Assertion contains an unacceptable AudienceRestriction.

[Nate Klingenstein]

If users are arriving at your endpoint with the wrong AudienceRestriction, that's an indication that the entityID in the authentication initiation process and the SP metadata as loaded by the IdP are incorrect, but the endpoints are right.  In effect, users are showing up at your SP with assertions that the SP believes were not issued for it.

I don't believe adding custom relying party will help much, but looking at the logs with the inbound assertion and checking that field value and tracing where it's from should.

On Aug 11, 2013, at 0:12 , Mike Flynn wrote:

> I have 1 school reporting this error after the upgrade.