SAML IDP Sends No Audience

This article explains why a SAML connection with an Identity Provider who's SAML response doesn't include an audience, Audience Restriction attribute, causing the flow to error with invalid audience.

Symptoms

The customer has a SAML connection with an Identity Provider who's SAML response doesn't include an aundience, Audience Restriction attribute, causing the flow to error with "invalid audience".

• SAML Connection
• Audience Restriction

Troubleshooting

The Identity Provider says that this attribute shouldn't be required by the SP, according to SAML protocol.

There's a connection option you can enable with this Management API endpoint.

Using GET, add the connection options object first and add the following key-value pair:

"options" : { 
     ...,
     "checkAudience": false
   }

With this option, the Audience restriction attribute will not be checked.