Application SAML Config Not Working

[patrick14]

I’m trying to configure applications to use SAML for SSO purposes. My configuration is like this:

{
  "audience": "https://${myurl}/saml/consume",
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:EmailAddress",
  "signResponse": true
}

and it works in my dev tenant:

When I use the same configuration in my prod tenant, the SAML response is NOT getting signed:

and the audience is NOT what is specified in my config. It is coming up as:

            <saml:AudienceRestriction>
                <saml:Audience>undefined.zoom.us</saml:Audience>
            </saml:AudienceRestriction>

rather than:

            <saml:AudienceRestriction>
                <saml:Audience>https://${myurl}/saml/consume</saml:Audience>
            </saml:AudienceRestriction>

Can anyone explain why the configuration from the app is not being used?

[patrick14]

Okay, I figured this out. Turns out that this was actually a bug with the Terraform Provider that was fixed in the GHI link below. I think the reason that I was seeing

            <saml:AudienceRestriction>
                <saml:Audience>undefined.zoom.us</saml:Audience>
            </saml:AudienceRestriction>

was because zoom was the the last addon in the list, and it likely had SAML configurations that were clobbering my configured ones.

For whatever reason, my dev tenant managed via TF didn’t inherit this same issue.

Issue with Client Addons