Turns out the open source access connector was sending invalid XML
(&'s were not encoded in the the querystring of the URL within the
authorization response).
When performing searches for secure results with the access connnector
setup, I don't get all the results I should. In the access connector
logs I see more "Permit" responses than I get in search results. It is
not because I need to search with omitted search results included. In
some cases I get no results when I should get some. Why would the
access connector respond with Permit and the GSA not include the
result in the result set?