AuthTrace › Guides
How to fix a SAML audience mismatch
An audience mismatch is the most common reason a SAML sign-in fails right after the identity provider (IdP) says "success". The user enters their password, gets sent back to the application, and sees something like AudienceRestriction not satisfied, Invalid audience, SAML assertion audience mismatch or a generic "sign-in failed" page.
What it means
Every SAML assertion carries an <Audience> value inside <Conditions><AudienceRestriction>. It names the service provider (SP) the assertion was issued for. The SP compares it with its own entity ID and rejects the assertion if they are not identical. This stops an assertion issued for one application being replayed against another.
So an audience mismatch always means two strings disagree:
| Where | What it is called |
|---|---|
| In the IdP configuration | Identifier, Entity ID, Audience URI, SP Entity ID, Relying party identifier (ADFS) |
| In the SP configuration / metadata | Entity ID, Issuer, SP identifier - also sent as <Issuer> in the AuthnRequest |
Find the two values
- Open DevTools on the sign-in tab and choose the AuthTrace panel (or open the Network panel and look for the POST that carries
SAMLResponse). - Sign in. AuthTrace shows the AuthnRequest going to the IdP and the SAML Response coming back.
- The diagnosis shows both values side by side, for example:
Audience in assertion: https://app.northwind.example/ SP entity ID (AuthnRequest Issuer): https://app.northwind.example/saml/metadata
If the flow is IdP-initiated (no AuthnRequest), take the SP's entity ID from its metadata XML: it is the entityID attribute on <EntityDescriptor>.
The usual culprits
- Trailing slash:
https://app.example.comvshttps://app.example.com/. Not the same string. - Metadata URL vs base URL: many SPs use their metadata URL as entity ID (
.../saml/metadata), while admins type the site URL into the IdP. - Scheme or case:
httpvshttps, orurn:Example:Appvsurn:example:app. - Test vs production: the IdP app was cloned from a staging app and still carries the staging identifier.
- Several identifiers: Entra ID allows more than one Identifier; the first (default) one is sent as Audience unless the SP's AuthnRequest names another.
Where to fix it
Change the IdP side to match the SP's entity ID exactly - it is usually easier than changing the SP.
- Microsoft Entra ID: Enterprise applications › your app › Single sign-on › Basic SAML Configuration › Identifier (Entity ID). Mark the correct one as Default.
- Okta: Applications › your app › General › SAML Settings › Edit › Audience URI (SP Entity ID).
- ADFS: Relying Party Trusts › your trust › Properties › Identifiers › Relying party identifier.
- Google Workspace: Apps › Web and mobile apps › your app › Service provider details › Entity ID.
- Keycloak (as IdP): the client's Client ID is the expected SP entity ID.
Check the fix
Sign in again with AuthTrace open. The audience finding disappears and the response shows a green signature check. If a different error appears next - for example Wrong ACS URL or Assertion not valid yet - that is the next thing in line; AuthTrace lists every problem it sees, not just the first.