 
tenant "<TENANT_ID>" ; region "<REGION>" ; username "<USERNAME>"

• Palo Alto Next Generation Firewalls (NGFW)
• Cloud Identity Engine (CIE) is activated
• Firewalls using CIE as SAML authentication provider

As displayed in the error message, the CSP ID associating CIE (AAA in above sample log message) and CSP ID cached locally by authd process (BBB in above sample log message) are different.

This issue can be resolved by restarting authd process with following CLI command:

> debug software restart process authd