DE EN IT

~/errors / SAML / SSO

SAML: Invalid audience for this Response (AudienceRestriction)

The identity provider addresses its assertion to one audience, the Entity ID of the service provider. Your app checks that this value equals its own Entity ID and refuses otherwise. Signature and time checks are separate, so this is purely a name mismatch.

daniele@mikweb: ~/errors — less saml-invalid-audience-for-this-response.md

What the message looks like

OneLogin_Saml2_ValidationError: Invalid audience for this Response (expected 'https://cloud.example.com/apps/user_saml/saml/metadata', got 'https://cloud.example.com')

Common causes

  • The Entity ID (audience) configured in the IdP differs from the one in the service provider, often by a trailing slash, http against https, or the metadata URL against a plain name.
  • The IdP application was created for another app or environment, for example test against production, and keeps the old value.
  • The service provider builds its Entity ID from the request URL, and behind a reverse proxy that URL differs from the public one.
  • The IdP metadata was imported before the Entity ID was changed and never refreshed.

Check

  1. What audience does the response carry? (paste the decoded response in a file)
    base64 -d saml-response.b64 | xmllint --format - | grep -i -A2 Audience
  2. What Entity ID does the service provider publish?
    curl -s https://cloud.example.com/index.php/apps/user_saml/saml/metadata | grep -o 'entityID="[^"]*"'
  3. What is stored in the Nextcloud SAML settings?
    sudo -u www-data php occ saml:config:get | grep -i entityid
  4. Does Nextcloud know its public protocol?
    sudo -u www-data php occ config:system:get overwriteprotocol

Fix

  • Pick one exact Entity ID and make both sides identical, character for character, including case and the trailing slash.
  • Enter that value as the audience or Entity ID of the application in the IdP, and as the service provider Entity ID in the app.
  • Behind a proxy, set occ config:system:set overwriteprotocol --value=https and the right host, so the app builds the public address.
  • Re-import or re-save the IdP metadata and the service provider metadata after any change.
  • Log in again in a private window and decode a new response to confirm that the audience now matches.

FAQ

Is this the same as a clock skew error?

No. A clock error shows NotBefore or NotOnOrAfter and is about time. Invalid audience is about names only, and clocks can be perfect.

Should the Entity ID be the metadata URL?

It can be, if both sides use the same. Many IdPs prefill the URL of the metadata, others use a plain name or a URN. What counts is that both sides carry the same string.

daniele@mikweb: ~/tools — ls

Matching tool

daniele@mikweb: ~/blog — ls

Related articles

Nextcloud with SAML and OIDC: 8 errors that keep showing up in supportRedirect loop, clock skew, wrong UID, duplicate accounts, missing groups: 8 SAML/OIDC errors from Nextcloud support — each with the cause and the fix.Mail landing in spam: SPF, DKIM and DMARC alignment explainedSPF, DKIM and DMARC explained simply: what each checks, why mail lands in spam although SPF passes, how to read headers — with a table and checklist.
daniele@mikweb: ~/errors — ls

More errors

invalid_clientOIDC: invalid_client (client authentication failed)SAML signatureSAML error: signature validation failed in Nextcloudinvalid_grantOIDC/OAuth2: invalid_grant at the token endpointredirect_uri_mismatchOIDC: redirect_uri_mismatch / invalid redirect_uriNotBeforeSAML: “not yet valid” – clock skew on NotBefore550 5.7.1SMTP 550 5.7.1: relay access denied and policy rejections

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).

← All error codes