Assertion contains an unacceptable AudienceRestriction.

[Mike Flynn]

I have 1 school reporting this error after the upgrade.  I cannot get to my logs right now but looking around on the net I see this:

https://groups.google.com/forum/m/#!topic/shibboleth-users/Oy5Ax26ZRIA


Is the issue that I need to set this for this Idp:

<RelyingParty name="[entityId]"> 
                <NameID nameMapping="shm"/> </RelyingParty>


Thanks!

[Nate Klingenstein]

If users are arriving at your endpoint with the wrong AudienceRestriction, that's an indication that the entityID in the authentication initiation process and the SP metadata as loaded by the IdP are incorrect, but the endpoints are right. In effect, users are showing up at your SP with assertions that the SP believes were not issued for it.

I don't believe adding custom relying party will help much, but looking at the logs with the inbound assertion and checking that field value and tracing where it's from should.

Post by Mike Flynn
I have 1 school reporting this error after the upgrade.

--
To unsubscribe from this list send an email to users-unsubscribe-***@public.gmane.org