Assertion contains an unacceptable AudienceRestriction

[Josh Christensen]

The error:
opensaml::FatalProfileException at (http://test.mysite.com:8080/Shibboleth.sso/SAML2/POST)
Assertion contains an unacceptable AudienceRestriction.

ISAPI section:

<Site id="3" name="test.mysite.com" scheme="http" port="8080" />

Request Map

<RequestMap entityID="http://saml.clientidpserver.com" applicationId="SSOTest">
<Host name="test.mysite.com" scheme="http" port="8080">
<Path name="test" authType="shibboleth" requireSession="false"/>
<Path name="home/test" authType="shibboleth" requireSession="false"/>
</Host>
</RequestMap>

SSO declaration

<SSO entityId="http://saml.clientidpserver.com" discoveryProtocol="SAMLDS" discoveryURL="https://www2.accp.clientidpserver.com/esamloutbound/saml?target=Mysite">
SAML2
</SSO>

Application override

<ApplicationOverride id="SSOTest" entityID="http://test.ftnirdc.com:8080" />

Metadata xml

<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor entityID="http://saml.clientidpserver.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">
                <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="false">
                                <KeyDescriptor use="signing">
                                                <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                                                                <ds:X509Data>
                                                                                <ds:X509Certificate>

                                                                                </ds:X509Certificate>
                                                                </ds:X509Data>
                                                </ds:KeyInfo>
                                </KeyDescriptor>
<!-- Supported Name Identifier Formats -->
                                <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
<!-- AuthenticationRequest Consumer endpoint -->
                                <SingleSignOnService isDefault="true" index="0" Location="https://www2.accp.clientidpserver.com/esamloutbound/saml?target=Mysite" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
                </IDPSSODescriptor>
 </EntityDescriptor>

All the searches on google point to the entity ID being wrong, but as you can see, it matches.  We also had the IDP try changing the audience to several variations, none of which worked.  I told the IDP that it should be http://test.mysite.com:8080

Any ideas what is wrong?

Thanks,

Josh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140317/6e67e34d/attachment.html