An IdP-initiated SSO flow is failing intermittently. What combination of Salesforce tools and IdP-side logs should an architect examine to pinpoint whether the problem is on the IdP side or the SP side?