SAML error: Invalid assertion with 'coin'

[LibiaoRobot]

From the debug, we can see that there is no problem with the time on both sides.

[slovepreet]

You can follow these instructions as per this kb

 https://community.fortinet.com/t5/FortiGate/Technical-Tip-Authentication-fails-with-clock-skew-error...

specifically this part 

config user saml 
    edit <>
        set clock-tolerance <in seconds>      <-- (0-300, 15 by default). 
    next
end

[LibiaoRobot · Accepted solution]

This error Code: 6 is caused by an Audience error, duplicate Audience, or inconsistent context. I have a duplicate Audience here, so the error is reported.

<saml:AudienceRestriction>
  <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>
  <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>
</saml:AudienceRestriction>

If there is an empty Audience, an error Code: 6 will be reported.

<saml:AudienceRestriction>
  <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>
  <saml:Audience/>
</saml:AudienceRestriction>

The correct one is as follows

<saml:AudienceRestriction>
  <saml:Audience>https://sp.example.com/remote/saml/metadata/</saml:Audience>
</saml:AudienceRestriction>