Assertion contains an unacceptable AudienceRestriction.

[Micky Williamson]

Full disclosure, I had a different thread on this configuration before.  But, I am now stuck with this error and am at wits end….
The default application and shibboleth config with okra, works as expected…the overridden application does not with the error "Assertion contains an unacceptable AudienceRestriction."

My Shib config:
<SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    clockSkew="180">
  <ApplicationDefaults entityID="https://webserver.mycompany.com" REMOTE_USER="eppn persistent-id targeted-id">
    <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="
true" cookieProps="https">
      <SSO entityID="http://www.okta.com/exk6c3e6vfIkB7KfI0h7">SAML2 SAML1</SSO>
      <Logout>SAML2 Local</Logout>
      <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
      <Handler type="Status" Location="/Status" />
      <Handler type="Session" Location="/Session" showAttributeValues="false"/>
      <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
    </Sessions>
    <Errors supportContact="root at localhost" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/>
    <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/OktaMetadata.xml"/>
    <MetadataProvider type="XML" validate="true" file="/etc/shibboleth/OktaMetadataCust2.xml"/>
    <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
    <AttributeResolver type="Query" subjectMatch="true"/>
    <AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/>
    <CredentialResolver type="File" key="keystore/web.key" certificate="keystore/web.crt"/>
    <ApplicationOverride id="cust2" entityID="https://webserver.mycompany.com/cust2">
      <Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerURL="/cust2/Shibboleth.sso" hand
lerSSL="true" cookieProps="https">
        <SSO entityID="http://www.okta.com/exk6l60qelcbBCOaT0h7">SAML2 SAML1</SSO>
        <Logout>SAML2 Local</Logout>
        <md:AssertionConsumerService Location="https://webserver.mycompany.com/cust2/SAML2/POST" index="1"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
        <md:AssertionConsumerService Location="https://webserver.mycompany.com/cust2/SAML2/POST-SimpleSign" index="2"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
        <md:AssertionConsumerService Location="https://webserver.mycompany.com/cust2/SAML2/Artifact" index="3"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
        <md:AssertionConsumerService Location="https://webserver.mycompany.com/cust2/SAML2/ECP" index="4"
            Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
        <md:AssertionConsumerService Location="https://webserver.mycompany.com/cust2/SAML/POST" index="5"
            Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
        <md:AssertionConsumerService Location="https://webserver.mycompany.com/cust2/SAML/Artifact" index="6"
            Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
        <Handler type="MetadataGenerator" Location="Metadata" signing="false"/>
        <Handler type="Status" Location="Status"/>
        <Handler type="Session" Location="Session" showAttributeValues="true"/>
        <Handler type="DiscoveryFeed" Location="DiscoFeed"/>
      </Sessions>
    </ApplicationOverride>
  </ApplicationDefaults>
  <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
  <ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/>
</SPConfig>

This is my Apache config:
<VirtualHost *:443>
    Header set Access-Control-Allow-Origin "*"
    RewriteEngine on
    ServerName webserver.mycompany.com<http://webserver.mycompany.com>
    DocumentRoot /var/www/app/html
  CustomLog /var/log/apache2/web-access.log combined
  ErrorLog /var/log/apache2/web-error.log
    LogLevel Debug
    SSLEngine On
    SSLProxyEngine On
    SSLCertificateFile /etc/apache2/keystore/web.crt
    SSLCertificateKeyFile /etc/apache2/keystore/web.key
    SSLCACertificateFile /etc/apache2/keystore/client.crt
    <Location /cust1>
        Header set Cache-Control "max-age=0, must-revalidate"
        AuthType shibboleth
        ShibRequestSetting requireSession true
        ShibUseHeaders On
        Require shibboleth
        ProxyPass            https://internal1.mycompany.com:8443
        ProxyPassReverse     https://internal1.mycompany.com:8443
    </Location>
    <Location /cust2>
        Header set Cache-Control "max-age=0, must-revalidate"
        AuthType shibboleth
        ShibRequestSetting requireSession true
        ShibRequestSetting applicationId cust2
        ShibUseHeaders On
        Require shibboleth
        ProxyPass            https://internal2.mycompany.com:8443
        ProxyPassReverse     https://internal2.mycompany.com:8443
    </Location>
</VirtualHost>
This i my Okta config for cust2:
Sign On URL
https://webserver.mycompany.com/cust2/Shibboleth.sso/SAML2/POST
Recipient URL
https://webserver.mycompany.com/cust2/Shibboleth.sso/SAML2/POST
Destination URL
https://webserver.mycompany.com/cust2/Shibboleth.sso/SAML2/POST
Audience Restriction
https://webserver.mycompany.com
Default Relay State
/cust2/app/



Micky Williamson

Senior Technical Leader
mwilliamson at silasg.com<mailto:mwilliamson at silasg.com>
C - 720 339 7657
D  - 206 508 4908




This communication may contain proprietary or other confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160714/c4edc0af/attachment-0001.html>