Shibbolth IdP setting isssuer as AudienceRestriction

[Cantor, Scott]

On 6/11/15, 2:06 PM, "Alain O'Dea" <alain.odea at gmail.com> wrote:


>
>It almost works but the SAML token has an AudienceRestriction of 
>http://localhost:8080/index.jsp <http://localhost:8080/index.jsp> which 
>is the issuer, not the consumer.  The saml-java SP rejects this.

The audience is whatever you've told that SP to send in its requests as 
its identity (the Issuer of the request in other words).

And that should be what's in the SP's metadata at the IdP in the entityID, 
or it wouldn't even respond.

-- Scott