Understanding the Audience URI in Okta
Last Updated:
Overview
The Audience URI is an essential configuration component for Single Sign-On (SSO) in custom Security Assertion Markup Language (SAML) or Okta Integration Network (OIN) app integrations within Okta. The Audience URI determines the intended recipient for the SAML assertion. The Service Provider (SP) provides the Audience URI directly.
Applies To
- Okta Identity Engine (OIE)
- Okta Classic Engine
- Okta Integration Network (OIN)
- Security Assertion Markup Language (SAML) App Configuration
- Single Sign-On (SSO)
Solution
What is the function of the Audience URI?
The Audience URI, or Audience Restriction, determines the intended recipient or audience for the SAML assertion. Vendors might also refer to this field as the Entity ID. The Audience URI accepts any string of data up to 1024 characters long but typically formats as a URL, often incorporating the SP name. In many cases, the Audience URI aligns with the Assertion Consumer Service (ACS) URL, also known as the SSO URL.
The Audience URI is obtained directly from the Service Provider.
If the SP SSO configuration instructions omit the Audience URI, obtain the URI directly from the SP.
How does Okta handle multiple Identity Providers?
SAML applications in Okta support only one Audience URI per application. If the application facilitates multiple Identity Providers (IdPs), configure separate applications for each URL.
