<saml2:Audience>

[Nate Klingenstein]

Cath,

The audience pretty much needs to be the SP's entityID for security purposes.  Otherwise, the recipient of an assertion could turn around and replay it to another SP(assuming signed assertions rather than signed responses).  If that's actually intended and the use case you're working with, then it is supported in v4 to add more Audiences.

https://wiki.shibboleth.net/confluence/display/IDP4/ProfileConfiguration-SAML

If that doesn't help, could you give more details on what you're trying to accomplish?

We'll be kind,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

 
 
-----Original message-----
> From: Cath Messner
> Sent: Tuesday, October 6 2020, 1:59 pm
> To: Shib Users
> Subject: <saml2:Audience>
> 
> 
> 
> This is far out of my comfort zone; please be gentle :)
> 
> For <saml2:Audience> -- is there a way for the IDP to specify a value (it appears to defer to the SPs entityID). Thanks.
> 
> <saml2:Audience>BLAH</saml2:Audience>
> 
> --
> 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
>