Briefly, this error occurs when the audience (aud) claim in the JWT token does not match the expected audience configured in Elasticsearch. This is a security measure to ensure tokens are intended for the correct recipient. To resolve this, you can either adjust the audience in your JWT token to match the Elasticsearch configuration, or modify the Elasticsearch configuration to accept the current audience in the JWT token. Also, ensure that the JWT token is correctly formatted and encoded.
This guide will help you check for common problems that cause the log ” Audience restriction [{}] does not match required audience [{}] ” to appear. To understand the issues related to this log, read the explanation below about the following Elasticsearch concepts: plugin.
Log Context
Log “Audience restriction [{}] does not match required audience [{}]” classname is SamlAuthenticator.java.
We extracted the following from Elasticsearch source code for those seeking an in-depth context :
diffChar;
uri.substring(diffChar);
spEntityId.substring(diffChar)
);
} else {
logger.info("Audience restriction [{}] does not match required audience [{}]"; uri; spEntityId);
}
});
return false;
}
