Skip to main content
LibiaoRobot
New Member
October 15, 2025
Solved

SAML error: Invalid assertion with 'coin'

From the debug, we can see that there is no problem with the time on both sides.

 

image.png

LibiaoRobot
New Member
October 16, 2025

This error Code: 6 is caused by an Audience error, duplicate Audience, or inconsistent context. I have a duplicate Audience here, so the error is reported.

 

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

 

If there is an empty Audience, an error Code: 6 will be reported.

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience/> </saml:AudienceRestriction>

 

The correct one is as follows

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

 

2 replies

slovepreet
Staff
Staff
October 15, 2025

You can follow these instructions as per this kb

 

 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-fails-with-clock-skew-errors-in/ta-p/222360

 

specifically this part 

config user saml 
    edit <>
        set clock-tolerance <in seconds>      <-- (0-300, 15 by default). 
    next
end

LibiaoRobot
LibiaoRobotAuthorAnswer
New Member
October 16, 2025

This error Code: 6 is caused by an Audience error, duplicate Audience, or inconsistent context. I have a duplicate Audience here, so the error is reported.

 

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

 

If there is an empty Audience, an error Code: 6 will be reported.

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience/> </saml:AudienceRestriction>

 

The correct one is as follows

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

 

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT