SAML audience matches, but ACS URL normalization drops the trailing slash and the login flow loops between the app and IdP

Authentication succeeds at the identity provider, yet the application rejects the response because the callback URL comparison is stricter than the team expected.