OKTA IDP and Shibboleth SP

[Bhattacharjee, Raja]

We have successfully set up federation between our shibboleth SP and another enterprises ADFS IDP.
The enterprise is now moving to OKTA as their IDP and we are trying to setup federation which has stopped at a point where we keep getting the error

2014-03-11 23:26:51 ERROR OpenSAML.SecurityPolicyRule.AudienceRestriction [59]: unacceptable AudienceRestriction in assertion (<saml2:AudienceRestriction xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Audience>https://collaboration-sso.cfer.com/acmetest/Shibboleth</saml2:Audience></saml2:AudienceRestriction>)
2014-03-11 23:26:51 WARN Shibboleth.SSO.SAML2 [59]: detected a problem with assertion: Assertion contains an unacceptable AudienceRestriction.

My app override is setup as

        <ApplicationOverride id="acmetest_app" entityID="https://collaboration-sso.cfer.com/acmetest/shibboleth"
                signing="false" encryption="false"
                attributePrefix="AJP_"
                REMOTE_USER="eppn persistent-id targeted-id">
                <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                        checkAddress="false" handlerSSL="false" cookieProps="http"
                        handlerURL="/acmetest/Shibboleth.sso">
                        <SSO entityID="http://www.okta.com/j3456m9uj48JDXQOLLMFLLY">
                                SAML2 SAML1
                        </SSO>
                </Sessions>
                <MetadataProvider type="XML" file="/app/sso/shibboleth-sp/metadata/sso-acmetest.metadata.xml">
                </MetadataProvider>
                <AttributeExtractor type="XML" file="/app/sso/shibboleth-sp/etc/shibboleth/attribute-map.xml">
                </AttributeExtractor>
        </ApplicationOverride>

Any idea what might be causing the error? Any guidance that anyone can provide for our enterprise partner in terms of populating the OKTA setup for our SP-initiated app (https://support.okta.com/entries/23364161-Configuring-Okta-Template-SAML-2-0-Application) will be greatly appreciated since OKTA doesn't provide loading of SP metadata.

Thanks

Raja



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140312/3975e030/attachment.html