<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Full disclosure, I had a different thread on this configuration before. But, I am now stuck with this error and am at wits end….
<div class="">The default application and shibboleth config with okra, works as expected…the overridden application does not with the error "Assertion contains an unacceptable AudienceRestriction."</div>
<div class=""><br class="">
<div class="">My Shib config:</div>
<div class=""><SPConfig xmlns="urn:mace:shibboleth:2.0:native:sp:config"<br class="">
xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"<br class="">
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"<br class="">
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" <br class="">
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<br class="">
clockSkew="180"><br class="">
<ApplicationDefaults entityID="<a href="https://webserver.mycompany.com" class="">https://webserver.mycompany.com</a>" REMOTE_USER="eppn persistent-id targeted-id"><br class="">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerURL="/Shibboleth.sso" handlerSSL="<br class="">
true" cookieProps="https"><br class="">
<SSO entityID="<a href="http://www.okta.com/exk6c3e6vfIkB7KfI0h7" class="">http://www.okta.com/exk6c3e6vfIkB7KfI0h7</a>">SAML2 SAML1</SSO><br class="">
<Logout>SAML2 Local</Logout><br class="">
<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/><br class="">
<Handler type="Status" Location="/Status" /><br class="">
<Handler type="Session" Location="/Session" showAttributeValues="false"/><br class="">
<Handler type="DiscoveryFeed" Location="/DiscoFeed"/><br class="">
</Sessions><br class="">
<Errors supportContact="root@localhost" helpLocation="/about.html" styleSheet="/shibboleth-sp/main.css"/><br class="">
<MetadataProvider type="XML" validate="true" file="/etc/shibboleth/OktaMetadata.xml"/><br class="">
<MetadataProvider type="XML" validate="true" file="/etc/shibboleth/OktaMetadataCust2.xml"/><br class="">
<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/><br class="">
<AttributeResolver type="Query" subjectMatch="true"/><br class="">
<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/><br class="">
<CredentialResolver type="File" key="keystore/web.key" certificate="keystore/web.crt"/><br class="">
<ApplicationOverride id="cust2" entityID="<a href="https://webserver.mycompany.com/cust2" class="">https://webserver.mycompany.com/cust2</a>"><br class="">
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" handlerURL="/cust2/Shibboleth.sso" hand<br class="">
lerSSL="true" cookieProps="https"><br class="">
<SSO entityID="<a href="http://www.okta.com/exk6l60qelcbBCOaT0h7" class="">http://www.okta.com/exk6l60qelcbBCOaT0h7</a>">SAML2 SAML1</SSO><br class="">
<Logout>SAML2 Local</Logout><br class="">
<md:AssertionConsumerService Location="<a href="https://webserver.mycompany.com/cust2/SAML2/POST" class="">https://webserver.mycompany.com/cust2/SAML2/POST</a>" index="1"<br class="">
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/><br class="">
<md:AssertionConsumerService Location="<a href="https://webserver.mycompany.com/cust2/SAML2/POST-SimpleSign" class="">https://webserver.mycompany.com/cust2/SAML2/POST-SimpleSign</a>" index="2"<br class="">
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/><br class="">
<md:AssertionConsumerService Location="<a href="https://webserver.mycompany.com/cust2/SAML2/Artifact" class="">https://webserver.mycompany.com/cust2/SAML2/Artifact</a>" index="3"<br class="">
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/><br class="">
<md:AssertionConsumerService Location="<a href="https://webserver.mycompany.com/cust2/SAML2/ECP" class="">https://webserver.mycompany.com/cust2/SAML2/ECP</a>" index="4"<br class="">
Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/><br class="">
<md:AssertionConsumerService Location="<a href="https://webserver.mycompany.com/cust2/SAML/POST" class="">https://webserver.mycompany.com/cust2/SAML/POST</a>" index="5"<br class="">
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/><br class="">
<md:AssertionConsumerService Location="<a href="https://webserver.mycompany.com/cust2/SAML/Artifact" class="">https://webserver.mycompany.com/cust2/SAML/Artifact</a>" index="6"<br class="">
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/><br class="">
<Handler type="MetadataGenerator" Location="Metadata" signing="false"/><br class="">
<Handler type="Status" Location="Status"/><br class="">
<Handler type="Session" Location="Session" showAttributeValues="true"/><br class="">
<Handler type="DiscoveryFeed" Location="DiscoFeed"/><br class="">
</Sessions><br class="">
</ApplicationOverride><br class="">
</ApplicationDefaults><br class="">
<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/><br class="">
<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/><br class="">
</SPConfig><br class="">
<br class="">
<div class="">This is my Apache config:</div>
<div class=""><VirtualHost *:443><br class="">
Header set Access-Control-Allow-Origin "*"<br class="">
RewriteEngine on <br class="">
ServerName <a href="http://webserver.mycompany.com" class="">webserver.mycompany.com</a><br class="">
DocumentRoot /var/www/app/html<br class="">
CustomLog /var/log/apache2/web-access.log combined<br class="">
ErrorLog /var/log/apache2/web-error.log<br class="">
LogLevel Debug <br class="">
SSLEngine On<br class="">
SSLProxyEngine On<br class="">
SSLCertificateFile /etc/apache2/keystore/web.crt<br class="">
SSLCertificateKeyFile /etc/apache2/keystore/web.key<br class="">
SSLCACertificateFile /etc/apache2/keystore/client.crt<br class="">
<Location /cust1><br class="">
Header set Cache-Control "max-age=0, must-revalidate"<br class="">
AuthType shibboleth<br class="">
ShibRequestSetting requireSession true<br class="">
ShibUseHeaders On<br class="">
Require shibboleth<br class="">
ProxyPass <a href="https://internal1.mycompany.com:8443" class="">https://internal1.mycompany.com:8443</a><br class="">
ProxyPassReverse https://internal1.mycompany.com:8443<br class="">
</Location><br class="">
<Location /cust2><br class="">
Header set Cache-Control "max-age=0, must-revalidate"<br class="">
AuthType shibboleth<br class="">
ShibRequestSetting requireSession true<br class="">
ShibRequestSetting applicationId cust2<br class="">
ShibUseHeaders On<br class="">
Require shibboleth<br class="">
ProxyPass https://internal2.mycompany.com:8443<br class="">
ProxyPassReverse https://internal2.mycompany.com:8443<br class="">
</Location><br class="">
</VirtualHost><br class="">
This i my Okta config for cust2:</div>
<div class="">Sign On URL<br class="">
<a href="https://webserver.mycompany.com/cust2/Shibboleth.sso/SAML2/POST" class="">https://webserver.mycompany.com/cust2/Shibboleth.sso/SAML2/POST</a><br class="">
Recipient URL<br class="">
https://webserver.mycompany.com/cust2/Shibboleth.sso/SAML2/POST<br class="">
Destination URL<br class="">
https://webserver.mycompany.com/cust2/Shibboleth.sso/SAML2/POST<br class="">
Audience Restriction<br class="">
https://webserver.mycompany.com <br class="">
Default Relay State<br class="">
/cust2/app/<br class="">
<br class="">
</div>
<div class=""><br class="">
</div>
<div class=""><br class="webkit-block-placeholder">
</div>
<div class="">
<div class="">Micky Williamson</div>
<div class=""><br class="">
</div>
<div class=""><font color="#2255ff" class=""><b class="">Senior Technical Leader</b></font></div>
<div class=""><a href="mailto:mwilliamson@silasg.com" class="">mwilliamson@silasg.com</a></div>
<div class="">C - 720 339 7657</div>
<div class="">D - 206 508 4908</div>
<div class=""><br class="">
</div>
<br class="Apple-interchange-newline">
</div>
<br class="">
</div>
</div>
<div style="font-size:9pt; font-family: 'Calibri',sans-serif;">
<div style="background-color:#D5EAFF; border:1px dotted #003333; padding:.8em; ">
<p style="font-size:8pt; line-height:10pt; font-family: 'Cambria','times roman',serif;">
This communication may contain proprietary or other confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message. Any disclosure, copying, or distribution
of this message, or the taking of any action based on it, is strictly prohibited.</p>
</div>
</div>
</body>
</html>