Shibbolth IdP setting isssuer as AudienceRestriction

[Brent Putman]

On 6/11/15 8:37 PM, Alain O'Dea wrote:
>
> That is extremely helpful Brent.  Thank you.  It seemed odd to have a
> specific page referenced.  Regrettably, saml-java explicitly couples
> the issuer to the consumerServiceURL here:
> https://github.com/onelogin/java-saml/blob/4a75209f61e75897a18cde61610efdfd8104b057/src/main/java/com/onelogin/saml/Response.java#L163-165

Yeah, if I'm reading that right, that's simply wrong.  The Assertion
audiences should be evaluated against the consuming party's entityID. 
An Audience is not a location or URL.  The protocol Destination and
SubjectConfirmation should be evaluated against the receiving endpoint,
but not the Audiences.


> I don't have a choice about issuer being a URL unless I reimplement
> using OpenSAML.  That is becoming a more compelling path now as more
> gaps in saml-java reveal themselves.

Since you mention it: as part of a particular body of work, I've just
recently checked into OpenSAML 3.x trunk our initial impl of components
for SAML 2 Assertion validation, which essentially does this sort of
thing. It will be in the next release.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150611/367f958c/attachment.html>