Troubleshooting Tip: SSL VPN is not able to connect with error ' Audience is invalid!'

[ssteo]

Description	This article describes that SSL VPN is not able to connect with the error 'Audience is invalid!' with Okta as a SAML identity provider.
Scope	FortiGate, Okta as SAML identity provider.
Solution	FortiGate had configured SSL VPN SAML login using OKTA SAML identity provider but failed to connect. Run the 'diagnose debug application samld -1 ' command and it shows the error below: diagnose debug application samld -1 __samld_sp_login_resp [871]: Audience is invalid! samld_send_common_reply [114]: Code: 6, id: 1168, data_len: 43 samld_send_common_reply [122]: Attr: 22, 8, ÿÿ samld_send_common_reply [122]: Attr: 23, 21, Undefined error. 'Audience is invalid' indicates that FortiGate Service Provider Information 'entity-id ' under user saml is configured differently from Okta settings. The Audience URL, also known as Audience Restriction, specifies the intended recipient of the SAML Assertion. This field might be referred to as the 'Entity ID' by different vendors. While it can be any string, it is usually formatted as a URL, often including the Service Provider’s (SP’s) name. Frequently, the Audience URI matches the Assertion Consumer Service (ACS) URL, also known as the SSO URL. A common cause of the 'Audience is invalid' error is typos in the SP Entity ID, particularly with 'https://' and 'http://'. Re-check that the URL in FortiGate is configured the same as Okta settings.  On Okta saml configuration it is possible to find Entity-ID settings under SAML Configuration -> General -> Audience URI (SP Entity ID). The Audience URI string is case-sensitive. For example, the following two URIs are different audiences and will generate an 'Audience is invalid' error: FortiGate: set entity-id "https://WOOD.example.com:12345/remote/saml/metadata/" Okta SP Entity ID: https://wood.example.com:12345/remote/saml/metadata/ To Trace the SAML Authentication, refer to Technical Tip: How to record a client SAML trace and examine the SAML response: __samld_sp_login_resp [854]: Audience is invalid! samld_send_common_reply [91]: Code: 7, id: 362199, pid: 246, len: 53, data_len 37 If SAML responds with code 7 along with 'Audience is invalid!' in the debug output, there is a configuration mismatch: the username claimed on FortiGate must be same as on the SAML server. The Audience value must exactly match one of the service principal names on the Server. config user saml     edit "OKTA"         set user-name <claim-name>  <----- This must be the same as the username configured on SAML.     next end Related articles: Technical Tip: Configuring SAML SSO login for FortiGate administrators with Okta acting as SAML IdP Troubleshooting Tip: SSL VPN and two-factor expiry timers