Good morning team! I'm working on Okta integration today and am running into this error: Mar 23 15:35:19 <hostname> fleet[5941]: {"component":"http","err":"response validation failed: wrong audience:fleet","level":"error","method":"POST","took":"8.576283ms","ts":"2023-03-23T15:35:19.891266573Z","uri":"/api/v1/fleet/sso/callback"} I saw in a previous post where this appears to be an issue with the entity ID. After looking at the metadata, it looks like the Entity ID in Fleet and the metadata are identical. Has anyone else run into this?

Hey @Mike S.! It definitely sounds like the Entity ID is the most likely culprit. Those are case-sensitive, could that be a factor?

Not that I can tell... I copied/pasted it, but I will double check that!

Can you check your config matches https://fleetdm.com/docs/deploying/configuration#okta-idp-configuration?

It does match that so we should be good there.

Do you have

Entity ID

set to

fleet

in the Fleet SSO config?

Yes

I notice the SAML you shared has an

saml2:Assertion

at the topmost level rather than a

saml2p:Response

or

samlp:Response

at the top level. I think that's probably the issue. Any idea why that would be? See some example responses at https://www.samltool.com/generic_sso_res.php