Follow the evidence.

Protocol

SAML 2.0

Flow

SP-initiated · HTTP-Redirect → HTTP-POST

Symptom

Users authenticate at the IdP successfully, then land back on the application login page. Started after the SP metadata was re-imported.

Exact error

Audience mismatch: expected https://app.example.test/saml/metadata

Recent changes

SP metadata re-imported on the IdP; SP host migrated to a new VM image.

<!-- Sanitized SAMLResponse (decoded, signature values removed) -->
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
    ID="_r8f2c1" Version="2.0" IssueInstant="2026-10-19T14:02:11Z"
    Destination="https://app.example.test/saml/acs"
    InResponseTo="_req4a91">
  <saml:Issuer>https://idp.example.test/metadata</saml:Issuer>
  <ds:Signature><!-- SignatureValue removed --></ds:Signature>
  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/>
  </samlp:Status>
  <saml:Assertion ID="_a77de0" IssueInstant="2026-10-19T14:02:11Z">
    <saml:Issuer>https://idp.example.test/metadata</saml:Issuer>
    <saml:Subject>
      <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
        j.doe@example.test
      </saml:NameID>
      <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <saml:SubjectConfirmationData InResponseTo="_req4a91"
          Recipient="https://app.example.test/saml/acs"
          NotOnOrAfter="2026-10-19T14:07:11Z"/>
      </saml:SubjectConfirmation>
    </saml:Subject>
    <saml:Conditions NotBefore="2026-10-19T14:02:11Z"
                     NotOnOrAfter="2026-10-19T14:07:11Z">
      <saml:AudienceRestriction>
        <saml:Audience>https://app.example.test/saml</saml:Audience>
      </saml:AudienceRestriction>
    </saml:Conditions>
  </saml:Assertion>
</samlp:Response>

# SP log (sanitized)
2026-10-19T14:00:09Z WARN saml.validate Assertion not yet valid (NotBefore=14:02:11Z)
2026-10-19T14:00:09Z ERROR saml.validate Audience mismatch: expected https://app.example.test/saml/metadata