Troubleshooting

Invalid audience / Audience restriction

The assertion is meant for a different application name than the one the application expects. The difference can be a single character: trailing slash, http versus https, URL versus URN, capitals.

“Invalid audience” / “Audience restriction”Audience

Probable cause. The assertion is meant for a different application name than the one the application expects. The difference can be a single character: trailing slash, http vs https, URL vs URN, capitals.

What to do? Compare the Entity ID declared on the IdP side with the application's (visible in its metadata) and make them strictly identical.

To see exactly which check fails, paste the response into theanalyseur, or paste the message into the diagnostic.

Related errors

All SAML and OpenID Connect errors

Want to see it for real? ID-Kit plays the role you are missing and shows you each step.

Open my spaceDecode a SAML response