Set Audience value

[Cantor, Scott]

On 1/20/17, 4:40 PM, "users on behalf of Michael Dahlberg" <users-bounces at shibboleth.net on behalf of olgamirth at gmail.com> wrote:

>> If the SP is broken like this, the solution in most cases is to refuse to accept that, report that bug and inform those in
>> charge that you cannot interoperate with their broken implementation until they patch it. I can provide the relevant
>> standards reference if that helps.
> 
> It would help, since I'm not sure where to look for this.  Thank you very much!

Sure.

https://www.oasis-open.org/committees/download.php/56782/sstc-saml-profiles-errata-2.0-wd-07.pdf

Sec 4.1.4.2:

Each bearer assertion MUST contain an <AudienceRestriction> including the service provider's unique identifier as an 
<Audience>.

That's your obligation, period.

Refer to the previous section if in doubt about "unique identifier", referring to its AuthnRequest:

"The  <Issuer> element MUST be present and MUST  contain the unique identifier of the requesting service provider"

Doesn't take higher math. Issuer is X, Audience is X, end of story.

-- Scott