Troubleshooting Tip: SSL VPN is not able to connect with error ' Audience is invalid!'

[ssteo]

Description	This article describes that SSLVPN is not able to connect with the error ' Audience is invalid!' with Okta as SAML identity provider.
Scope	FortiGate, Okta as SAML identity provider
Solution	FortiGate had configure sslvpn SAML login using OKTA SAML identity provider but failed to connect. Run "diagnose debug application samld -1 " command and it show error below: __samld_sp_login_resp [871]: Audience is invalid! samld_send_common_reply [114]: Code: 6, id: 1168, data_len: 43 samld_send_common_reply [122]: Attr: 22, 8, ÿÿ samld_send_common_reply [122]: Attr: 23, 21, Undefined error. "Audience is invalid" indicate that FortiGate Service Provider Information  "entity-id " under user saml  is configure different from Okta settings. Re-check the URL in FortiGate is configure same as Okta settings.