Issue | Symptom | Solution |
org.opensaml.common.SAMLException: Local entity is not the intended audience of the assertion in at least one AudienceRestriction. | The audience URL in the SAML assertion does not match with the Service provider identity in API Gateway. | Make sure the Service provider identity in API Gateway matches with the audience URL. |
If you have enabled Enforce SSO login by default, and if you have provided incorrect information while configuring SAML SSO, you cannot update the SAML SSO configuration in API Gateway as you are redirected to the SSO Login page directly. | In such case, you can login into API Gateway using the http(s)://hostname: portnumber/apigatewayui/login?usesso=false URL and update the SSO configuration with correct details. |