session.logon.last.password is not dectecting in session variables, SSO failing..

Log the variable to see if it is missing or faulty following https://support.f5.com/csp/article/K11253 and also article https://support.f5.com/csp/article/K07645403 as the password is a secure objects and some changes are needed to be logged .

Also check you SSO credential mapping agent https://techdocs.f5.com/en-us/bigip-15-1-0/big-ip-access-policy-manager-visual-policy-editor/access-policy-item-reference/about-assignment-items/about-sso-credential-mapping.html , as you may need to use it or the variable assign agent to modify the variable if it needs to be different.