Okta AudienceRestriction Interoperability Question
Klingenstein, Nate
nklingenstein at calstate.edu
Mon Sep 18 16:50:17 EDT 2017
This one is way down in the weeds.
I have a Shibboleth SP that is successfully issuing requests to both Okta IdP's and Shibboleth IdP's. Assertions from one of the Okta IdP's are failing verification because of an AudienceRestriction mismatch, but I can't for the life of me see what it is. Second pairs of eyes welcome, and sorry for the walls of text; I just wanted it to be verbatim(minus PII) since I really can't see it.
I'll be asking them to change the format of the attributes and I believe I redacted the sensitive stuff, although it's okay if I missed something.
Works:
2017-09-18 10:00:46 DEBUG Shibboleth.SSO.SAML2 [52]: decrypted Assertion: <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_7026d9711896ff5b45efa5455bdfc28a" IssueInstant="2017-09-18T17:00:46.166Z" Version="2.0"><saml2:Issuer>https://idp-co.calstate.edu/idp/shibboleth</saml2:Issuer><saml2:Subject><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://idp-co.calstate.edu/idp/shibboleth" SPNameQualifier="https://login.calstate.edu/mfa/cfs">AAdzZWNyZXQxCjZJmlAJ2FW2rOLfk4hHe75BPcLB3hAfKahI45tzB6CB/EepdlTENRHg4atn5nndBXaDc8TKisnWKfmI29gYjovl57tJW3YiuFbtlM/9TlgTngS+vxCDa+JetmjTdm2WWQZYdnCIP5UEJg==</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData Address="137.145.7.5" InResponseTo="_13a19408c4dd8d6207ea4b51370a1fb2" NotOnOrAfter="2017-09-18T17:05:46.166Z" Recipient="https://login.calstate.edu/cfsmfahandler/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2017-09-18T17:00:46.166Z" NotOnOrAfter="2017-09-18T17:05:46.166Z"><saml2:AudienceRestriction><saml2:Audience>https://login.calstate.edu/mfa/cfs</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2017-09-18T17:00:46.119Z" SessionIndex="_6d1eaa69311264a940d8c10d208fa3ea"><saml2:SubjectLocality Address="137.145.7.5"/><saml2:AuthnContext><saml2:AuthnContextClassRef>https://iam.calstate.edu/csuconnect/mfa</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement><saml2:Attribute FriendlyName="telephoneNumber" Name="urn:oid:2.5.4.20" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="displayName" Name="urn:oid:2.16.840.1.113730.3.1.241" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="calstateEduPersonID" Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.17" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>******</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="givenName" Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="calstateEduPersonEmplID" Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="sn" Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xsd:string">lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="title" Name="urn:oid:2.5.4.12" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Manager, FIS</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="calstateEduPersonOrg" Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.15" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>co</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="calstateEduPersonAffiliation" Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>Employee Staff MPP</saml2:AttributeValue><saml2:AttributeValue>Employee Staff</saml2:AttributeValue><saml2:AttributeValue>Employee State</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="mail" Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>lala at calstate.edu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute FriendlyName="calstateEduPersonPrincipalName" Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.14" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"><saml2:AttributeValue>lalala at co.calstate.edu</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion>
Doesn't work:
2017-09-18 11:02:48 DEBUG OpenSAML.MessageDecoder.SAML2POST [51]: decoded SAML message:
<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://login.calstate.edu/mfahandler/Shibboleth.sso/SAML2/POST" ID="id27803518502426285296897691" IssueInstant="2017-09-18T18:02:48.243Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema"><saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">http://www.okta.com/exke78y014UGy9E3k0x7</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#id27803518502426285296897691"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>547VjPLRbxjeiznrV/KuuLG/5jaHsKKdzFUPdsioVrU=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>Rz6UdGxb78h0p5VU+5MTq6f5Aam0FBoea2VH+Bc6bHeSHDcQTysFObso59poOStw2fkFwOs4GkVBF5dXFAavDtNSadxRp2bTEtx+d+EC98ABclZYyIXYcPlzHAz3CjZZutlGJJ+UGBCNbgwLFG9uf9qsH4/JquQ+O968wIhLMTf0wsODMeLk3txB9yNZeuwz3ceXZCuLEF0RR9wdbKWjW1SuH4JNeZO/rOqNCRzx2PHs1yOKWEHcTZs/WzedUbbpMKWuPuQo6pg6kljV5Uy3DMGUsix40iXZJ3OwBj8y13E3RDRMi84Fhd82LRaLq2DWamK+EzcG2dl9lG1Y2Ke+UQ==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDmDCCAoCgAwIBAgIGAU89vyseMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJVUzETMBEG
A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
MBIGA1UECwwLU1NPUHJvdmlkZXIxDTALBgNVBAMMBHNqc3UxHDAaBgkqhkiG9w0BCQEWDWluZm9A
b2t0YS5jb20wHhcNMTUwODE3MjIxODQyWhcNNDUwODE3MjIxOTQyWjCBjDELMAkGA1UEBhMCVVMx
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9r
dGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMQ0wCwYDVQQDDARzanN1MRwwGgYJKoZIhvcNAQkBFg1p
bmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnDdx/9EV9c59Y8XQ
tYXYHTEVKhV2NVarpAaa8Yxlb8ugpR9ikBeXDJC4mD8afK/13vEtNWEWHdaMT04VP8Vx+HtEJXtH
eLPXuvBmQpbVYy3qeLZe0Yrx+LmEqivHmUhgqSIJpzE7wkfGGLgRzjt6grjDpmCtF4lbDiGLpowO
tIR4kfsrzicJXCuw7ekIJSLBe/kH0O/yfvd2fhKq/zmaIfYk0gCxXLCrWE+6Xt11qKGFVIlxkeW1
xQvp611gm+WA1uJSiFsFWzMwclQtWqUB00PU+SNb91xJctrtzTciCLg8wqh3SxAZJojpJazQr9W5
3MLMr+IB3quKQmrrA4pBRwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA8av+VbkVmwe7BGtRuyfdC
ID4LHvwcW/09E53Wk9u0IZTYTwctbbp3yntJ/IPkIJfcbI44adgcnALXwkD/aAlUZhR3dEFQ81LB
v0ThHEYKYpapeUPZOFQPevjcdLYsGMo3bBMFauj0+BaeQV0Xd/yzXdP0ofmVH9ED7AiwD4gF3LeO
qS73FqC/aCRTnNyae958ajlijgz9SuFQ9Mtvb9ydovjMCd3sDjVH2lrNI3DccQW0DNyo1MDJaPsV
yE30LMCgSvjwltWzQ8h5+cOJr0aWFbxYVgt+EWE2rV5Z++houQtM/1izLducanTAAM1G359CJaMW
ZepgKykiF13Amw6y</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2p:Status xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></saml2p:Status><saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="id278035185024560501848815467" IssueInstant="2017-09-18T18:02:48.243Z" Version="2.0" xmlns:xs="http://www.w3.org/2001/XMLSchema"><saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">http://www.okta.com/exke78y014UGy9E3k0x7</saml2:Issuer><ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><ds:SignedInfo><ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/><ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/><ds:Reference URI="#id278035185024560501848815467"><ds:Transforms><ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/><ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"><ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="xs"/></ds:Transform></ds:Transforms><ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><ds:DigestValue>7v3BTUYPyUnmcEO7pTUoxakPiKDApe3jS/ixJCMI/M4=</ds:DigestValue></ds:Reference></ds:SignedInfo><ds:SignatureValue>XLGjyaM7lMiz6W90WwAg77th+0xoCQzm3UM9LXyKJlMwC300cequ0GsdLaj3MSbDK9yGZpSx+NMQ1QuKpSN4/TF3B6THurflS+dC7h6EfKn2Ifi5qBGuMvyIEP1WC+D2X4VQQlMxQs5NzLBGEF2ODMlu54jT9ZAEr0IqBbuRN2Lx7vvtpr4lod3lBeA3BG961pfKSQq+USD1j7ZvsR5uN0E89yG4vhtq9l5Pw/46tC5cKFevXutZntd5GRRAatzjy62lr/FTdtQktMYBTgi1avU775bVrMpdDtdm/HinE3xFafkfxvXdDV6djLJbsoLcRQJ1aRimSekXRyTxdml/CA==</ds:SignatureValue><ds:KeyInfo><ds:X509Data><ds:X509Certificate>MIIDmDCCAoCgAwIBAgIGAU89vyseMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJVUzETMBEG
A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
MBIGA1UECwwLU1NPUHJvdmlkZXIxDTALBgNVBAMMBHNqc3UxHDAaBgkqhkiG9w0BCQEWDWluZm9A
b2t0YS5jb20wHhcNMTUwODE3MjIxODQyWhcNNDUwODE3MjIxOTQyWjCBjDELMAkGA1UEBhMCVVMx
EzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9r
dGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMQ0wCwYDVQQDDARzanN1MRwwGgYJKoZIhvcNAQkBFg1p
bmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnDdx/9EV9c59Y8XQ
tYXYHTEVKhV2NVarpAaa8Yxlb8ugpR9ikBeXDJC4mD8afK/13vEtNWEWHdaMT04VP8Vx+HtEJXtH
eLPXuvBmQpbVYy3qeLZe0Yrx+LmEqivHmUhgqSIJpzE7wkfGGLgRzjt6grjDpmCtF4lbDiGLpowO
tIR4kfsrzicJXCuw7ekIJSLBe/kH0O/yfvd2fhKq/zmaIfYk0gCxXLCrWE+6Xt11qKGFVIlxkeW1
xQvp611gm+WA1uJSiFsFWzMwclQtWqUB00PU+SNb91xJctrtzTciCLg8wqh3SxAZJojpJazQr9W5
3MLMr+IB3quKQmrrA4pBRwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQA8av+VbkVmwe7BGtRuyfdC
ID4LHvwcW/09E53Wk9u0IZTYTwctbbp3yntJ/IPkIJfcbI44adgcnALXwkD/aAlUZhR3dEFQ81LB
v0ThHEYKYpapeUPZOFQPevjcdLYsGMo3bBMFauj0+BaeQV0Xd/yzXdP0ofmVH9ED7AiwD4gF3LeO
qS73FqC/aCRTnNyae958ajlijgz9SuFQ9Mtvb9ydovjMCd3sDjVH2lrNI3DccQW0DNyo1MDJaPsV
yE30LMCgSvjwltWzQ8h5+cOJr0aWFbxYVgt+EWE2rV5Z++houQtM/1izLducanTAAM1G359CJaMW
ZepgKykiF13Amw6y</ds:X509Certificate></ds:X509Data></ds:KeyInfo></ds:Signature><saml2:Subject xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient">000011259</saml2:NameID><saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml2:SubjectConfirmationData NotOnOrAfter="2017-09-18T18:07:48.243Z" Recipient="https://login.calstate.edu/mfahandler/Shibboleth.sso/SAML2/POST"/></saml2:SubjectConfirmation></saml2:Subject><saml2:Conditions NotBefore="2017-09-18T17:57:48.243Z" NotOnOrAfter="2017-09-18T18:07:48.243Z" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:AudienceRestriction><saml2:Audience>https://login.calstate.edu/mfa/cfs</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions><saml2:AuthnStatement AuthnInstant="2017-09-18T18:02:48.243Z" SessionIndex="id1505757768243.63999903" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:AuthnContext><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></saml2:AuthnContext></saml2:AuthnStatement><saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Attribute Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.14" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">lalala at sjsu.edu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">Employee Staff</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.15" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">sjsu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:2.16.840.1.113730.3.1.241" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">lala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">lalala</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">la.lala at sjsu.edu</saml2:AttributeValue></saml2:Attribute><saml2:Attribute Name="urn:oid:1.3.6.1.4.1.10396.2.1.1.17" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"><saml2:AttributeValue xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="xs:string">number</saml2:AttributeValue></saml2:Attribute></saml2:AttributeStatement></saml2:Assertion></saml2p:Response>
2017-09-18 11:02:48 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: extracting issuer from SAML 2.0 protocol message
2017-09-18 11:02:48 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: message from (http://www.okta.com/exke78y014UGy9E3k0x7)
2017-09-18 11:02:48 DEBUG OpenSAML.MessageDecoder.SAML2 [51]: searching metadata for message issuer...
2017-09-18 11:02:48 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [51]: evaluating message flow policy (replay checking on, expiration 60)
2017-09-18 11:02:48 DEBUG XMLTooling.StorageService [51]: inserted record (id27803518502426285296897691) in context (MessageFlow) with expiration (1505758008)
2017-09-18 11:02:48 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [51]: validating signature profile
2017-09-18 11:02:48 DEBUG XMLTooling.TrustEngine.ExplicitKey [51]: attempting to validate signature with the peer's credentials
2017-09-18 11:02:48 DEBUG XMLTooling.TrustEngine.ExplicitKey [51]: signature validated with credential
2017-09-18 11:02:48 DEBUG OpenSAML.SecurityPolicyRule.XMLSigning [51]: signature verified against message issuer
2017-09-18 11:02:48 DEBUG Shibboleth.SSO.SAML2 [51]: processing message against SAML 2.0 SSO profile
2017-09-18 11:02:48 DEBUG Shibboleth.SSO.SAML2 [51]: extracting issuer from SAML 2.0 assertion
2017-09-18 11:02:48 DEBUG OpenSAML.SecurityPolicyRule.MessageFlow [51]: evaluating message flow policy (replay checking on, expiration 60)
2017-09-18 11:02:48 DEBUG XMLTooling.StorageService [51]: inserted record (id278035185024560501848815467) in context (MessageFlow) with expiration (1505758008)
2017-09-18 11:02:48 ERROR OpenSAML.SecurityPolicyRule.AudienceRestriction [51]: unacceptable AudienceRestriction in assertion (<saml2:AudienceRestriction xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Audience>https://login.calstate.edu/mfa/cfs</saml2:Audience></saml2:AudienceRestriction>)
2017-09-18 11:02:48 WARN Shibboleth.SSO.SAML2 [51]: detected a problem with assertion: Assertion contains an unacceptable AudienceRestriction.
2017-09-18 11:02:49 DEBUG Shibboleth.Listener [51]: dispatching message (default/SAML2/POST)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170918/8b08f89a/attachment-0001.html>
More information about the users
mailing list