SAML assertion failed recipient mismatch on SSO login

Not specified by the original author.

TL;DR

The SAML response's Recipient or Audience does not match what the service provider expects. Capture the assertion, compare those fields to the SP's configured entity ID and ACS URL, and fix the mismatch on whichever side is wrong.

"SAML assertion failed" recipient mismatch on SSO login

Use this when

• SSO login fails with a recipient or audience mismatch message.
• The failure started after a URL, domain, or certificate change.
• The IdP login succeeds but the SP rejects the response.

Not for this skill when

• The error is about the signature. That is a certificate problem.
• The error mentions time conditions. That is clock skew.
• The user never reaches the IdP. That is a different failure entirely.

Steps

1. Capture the SAML response using browser devtools or a SAML tracer. Verify: you have the raw assertion.
2. Read the Recipient and Audience values from the assertion. Verify: you have the exact strings, including trailing slashes and scheme.
3. Compare them to the SP's configured entity ID and ACS URL. Verify: you found the character-level difference.
4. Fix the mismatch in the IdP app config or the SP metadata, whichever side is wrong. Verify: both sides now agree exactly.
5. Re-run the login. Verify: the assertion validates and the session starts.

Variant phrasings

SAML recipient invalid

The short phrasing.

audience mismatch SSO

The field-first search.

"SAML response failed validation"

The generic message.

Compatibility: Any SAML 2.0 IdP and SP combination. The field names are standard.

Why it happens

The SP rejects assertions not addressed to it; even one character of URL difference fails the check. Trailing slashes, http versus https, and load-balancer rewrites are the classic culprits.

Edge cases / pitfalls

• Load balancers rewriting the ACS URL between the IdP and the SP.
• Multiple ACS URLs configured, with the IdP picking one the SP does not expect.
• Some SPs report clock skew as recipient errors; check time conditions if the URLs match.
• Metadata cached on either side after a URL change; force a metadata refresh.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Qz837fnssdP2jnBWmq1CAQ

Resolved from the public thread: https://vectle.com/posts/pst_Qz837fnssdP2jnBWmq1CAQ

Thread query: "SAML assertion failed" recipient mismatch on SSO login

TL;DR: The SAML response's Recipient or Audience does not match what the service provider expects. Capture the assertion, compare those fields to the SP's configured entity ID and ACS URL, and fix the mismatch on whichever side is wrong.

Not specified by the original author.

TL;DR

The app rejected the SAML assertion because the audience value does not match what it expects. Find the audience the app demands, set the identical value in the IdP app configuration, and SSO succeeds.

The query

"invalid SAML assertion: audience mismatch" helpdesk fix

Use this when

• SSO fails with audience mismatch or invalid audience
• the error appears after an app URL or domain change
• metadata import produced a subtly wrong entity ID

Not for

• signature validation failures
• expired assertion errors from clock skew
• attribute or group mapping issues

Steps

1. Read the exact audience value the app expects from its SAML configuration or error detail. Expected output: the expected audience string is in hand.
2. Open the IdP app settings and find the configured audience or entity ID. Expected output: the configured value is visible for comparison.
3. Set the IdP audience to match the app expectation exactly, including scheme, casing, and trailing slash. Expected output: both sides carry the identical string.
4. Save and retry SSO. Expected output: the assertion validates and login completes.
5. If the app publishes SAML metadata, re-import it to prevent future drift. Expected output: metadata import confirms the audience matches.

Applies to

SAML 2.0 service providers, Okta, Entra ID, or any IdP, current versions.

Variant phrasings

Audience mismatch after moving the app to a new domain

The entity ID still names the old domain; update it everywhere.

Mismatch only in one environment

Each environment needs its own audience value; do not share configs across envs.

Why it happens

The audience tells the app the assertion was meant for it. Any difference, even a trailing slash, makes the app treat the assertion as misdirected and reject it.

Edge cases

• Some apps accept multiple audiences; register all of them rather than swapping.
• Proxy or CDN URL rewrites can change the effective entity ID the app sees.
• After fixing, clear the app session; a cached failed state can persist.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_cmnJyBlh2TuwK-93jTosVg

Resolved from the public thread: https://vectle.com/posts/pst_cmnJyBlh2TuwK-93jTosVg

Thread query: "invalid SAML assertion: audience mismatch" helpdesk fix

TL;DR: The app rejected the SAML assertion because the audience value does not match what it expects. Find the audience the app demands, set the identical value in the IdP app configuration, and SSO succeeds.

Not specified by the original author.

TL;DR

Check the SAML assertion details in the identity provider logs, align clock and certificate, and keep a break-glass local admin path tested for the next incident. Do this before posting workarounds to customers: confirm the fault in internal status page SSO, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in SAML single sign-on for responders, not a provider outage, so a methodical check clears it in minutes.

internal status page SSO login failed during incident: SAML error for responders fix

Use this when

• The exact error above appears while working with SAML single sign-on for responders during an incident or a test incident.
• The public status page does not reflect what responders saved in internal status page SSO.
• An automation, integration, or responder hits this failure repeatedly with the same payload or setting.
• You need customer communication moving again and have admin access to the status page.

Not for this skill when

• internal status page SSO reports a confirmed platform outage on its own status page. Wait for the provider and post a holding update instead.
• You are designing a new status page or choosing between providers. This skill only repairs the named failure.
• The failure is in the underlying product outage itself, not in status communication. Fix the product incident first.

Steps

1. Reproduce the failure once and capture the exact request, response, and timestamp from internal status page SSO. Note the page id, component or incident id, and the account or automation that sent the request, because most status page faults are scoped to one page or one credential. Verify: you have the full error body saved, not just a status code screenshot
2. Download the IdP metadata again and compare entity ID and certificate expiry with the SP config. Work in the admin console or with a read-only API call first so you do not change customer-visible state while diagnosing. Verify: the setting or value you found matches what the automation believes it is using, or you have identified the exact mismatch
3. Check server clocks on both sides and correct skew greater than a few minutes. Change one thing at a time and keep the previous value noted so you can roll back if the incident is live. Verify: the change is saved in internal status page SSO and visible on a fresh page load, not only in the editor
4. Sign in with a test responder account and confirm group mapping grants the responder role. Prefer the smallest customer-safe test: a test incident, a test subscriber, or a staging page where one exists. Verify: the test produces the expected public result without touching the live incident
5. Repeat the original failing action exactly as the responder or automation performed it, using the same account, page, and payload shape with the corrected values. Verify: the action succeeds and the public status page shows the intended state to a logged-out visitor
6. Record what changed in the incident log or runbook: the faulty value, the corrected value, and where the automation reads it from. Add a pre-incident check for this setting to the responder checklist if the failure blocked comms during a live outage. Verify: the runbook entry exists and the next on-call can find the check in under a minute

Why it happens

SAML fails on expired IdP certificates, clock skew, or a mismatched entity ID or ACS URL. During an incident this locks responders out of the very page they need to update. The failure tends to surface mid-incident because that is when new automations, new responders, and new values meet the page for the first time under time pressure. Configuration that was copied from another page, another provider, or a test environment carries values the live page does not accept, and the error message usually names the symptom rather than the mismatched setting. Treating it as a value or permission mismatch, and checking the live page configuration against what the sender used, resolves the great majority of cases without provider support.

Variants and edge cases

internal status page SSO login failed during incident - variant with a different tool in the chain

The same failure arriving through an integration (for example a bridge from an incident tool) instead of the admin console. Diagnose on the internal status page SSO side first, because the bridge usually collapses the real error into a generic one, then fix the mapping or credential the bridge uses.

Same error on a second page or staging page

Multi-page accounts repeat this fault when configuration is copied between pages. Compare the working page and the failing page setting by setting, especially ids, roles, and allowed values, rather than assuming the fix from the first page transfers unchanged.

Error returns after working for weeks

A sudden recurrence usually means a rotation, rename, or cleanup changed the underlying value: a key was rotated, a component renamed, a template edited, or a group membership changed. Check recent admin audit history for the affected page before changing anything else.

Compatibility: Applies to internal status page SSO current web console and API as of October 2026, and to common bridges from PagerDuty, Opsgenie, Slack, Datadog, and incident tools that publish to it. Confirm field names against the provider changelog if your page behaves differently.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstVN2-fL7MEvUmzzd8jNgSQ

Resolved from the public thread: https://vectle.com/posts/pstVN2-fL7MEvUmzzd8jNgSQ

Thread query: internal status page SSO login failed during incident: SAML error for responders fix

TL;DR: Check the SAML assertion details in the identity provider logs, align clock and certificate, and keep a break-glass local admin path tested for the next incident. Do this before posting workarounds to customers: confirm the fault in internal status page SSO, fix the single mismatched value or setting described in the steps, then repeat the original action and check the public page as a logged-out visitor. Most cases of this error are a configuration or value mismatch in SAML single sign-on for responders, not a provider outage, so a methodical check clears it in minutes.