Assertion contains an unacceptable AudienceRestriction

[Eric Goodman]

I recall that there was a Shib bug in older IdP versions (sorry, can't find the reference right now) where AudienceRestrictions weren't properly handled. If you're not on the most up to date version that could be the issue.

--- Eric

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Josh Christensen
Sent: Monday, March 17, 2014 2:44 PM
To: users at shibboleth.net
Subject: Assertion contains an unacceptable AudienceRestriction

The error:
opensaml::FatalProfileException at (http://test.mysite.com:8080/Shibboleth.sso/SAML2/POST)
Assertion contains an unacceptable AudienceRestriction.

ISAPI section:

<Site id="3" name="test.mysite.com" scheme="http" port="8080" />

Request Map

<RequestMap entityID="http://saml.clientidpserver.com" applicationId="SSOTest">
<Host name="test.mysite.com" scheme="http" port="8080">
<Path name="test" authType="shibboleth" requireSession="false"/>
<Path name="home/test" authType="shibboleth" requireSession="false"/>
</Host>
</RequestMap>

SSO declaration

<SSO entityId="http://saml.clientidpserver.com" discoveryProtocol="SAMLDS" discoveryURL="https://www2.accp.clientidpserver.com/esamloutbound/saml?target=Mysite">
SAML2
</SSO>

Application override

<ApplicationOverride id="SSOTest" entityID="http://test.ftnirdc.com:8080" />

Metadata xml

<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor entityID="http://saml.clientidpserver.com" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xsi="https://www.w3.org/2001/XMLSchema-instance">
                <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="false">
                                <KeyDescriptor use="signing">
                                                <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
                                                                <ds:X509Data>
                                                                                <ds:X509Certificate>

                                                                                </ds:X509Certificate>
                                                                </ds:X509Data>
                                                </ds:KeyInfo>
                                </KeyDescriptor>
<!-- Supported Name Identifier Formats -->
                                <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
<!-- AuthenticationRequest Consumer endpoint -->
                                <SingleSignOnService isDefault="true" index="0" Location="https://www2.accp.clientidpserver.com/esamloutbound/saml?target=Mysite" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
                </IDPSSODescriptor>
 </EntityDescriptor>

All the searches on google point to the entity ID being wrong, but as you can see, it matches.  We also had the IDP try changing the audience to several variations, none of which worked.  I told the IDP that it should be http://test.mysite.com:8080

Any ideas what is wrong?

Thanks,

Josh
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140318/15c307cf/attachment.html