SSO Troubleshooting: Not a valid audience for this response

Error

A learner attempts to SSO. After authenticating successfully to their IDP,  the user returns to Foundry and in Foundry sees this error message:
 
https://admin.fifoundry/{org-slug}/saml/sp is not a valid audience for this Response – Valid audiences: https://fifoundry/{org-slug}/saml/sp
 
where {org-slug} is the slug name for your organization.
 

Explanation

There is a configuration missing in your identity provider
 

Resolution

In your identity provider, in the configuration for the Foundry service provider when you enter an audience restriction, you must enter the Foundry EntityID which is the first part of the error detail message. Be sure to include your actual organization slug, not the placeholder in the example above.