We have seen the SSO errors with Salesforce happen sporadically. Any advice?  Here is the error I get:

Single Sign-On Error
We can't log you in. Check for an invalid assertion in the SAML Assertion Validator (available in Single Sign-On Settings) or check the login history for failed logins.

The logins will work in subsequent attempts. Here's what I've found in the login history. As you can see, the login succede and fail randomly:

Username Login Time (Eastern Daylight Time) Source IP Login Type Status Browser Platform Application Client Version API Type API Version Login URL TLS Protocol TLS Cipher Suite Country Code Country Subdivision City PostalCode Latitude Longitude
abc@abc.com 1/19/2017 9:30 209.36.16.130 SAML Sfdc Initiated SSO Success Chrome 55 Windows 7 Browser N/A N/A N/A abc.my.salesforce.com TLS 1.2 ECDHE-RSA-AES256-GCM-SHA384 US United States Rhode Island West Warwick 2893 41.697 -71.5254
abc@abc.com 1/19/2017 9:05 209.36.16.130 SAML Sfdc Initiated SSO Failed: InResponseTo Invalid Chrome 55 Windows 7 Browser N/A N/A N/A abc.my.salesforce.com TLS 1.2 ECDHE-RSA-AES256-GCM-SHA384
abc@abc.com 1/19/2017 9:05 209.36.16.130 SAML Sfdc Initiated SSO Failed: InResponseTo Invalid Chrome 55 Windows 7 Browser N/A N/A N/A abc.my.salesforce.com TLS 1.2 ECDHE-RSA-AES256-GCM-SHA384
abc@abc.com 1/19/2017 9:02 209.36.16.130 SAML Sfdc Initiated SSO Success Chrome 55 Windows 7 Browser N/A N/A N/A abc.my.salesforce.com TLS 1.2 ECDHE-RSA-AES256-GCM-SHA384 US United States Rhode Island West Warwick 2893 41.697 -71.5254
abc@abc.com 1/19/2017 8:56 209.36.16.130 SAML Sfdc Initiated SSO Failed: InResponseTo Invalid Chrome 55 Windows 7 Browser N/A N/A N/A abc.my.salesforce.com TLS 1.2 ECDHE-RSA-AES256-GCM-SHA384