Invalid Assertion Consumer Service URL

IdP has identified the SP, but the ACS presented by the SP is not what has been registered on the metadata. This could happen easily when the SP presents ACS with http when it has registered it under https, for example. IdP log usually indicates what ACS is presented by the SP, hence the one being rejected.

Things to check:

• make sure SP aware the exact ACS it is using
• if the difference in the ACS is http and https, make sure the SP is configured to do this auto detection^?
• check IdP log to see what ACS is presented and rejected
• check SP log to see what ACS being sent
• check registration at federation manager to see if the ACS is properly registered (i.e. https://MY_DNS/Shibboleth.sso/SAML/POST and https://MY_DNS/Shibboleth.sso/SAML/Artifact)