SAML authentication fails with error "Local entity is not the intended audience of the assertion in at least one Audience restriction"

This article explains how to address PASOE Authentication error "Local entity is not the intended audience of the assertion in at least one AudienceRestriction" when logging in using SAML authentication

Aug 28, 2019
Knowledge

Title

URL Name

SAML-authentication-fails-with-error-Local-entity-is-not-the-intended-audience-of-the-assertion-in-at-least-one-Audience-restriction

Article Number

000113490

Environment

Product: OpenEdge Version: 12.x OS: All supported platforms

Question/Problem Description

SAML authentication fails with error "Local entity is not the intended audience of the assertion in at least one Audience restriction".

PASOE Authentication error "Local entity is not the intended audience of the assertion in at least one AudienceRestriction" is received when logging in using SAML authentication

Steps to Reproduce

Clarifying Information

WEB-INF/metadata/sp.xml reads:

<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#"" entityID="http://sp.myserver.internal:8081/spring-security-saml2-sample/saml/metadata">;

SAML Response reads:

<AudienceRestriction>
<Audience>https://sp.myserver.internal:8081/spring-security-saml2-sample/saml/metadata</Audience>
</AudienceRestriction>

Error Message

Client reads: Unauthorized: authentication failed due to bad credentials Authentication Failed: Error validating SAML message : Response doesn't have any valid assertion which would pass subject validation oepas1.<date>.log reads : 019-08-28T04:15:03.287-04:00 DEBUG [thd-6] ROOT:r:0000000f c.p.a.s.s.OESamlWebssoProfileConsumerImpl - Validation of authentication statement in assertion failed, skipping ... org.opensaml.common.SAMLException: Local entity is not the intended audience of the assertion in at least one AudienceRestriction ... 2019-08-28T04:15:03.288-04:00 ERROR [thd-6] ROOT:r:0000000f c.p.a.s.s.OESamlAuthenticationProvider - Error validating SAML message : Response doesn't have any valid assertion which would pass subject validation 2019-08-28T04:15:03.288-04:00 DEBUG [thd-6] ROOT:r:0000000f o.a.camel.spring.SpringCamelContext - onApplicationEvent: org.springframework.security.authentication.event.AuthenticationFailureServiceExceptionEvent[source=org.springframework.security.saml.SAMLAuthenticationToken@40068bf9: Principal: null; Credentials: [PROTECTED]; Authenticated: false; Details: null; Not granted any authorities] ... org.springframework.security.authentication.AuthenticationServiceException: Error validating SAML message : Response doesn't have any valid assertion which would pass subject validation at com.progress.appserv.services.security.OESamlAuthenticationProvider.authenticate(OESamlAuthenticationProvider.java:83)

Defect Number

Enhancement Number

Cause

Service Provider (SP) entityID in WEB-INF/metadata/sp.xml does not match Audience in SAML Response.

Resolution

Update SP entityID in WEB-INF/metadata/sp.xml or configuration on the Identity Provider (IdP) side so that SP entityID in SPMetadata.xml matches that of Audience in SAML Response.

Workaround

Notes

Keyword Phrase

Last Modified Date

9/25/2019 12:54 PM

SAML authentication fails with error "Local entity is not the intended audience of the assertion in at least one Audience restriction"

Files(0)

Was this article helpful?

Was this article helpful?

SAML authentication fails with error "Local entity is not the intended audience of the assertion in at least one Audience restriction"

Information

Related Articles