SSO Behavior in Sandbox (MxC tab, then launch base MMS URL)

I am creating this ticket so that we have something to track work/comments against.

We have configured SSO in the Sandbox, and it is mostly working. There is one thing that is remaining, and I am not sure what can be done about it. I have entered this as a Research Spike, as we are planning to try to switch on SSO for MxC on Sunday 13 Feb 2022, and I don't want to have to deploy code between then and now.

1. Identify why this is happening
2. Is there a possible workaround? If so, what is it?

Steps to reproduce

1. Clear your browser cache
2. Quit/Close your browser
3. Launch a brand new browser session, NOT just an incognito/private tab
4. Login to MxC (https://m-cfasbx.cfainformdev.net/), via OKTA
   • will.englefield / MacromatixDev21
   • You will now have an MxC tab open
5. Launch a second tab
6. Navigate to the base MMS url (For sandbox, this is: https://cfasbx.cfainformdev.net/)
   • Result: the user is logged in to MMS
   • Expected Result: user is NOT logged in to MMS, see example/use case/flow below:

Try this again, only a little different

1. Login to MxC (https://m-cfasbx.cfainformdev.net/), via OKTA
   • will.englefield / MacromatixDev21
   • You will now have an MxC tab open
2. Launch a second tab
3. This time navigate to a longer URL, more than the base MMS (e.g. https://cfasbx.cfainformdev.net/MMS_Stores_ExternalSite.aspx?url=/Inventory/Count/History&MenuCustomItemID=456)
   • Result: Everything seems to work as expected
   • In this case the user sees the MMS logon page, and after 5 seconds gets redirected to MxC