<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On 11 June 2015 at 11:57, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span class="">On 6/11/15, 2:06 PM, "Alain O'Dea" <<a href="mailto:alain.odea@gmail.com">alain.odea@gmail.com</a>> wrote:<br>
<br>
<br>
><br>
>It almost works but the SAML token has an AudienceRestriction of<br>
</span>><a href="http://localhost:8080/index.jsp" target="_blank">http://localhost:8080/index.jsp</a> <<a href="http://localhost:8080/index.jsp" target="_blank">http://localhost:8080/index.jsp</a>> which<br>
<span class="">>is the issuer, not the consumer.  The saml-java SP rejects this.<br>
<br>
</span>The audience is whatever you've told that SP to send in its requests as<br>
its identity (the Issuer of the request in other words).<br>
<br>
And that should be what's in the SP's metadata at the IdP in the entityID,<br>
or it wouldn't even respond.<br>
<span class=""><font color="#888888"><br>
-- Scott<br></font></span></blockquote><div><br></div><div>Got it.  Thank you Scott.  That fixed my issue.</div><div><br></div><div>Specifically for the benefit of others (including myself in future):</div><div><br></div><div>I changed <a href="https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19">https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/sample/src/main/webapp/index.jsp#L19</a> to:</div><div>appSettings.setIssuer("<a href="http://localhost:8080/consume.jsp">http://localhost:8080/consume.jsp</a>");<br></div><div><br></div><div>And I changed the relyingPartyIds in the relying-party.xml override that disables assertion encryption:</div><div><br></div><div><div>        <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="http://localhost:8080/consume.jsp">http://localhost:8080/consume.jsp</a>"></div><div>            <property name="profileConfigurations"></div><div>                <list></div><div>                    <bean parent="SAML2.SSO"</div><div>                          p:encryptAssertions="false"</div><div>                          p:signAssertions="#{T(com.google.common.base.Predicates).alwaysTrue()}" /></div><div>                </list></div><div>            </property></div><div>        </bean></div></div><div><br></div><div>And I changed the entityId in my SP metadata to <a href="http://localhost:8080/consume.jsp">http://localhost:8080/consume.jsp</a>.</div></div></div></div>