LaineK.95757 (Customer) asked a question.
Hello,
I am getting the following errors when I am trying to authenticate using SAML2 (SP initiated) using Spring security:
OpenSamlAuthenticationProvider Found 1 validation errors in SAML response [id***************************]: [[invalid_assertion] Invalid assertion [idxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] for SAML response [id***************************]: Condition '{urn:oasis:names:tc:SAML:2.0:assertion}AudienceRestriction' of type 'null' in assertion 'idxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' was not valid.: None of the audiences within Assertion 'idxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' matched the list of valid audiances]
2021-11-22 15:15:32,537 http-nio-0.0.0.0-8080-exec-1 DEBUG DefaultAuthenticationEventPublisher No event was found for the exception org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException
2021-11-22 15:15:32,537 http-nio-0.0.0.0-8080-exec-1 TRACE Saml2WebSsoAuthenticationFilter Failed to process authentication request org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException: Invalid assertion [idxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx] for SAML response [id***************************]: Condition '{urn:oasis:names:tc:SAML:2.0:assertion}AudienceRestriction' of type 'null' in assertion 'idxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' was not valid.: None of the audiences within Assertion 'idxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' matched the list of valid audiances
> at org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationProvider.createAuthenticationException(OpenSamlAuthenticationProvider.java:694)
> at org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationProvider.process(OpenSamlAuthenticationProvider.java:516)
> at org.springframework.security.saml2.provider.service.authentication.OpenSamlAuthenticationProvider.authenticate(OpenSamlAuthenticationProvider.java:444)
> at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182)
I think my issue is resolved after putting http://[hostaddress]:8080/saml2/service-provider-metadata/okta for Audience Restriction
This worked for me too. My guess is that this is the default for Spring up until the registration entry. My application.yml contains:
spring:
security:
saml2:
relyingparty:
registration:
okta: