SP: Assertion contains an unacceptable AudienceRestriction.

[Rainer Hoerbe]

Am 21.09.2012 um 18:07 schrieb "Cantor, Scott" <cantor.2 at osu.edu>:

> 

>> 2012-09-21 17:46:52 ERROR OpenSAML.SecurityPolicyRule.AudienceRestriction
>> [1]: unacceptable AudienceRestriction in assertion
>> (<saml2:AudienceRestriction
>> xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Audience>https:
>> //pvpsaml2.portalverbund.at/shibboleth</saml2:Audience></saml2:AudienceRes
>> triction>)
>> 
>> Shibboleth2.xml:
>>       <ApplicationOverride id="pvpsaml2"
>> entityID="https://pvpsaml2.portalverbund.at/shibboleth" />
> 
> So that means the assertion is carrying the overridden entityID, and so
> the error would indicate that the delivery point is to the ACS of a
> different application bucket that is using a different (probably the
> default) entityID.

This is my default SP:
<ApplicationDefaults id="default" policyId="default" entityID="https://samlecho2.hoerbe.at/shibboleth" ... >

The assertion is being delivered to the ACS if the specified entityID.

> 
>> ssl.conf:
>> 	<Location /secure>
>> 	  AuthType shibboleth
>> 	  ShibRequestSetting applicationId pvpsaml2
>> 	  ShibRequestSetting requireSession true
>> 	  require valid-user
>> 	</Location>
> 
> That means you're doing path-based and that means the error is because you
> didn't supply a Sessions element in the override with a handlerURL of
> /secure/Shibboleth.sso or whatever you prefer.

Why should this be path-based? My ssl.conf contains:

<VirtualHost 46.252.26.58:443>
 	ServerName samlecho2.hoerbe.at
	<Location /secure>
	  AuthType shibboleth
	  ShibRequestSetting applicationId default
	  ShibRequestSetting requireSession true
	  require valid-user
	</Location>
</VirtualHost>
<VirtualHost 46.252.26.58:443>
 	ServerName pvpsaml2.portalverbund.at
 	<Location /secure>
	  AuthType shibboleth
	  ShibRequestSetting applicationId pvpsaml2
	  ShibRequestSetting requireSession true
	  require valid-user
	</Location>
</VirtualHost>



> 
>> http://metadata.portalverbund.at//testfed-metadata.xml:
>> The enitityID https://pvpsaml2.portalverbund.at/shibboleth has a proper
>> SAML2/POST ACS, otherwise it would not receive the response.
> 
> Yes, but the ACS doesn't map to the same applicationId as the resource
> that generated the request.

I cannot see why. What do I have to look for?

- Rainer