Set Audience value

[Cantor, Scott]

On 1/20/17, 3:44 PM, "users on behalf of Michael Dahlberg" <users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:

>    I'm working with an SP that requires the Audience value be set to something different than the entityID.  From the
> following page https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPAudience
> it would seem to suggest that the best method to correct this would be to edit the Metadata file.

That is SP documentation (anything with NativeSP in the name is), it has nothing to do with your problem. It's also rather incoherently written, but trying to go back 9 years and figure out what I was trying to communicate in that page is more than I think I can do right now.

>  I have two questions:
>  
>  (1) Is this still the recommendation for the IdP version 3.2.1?

You can't fix this with a metadata change. If the SP identifies itself as Bob and wants you to call it Alice, you can't change the metadata to call it Alice since that will simply turn the original request into an unrecognized one.
    
>  (2) And by "correcting the Metadata file" does this mean changing the entityID to the required Audience value?

I believe what the page was trying to say, though I can't be sure, was that if you try and patch around a broken IdP that's sending the wrong Audience value, it's probably something you (the SP) caused by giving it the wrong metadata and fixing the metadata is what you normally should do.

If the SP is broken like this, the solution in most cases is to refuse to accept that, report that bug and inform those in charge that you cannot interoperate with their broken implementation until they patch it. I can provide the relevant standards reference if that helps.

If you agree with implementing hacks on your side to cover for their bug, the IdP supports a property on the profile beans for adding additional values outbound. I do not advise using it, but it is there.

https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration

additionalAudiencesForAssertion

-- Scott