3603301 - SAML SSO authentication with error: "audience restriction does not specify the current Service Provider" in IAS

• SSO with Corporate Identity Provider does not work.
• The SAML response sent from Identity Authentication to the Service Provider contains the status message "Failed to authenticate user".
• The IAS troubleshooting logs contains the following error:

         Service Provider has received SAML2Assertion from Identity Provider [XXX] whose audience restriction [[https://<tenant id>.accounts.cloud.sap]] does not specify the current Service Provider [https://<tenant id>.accounts.ondemand.com].          

Identity Authentication Service

SAML, SSO, authentication, Identity Authentication Service, entity ID, entity name, corporate IdP, mismatch, audience restriction does not specify the current Service Provider, audience restriction, Failed to authenticate user , KBA , BC-IAM-IDS , Identity Authentication Service , Problem