<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<base href="x-msg://2081/">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Raja,
<div><br>
</div>
<div>You're probably getting that message because of case sensitivity in Shibboleth. I'm not sure why they would be capitalizing it in their response unless it's unsolicited and they just mistyped it and they aren't relying on metadata.</div>
<div><br>
</div>
<div>I'd change the cases to be the same and recommend that Okta consume your SP metadata.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Nate.</div>
<div><br>
<div>
<div>On Mar 11, 2014, at 6:24 PM, "Bhattacharjee, Raja" <<a href="mailto:Raja.Bhattacharjee@Level3.com">Raja.Bhattacharjee@Level3.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div lang="EN-US" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; ">
<div class="WordSection1" style="page: WordSection1; ">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
We have successfully set up federation between our shibboleth SP and another enterprises ADFS IDP.<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
The enterprise is now moving to OKTA as their IDP and we are trying to setup federation which has stopped at a point where we keep getting the error<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 9pt; ">2014-03-11 23:26:51 ERROR OpenSAML.SecurityPolicyRule.AudienceRestriction [59]: unacceptable AudienceRestriction in assertion (<saml2:AudienceRestriction xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><saml2:Audience><a href="https://collaboration-sso.cfer.com/acmetest/Shibboleth</saml2:Audience></saml2:AudienceRestriction>" style="color: purple; text-decoration: underline; ">https://collaboration-sso.cfer.com/acmetest/Shibboleth</saml2:Audience></saml2:AudienceRestriction></a>)<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 9pt; ">2014-03-11 23:26:51 WARN Shibboleth.SSO.SAML2 [59]: detected a problem with assertion: Assertion contains an unacceptable AudienceRestriction.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
My app override is setup as<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> <ApplicationOverride id="acmetest_app" entityID="<a href="https://collaboration-sso.cfer.com/acmetest/shibboleth" style="color: purple; text-decoration: underline; ">https://collaboration-sso.cfer.com/acmetest/shibboleth</a>"<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> signing="false" encryption="false"<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> attributePrefix="AJP_"<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> REMOTE_USER="eppn persistent-id targeted-id"><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> checkAddress="false" handlerSSL="false" cookieProps="http"<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> handlerURL="/acmetest/Shibboleth.sso"><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> <SSO entityID="<a href="http://www.okta.com/j3456m9uj48JDXQOLLMFLLY" style="color: purple; text-decoration: underline; ">http://www.okta.com/j3456m9uj48JDXQOLLMFLLY</a>"><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> SAML2 SAML1<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> </SSO><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> </Sessions><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> <MetadataProvider type="XML" file="/app/sso/shibboleth-sp/metadata/sso-acmetest.metadata.xml"><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> </MetadataProvider><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> <AttributeExtractor type="XML" file="/app/sso/shibboleth-sp/etc/shibboleth/attribute-map.xml"><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> </AttributeExtractor><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="font-size: 8pt; "> </ApplicationOverride><o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
Any idea what might be causing the error? Any guidance that anyone can provide for our enterprise partner in terms of populating the OKTA setup for our SP-initiated app (<span style="color: rgb(31, 73, 125); "><a href="https://support.okta.com/entries/23364161-Configuring-Okta-Template-SAML-2-0-Application" style="color: purple; text-decoration: underline; ">https://support.okta.com/entries/23364161-Configuring-Okta-Template-SAML-2-0-Application</a>)
will be greatly appreciated since OKTA doesn’t provide loading of SP metadata.<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); ">Thanks<o:p></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); "> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<span style="color: rgb(31, 73, 125); ">Raja</span><o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">
<o:p> </o:p></div>
</div>
--<br>
To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: purple; text-decoration: underline; ">users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br>
</div>
</body>
</html>