SP: Assertion contains an unacceptable AudienceRestriction.

[Cantor, Scott]

On 9/21/12 12:00 PM, "Rainer Hoerbe" <rainer at hoerbe.at> wrote:

>I am trying to figure out the mechanics of <ApplicationOverride>. After
>reading NativeSPApplicationOverride back and forth I am stuck:

Vhost-based override or path-based?

>2012-09-21 17:46:52 ERROR OpenSAML.SecurityPolicyRule.AudienceRestriction
>[1]: unacceptable AudienceRestriction in assertion
>(<saml2:AudienceRestriction
>xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Audience>https:
>//pvpsaml2.portalverbund.at/shibboleth</saml2:Audience></saml2:AudienceRes
>triction>)
>
>Shibboleth2.xml:
>        <ApplicationOverride id="pvpsaml2"
>entityID="https://pvpsaml2.portalverbund.at/shibboleth" />

So that means the assertion is carrying the overridden entityID, and so
the error would indicate that the delivery point is to the ACS of a
different application bucket that is using a different (probably the
default) entityID.

>ssl.conf:
> 	<Location /secure>
>	  AuthType shibboleth
>	  ShibRequestSetting applicationId pvpsaml2
>	  ShibRequestSetting requireSession true
>	  require valid-user
>	</Location>

That means you're doing path-based and that means the error is because you
didn't supply a Sessions element in the override with a handlerURL of
/secure/Shibboleth.sso or whatever you prefer.

>http://metadata.portalverbund.at//testfed-metadata.xml:
>The enitityID https://pvpsaml2.portalverbund.at/shibboleth has a proper
>SAML2/POST ACS, otherwise it would not receive the response.

Yes, but the ACS doesn't map to the same applicationId as the resource
that generated the request.

-- Scott