OKTA IDP and Shibboleth SP

[Nate Klingenstein]

Raja,

You're probably getting that message because of case sensitivity in Shibboleth.  I'm not sure why they would be capitalizing it in their response unless it's unsolicited and they just mistyped it and they aren't relying on metadata.

I'd change the cases to be the same and recommend that Okta consume your SP metadata.

Thanks,
Nate.

On Mar 11, 2014, at 6:24 PM, "Bhattacharjee, Raja" <Raja.Bhattacharjee at Level3.com<mailto:Raja.Bhattacharjee at Level3.com>> wrote:

We have successfully set up federation between our shibboleth SP and another enterprises ADFS IDP.
The enterprise is now moving to OKTA as their IDP and we are trying to setup federation which has stopped at a point where we keep getting the error

2014-03-11 23:26:51 ERROR OpenSAML.SecurityPolicyRule.AudienceRestriction [59]: unacceptable AudienceRestriction in assertion (<saml2:AudienceRestriction xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Audience>https://collaboration-sso.cfer.com/acmetest/Shibboleth</saml2:Audience></saml2:AudienceRestriction>)
2014-03-11 23:26:51 WARN Shibboleth.SSO.SAML2 [59]: detected a problem with assertion: Assertion contains an unacceptable AudienceRestriction.

My app override is setup as

        <ApplicationOverride id="acmetest_app" entityID="https://collaboration-sso.cfer.com/acmetest/shibboleth"
                signing="false" encryption="false"
                attributePrefix="AJP_"
                REMOTE_USER="eppn persistent-id targeted-id">
                <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
                        checkAddress="false" handlerSSL="false" cookieProps="http"
                        handlerURL="/acmetest/Shibboleth.sso">
                        <SSO entityID="http://www.okta.com/j3456m9uj48JDXQOLLMFLLY">
                                SAML2 SAML1
                        </SSO>
                </Sessions>
                <MetadataProvider type="XML" file="/app/sso/shibboleth-sp/metadata/sso-acmetest.metadata.xml">
                </MetadataProvider>
                <AttributeExtractor type="XML" file="/app/sso/shibboleth-sp/etc/shibboleth/attribute-map.xml">
                </AttributeExtractor>
        </ApplicationOverride>

Any idea what might be causing the error? Any guidance that anyone can provide for our enterprise partner in terms of populating the OKTA setup for our SP-initiated app (https://support.okta.com/entries/23364161-Configuring-Okta-Template-SAML-2-0-Application) will be greatly appreciated since OKTA doesn’t provide loading of SP metadata.

Thanks

Raja



--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140312/087b8cd2/attachment-0001.html