New here - OpenSAML and conditions/audience restrictions problem

[o haya]

Hi,

I am just getting started with OpenSAML, and using Java and OpenSAML 2.6.6 and writing a small app to generate a SAML assertion.  The assertion that I am trying to generate needs to have  <Conditions> and in particular, I need to include an AudienceRestriction.

I have code now that, in fact does add the <Conditions>, but I am ending up with two <saml:AudienceRestriction> elements. 

One of them has the URI I want, but the other is empty, e.g.:

<saml2:Conditions NotOnOrAfter="2019-02-15T19:27:56.620Z" NotBefore="2019-02-15T19:27:56.603Z">
    <saml2:AudienceRestriction/>
    <saml2:AudienceRestriction>
        <saml2:Audience>https://sandboxdtm01.xxx.dev/fed</saml2:Audience>
    </saml2:AudienceRestriction>
</saml2:Conditions>

whereas I think that what I want is (i.e., just the one saml2:AudienceRestriction with the URI):

<saml2:Conditions NotOnOrAfter="2019-02-15T19:27:56.620Z" NotBefore="2019-02-15T19:27:56.603Z">
    <saml2:AudienceRestriction>
        <saml2:Audience>https://sandboxdtm01.xxx.dev/fed</saml2:Audience>
    </saml2:AudienceRestriction>
</saml2:Conditions>

The part of my code that is building that is:

            SAMLObjectBuilder audienceRestrictionConditionBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
            Condition condition = (Condition) audienceRestrictionConditionBuilder.buildObject();

            SAMLObjectBuilder conditionsBuilder = (SAMLObjectBuilder) SAMLWriter.getSAMLBuilder().getBuilder(Conditions.DEFAULT_ELEMENT_NAME);
            Conditions conditions = (Conditions) conditionsBuilder.buildObject();
            conditions.getConditions().add(condition);
            // add notBefore and notOnOrAfter to the Conditions
            conditions.setNotBefore(now);
            conditions.setNotOnOrAfter(now2);
            
            // From: https://www.programcreek.com/java-api-examples/?code=mwdb/OA2C/OA2C-master/OAuth2Client_Java/src/com/sap/security/oa2/LocalSamlTokenFactory.java
            // try add audience - from Example 6 at https://www.programcreek.com/java-api-examples/?api=org.opensaml.saml2.core.AudienceRestriction
            SAMLObjectBuilder audienceRestrictionnBuilder = null;
            SAMLObjectBuilder audienceBuilder = null;
            audienceRestrictionnBuilder = (SAMLObjectBuilder) getSAMLBuilder().getBuilder(AudienceRestriction.DEFAULT_ELEMENT_NAME);
    	    audienceBuilder = (SAMLObjectBuilder) getSAMLBuilder().getBuilder(Audience.DEFAULT_ELEMENT_NAME);
            String audienceURI = "https://sandboxdtm01.xxx.dev/fed";
            
        	// Create the audience
        	Audience audience = (Audience) audienceBuilder.buildObject();
        	audience.setAudienceURI(audienceURI);

        	// Create the audience restriction
        	AudienceRestriction audienceRestriction = (AudienceRestriction) audienceRestrictionnBuilder.buildObject();

        	// add in the audience
        	audienceRestriction.getAudiences().add(audience);
        	conditions.getAudienceRestrictions().add(audienceRestriction);

It seems like just instantiating the builder is making the empty saml2:AudienceRestriction, but I don't know how to make an "empty" builder?

Can someone tell me how I should be/can do that?

Thanks,
Jim