A SAML assertion signs correctly, but the audience URI casing changed during the domain move and one service provider rejects only mixed-case callbacks

Identity proof is valid, yet string normalization assumptions differ between the two ends.