The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

(1) Share

Report

Posted on by Marco Mels

Hi,

This is Marco Mels from the Microsoft Dynamics NAV CSS Organization. I just wanted to share some information that we may see coming as a question on a regular base. If you try to setup Dynamics NAV with Office 365 and try to authenticate with Single Sign On, then this may fail with the following error in the application event log file:

Event ID: 231
Level: Warning
Description:
Server instance: DynamicsNAV110
Tenant ID:
<ii>Type: System.IdentityModel.Tokens.AudienceUriValidationFailedException
Message: <ii>ID1038: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris.
Audience: 'dynamicsnavwinclient/.../ii>

The reason for this error is that you did run the Powershell command lets Set-NavSingleSignOnWithOffice365 you may still find on the Dynamics NAV product DVD. These command lets did work fine in previous releases, but while we integrate more functionality with Office 365, it is better / recommended to create your own Azure AD app via the Azure Portal. We did update documentation around this scenario:
docs.microsoft.com/.../authenticating-users-with-azure-active-directory

If you do have any further questions or insights to share, please reply to this forum posting.

*This post is locked for comments

All responses (12)

Answers (2)

Suggested answer

Marco Mels on at

Like (0)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hello,

The original issue was that the mentioned PowerShell scripts on the product DVD did do what they should do, but the Azure AD App was not visible so additional reply urls could not be added this way. That is what I recall as being cause of the scripts getting deprecated. If it started to work again and if it does work, then thanks for sharing.

Thanks.
Mkii 5 on at

Like (0)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Not sure if I missed something, but you wrote "These command lets did work fine in previous versions" which versions are you referring to as working and what version did it stop? I was trying with 2018 and the web worked fine from the Powershell scripts, once I added the Redirect URIs to the App Registration. The issue I was having with the AudienceUris was fixed by adding the 'http://dynamicsnavwinclient/ to the "Valid Audiences" in the NST Admin "Azure Active Directory" section.
Community Member Microsoft Employee on at

Like (0)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hi Marco

I got my issue solved, thanks for the help! :)
Marco Mels on at

Like (1)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hello again,

Not sure if this is still an issue, but the WSFederationLoginEndpoint is really something that you can find in the customsettings.config file. Not the navsettings.json file.

Thanks.
Community Member Microsoft Employee on at

Like (0)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hi Marco

Thanks a lot for replying!

I did as you said, except it's Nav 2018, so I added it in Navsettings.json instead for that specific serverinstance.

I don't get the earlier mentioned "25%"'s, but now it lets me log in to office, after that it gives the error:

"Unable to connect to this site

The IP address of the server for <AADID>.onmicrosoft.com could not be found."

I can really not get what is wrong right now. It works perfectly with the installed windows client, but web client wont connect.
Suggested answer

Marco Mels on at

Like (1)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hi,

In the customsettings.config file, you need to add SignIn.aspx after the WebServer instance part of the url for the WSFederationLoginEndpoint. If you do not like to add the SignIn.aspx, then you can use an undocumented trick: change wreply to wtreply. That will work as well :-)

The WSFederationLoginEndpoint is build upon the following values (removing "https:// before login.windows.net to avoid automatic formatting problems):

login.windows.net/tenantID.onmicrosoft.com/wsfed?wa=wsignin1.0%26
wtrealm=AppIdUri
wreply=PublicWebBaseUrl/SignIn.aspx" />

If you know the tricks, you find it easy after all.
Suggested answer

AJAnsari 5,754 on at

Like (1)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hi Martin,

I had this same issue, and had to work with Microsoft support to resolve the issue - it took us a couple days but we were able to fix the problem.

I haven't had time to complete my blog article on this yet, but if you are running NAV 2018 and need to resolve this soon, please e-mail me at AJ@D365BCHub.com and I will send you a Word document that was originally created by Microsoft's support team and then enhanced with my notes/steps to get around the issue.

I hope this helps. If my response has answered your question, please verify by clicking Yes next to "Did this answer your question?"
Community Member Microsoft Employee on at

Like (1)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hi Marco

I got it working, but not with the webclient.

It gives an error:

404.15 - Not Found after I logged in with my credentials.

Also it gives me that the requested URL-address is filled up with 25's:

52525252f%252525253fReturnUrl%252525253d%25252525252fdemomiljo%25252525252f%25252525253fReturnUrl%25252525253d%2525252525252fdemomiljo%2525252525252f%2525252525253fReturnUrl%2525252525253d%252525252525252fdemomiljo%252525252525252f%252525252525253fReturnUrl%252525252525253d%25252525252525252fdemomiljo%25252525252525252f%25252525252525253fReturnUrl%25252525252525253d%2525252525252525252fdemomiljo%2525252525252525252f%2525252525252525253fReturnUrl%2525252525252525253d%252525252525252525252fdemomiljo%252525252525252525252f%252525252525252525253fReturnUrl%252525252525252525253d%25252525252525252525252fdemomiljo%25252525252525252525252f%25252525252525252525253fReturnUrl%25252525252525252525253d%2525252525252525252525252fdemomiljo%2525252525252525252525252f%2525252525252525252525253fReturnUrl%2525252525252525252525253d%252525252525252525252525252fdemomiljo%252525252525252525252525252f%252525252525252525252525253fReturnUrl%252525252525252525252525253d%25252525252525252525252525252fdemomiljo%25252525252525252525252525252f%25252525252525252525252525253fReturnUrl%25252525252525252525252525253d%2525252525252525252525252525252fdemomiljo%2525252525252525252525252525252f%2525252525252525252525252525253fReturnUrl%2525252525252525252525252525253d%252525252525252525252525252525252fdemomiljo%252525252525252525252525252525252f%252525252525252525252525252525253fReturnUrl%252525252525252525252525252525253d%25252525252525252525252525252525252fdemomiljo%25252525252525252525252525252525252f%25252525252525252525252525252525253fReturnUrl%25252525252525252525252525252525253d%2525252525252525252525252525252525252fdemomiljo%2525252525252525252525252525252525252f%2525252525252525252525252525252525253fReturnUrl%2525252525252525252525252525252525253d%252525252525252525252525252525252525252fdemomiljo%252525252525252525252525252525252525252f%252525252525252525252525252525252525253fReturnUrl%252525252525252525252525252525252525253d%25252525252525252525252525252525252525252fdemomiljo%25252525252525252525252525252525252525252f

52525252f%252525253fReturnUrl%252525253d%25252525252fdemomiljo%25252525252f%25252525253fReturnUrl%25252525253d%2525252525252fdemomiljo%2525252525252f%2525252525253fReturnUrl%2525252525253d%252525252525252fdemomiljo%252525252525252f%252525252525253fReturnUrl%252525252525253d%25252525252525252fdemomiljo%25252525252525252f%25252525252525253fReturnUrl%25252525252525253d%2525252525252525252fdemomiljo%2525252525252525252f%2525252525252525253fReturnUrl%2525252525252525253d%252525252525252525252fdemomiljo%252525252525252525252f%252525252525252525253fReturnUrl%252525252525252525253d%25252525252525252525252fdemomiljo%25252525252525252525252f%25252525252525252525253fReturnUrl%25252525252525252525253d%2525252525252525252525252fdemomiljo%2525252525252525252525252f%2525252525252525252525253fReturnUrl%2525252525252525252525253d%252525252525252525252525252fdemomiljo%252525252525252525252525252f%252525252525252525252525253fReturnUrl%252525252525252525252525253d%25252525252525252525252525252fdemomiljo%25252525252525252525252525252f%25252525252525252525252525253fReturnUrl%25252525252525252525252525253d%2525252525252525252525252525252fdemomiljo%2525252525252525252525252525252f%2525252525252525252525252525253fReturnUrl%2525252525252525252525252525253d%252525252525252525252525252525252fdemomiljo%252525252525252525252525252525252f%252525252525252525252525252525253fReturnUrl%252525252525252525252525252525253d%25252525252525252525252525252525252fdemomiljo%25252525252525252525252525252525252f%25252525252525252525252525252525253fReturnUrl%25252525252525252525252525252525253d%2525252525252525252525252525252525252fdemomiljo%2525252525252525252525252525252525252f%2525252525252525252525252525252525253fReturnUrl%2525252525252525252525252525252525253d%252525252525252525252525252525252525252fdemomiljo%252525252525252525252525252525252525252f%252525252525252525252525252525252525253fReturnUrl%252525252525252525252525252525252525253d%25252525252525252525252525252525252525252fdemomiljo%25252525252525252525252525252525252525252f
Community Member Microsoft Employee on at

Like (0)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hi Marco

Thanks it helped!
Verified answer

Marco Mels on at

Like (1)

Report

RE: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris

Hello,

You are of course right! It appears that "ifyou" is added to the last part of the link. This does come from the next line in initial posting: "If you do have any further questions or insights to share, please reply to this forum posting". Removing ifyou from the link will get you to the page.

I did correct the initial posting by removing the link from the url. Hope it does help.

It appears to be a formatting issue because the error is not visible unless you copy the link and look at it.