Skip to main content
LibiaoRobot
LibiaoRobot
New Member
October 15, 2025
Solved

SAML error: Invalid assertion with 'coin'

  • October 15, 2025
  • 2 replies
  • 403 views

From the debug, we can see that there is no problem with the time on both sides.

 

image.png

Best answer by LibiaoRobot

This error Code: 6 is caused by an Audience error, duplicate Audience, or inconsistent context. I have a duplicate Audience here, so the error is reported.

 

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

 

If there is an empty Audience, an error Code: 6 will be reported.

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience/> </saml:AudienceRestriction>

 

The correct one is as follows

<saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

 

2 replies

slovepreet
Staff
slovepreet
Staff
October 15, 2025

You can follow these instructions as per this kb

 

 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-fails-with-clock-skew-errors-in/ta-p/222360

 

specifically this part 

config user saml 
    edit <>
        set clock-tolerance <in seconds>      <-- (0-300, 15 by default). 
    next
end

    LibiaoRobot
    LibiaoRobotAuthorAnswer
    New Member
    October 16, 2025

    This error Code: 6 is caused by an Audience error, duplicate Audience, or inconsistent context. I have a duplicate Audience here, so the error is reported.

     

    <saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

     

    If there is an empty Audience, an error Code: 6 will be reported.

    <saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>   <saml:Audience/> </saml:AudienceRestriction>

     

    The correct one is as follows

    <saml:AudienceRestriction>   <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience> </saml:AudienceRestriction>

     

    Terms & ConditionsAccessibility statement