WP is SSO provider. . . .
My suspicion was the new security thing (that I can’t quite remember what it was now) caused the problem. They had http:// rather than https:// for the SSO_URL, even though the site was https (and I guess redirecting to https so it still worked). But that doesn’t seem to make sense either.