[External] Re: Error: Assertion contains an unacceptable AudienceRestriction

[Peter Schober]

* Andrea Giammaria via users <users at shibboleth.net> [2020-10-29 17:11]:
> I've set the applicationid in the vhost to match the ID I have in shibboleth2.xml for custom attribute mapping:
> 
> <ApplicationOverride entityID="https://testhd.test.mydomain/shibboleth" id="testhd">
> 	<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map-testhd.xml"/>
> </ApplicationOverride>

You're saying the override is necessary to map the same input data
(SAML attribute 2-tuples of Name and NameFormat) to different internal
attributes based on the vhost?

(Sorry to be questioning your motivation, with overrides questioning
their use has been pretty much established procedure here. ;))

Anyway, did you give the IDP metadata specific for that override?
It needs its own handlerURL, IIRC, so the protocol endpoints need to
be specific for the override.
Check the exact endpoint the assertion came in at to rule this out.

-peter