How to check Assertion Conditions element

[Michele Innocenti]

Hi again. I would need to know if it is possible to check the existence 
of elements in the Condition element of the Response IDP Assertion. So that, for example, this Response from the IDP can be refused by Shibboleth SP:

IDP Response:

```
<!-- <?xml version="1.0"?>
<samlp:Response xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://xxx/Shibboleth.sso/SAML2/POST" ID="_" InResponseTo="_" IssueInstant="2022-07-01T16:31:22Z" Version="2.0">
     <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>
     <ds:Signature>
         ...
     </ds:Signature>
     
     <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>
     <saml:Assertion xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ID="_" IssueInstant="2022-07-01T16:31:22Z" Version="2.0">
         <saml:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://localhost:8080</saml:Issuer>
         
     <ds:Signature>
         ...
     </ds:Signature>
         
         <saml:Subject>
             <saml:NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient" NameQualifier="https://localhost:8080">
                     that-transient-opaque-value
             </saml:NameID>
                   
             <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                 <saml:SubjectConfirmationData InResponseTo="_" NotOnOrAfter="2022-07-01T16:36:22Z" Recipient="https://xxx/Shibboleth.sso/SAML2/POST"/>
             </saml:SubjectConfirmation>
         </saml:Subject>
         
         <saml:Conditions NotBefore="2022-07-01T16:31:22Z" NotOnOrAfter="2022-07-01T16:36:22Z">
             

         </saml:Conditions>
         ...
```

Compared to an acceptable IDP Response:

```
	...
	<saml:Conditions NotBefore="2022-07-01T16:31:16Z" NotOnOrAfter="2022-07-01T16:36:16Z">
             
             <saml:AudienceRestriction>
                 <saml:Audience>https://xxx.it</saml:Audience>
             </saml:AudienceRestriction>
             
         </saml:Conditions>
	...
```

Is it possible to enforce the presence of an AudienceRestriction  element into the IDP Response so that Shibboleth SP can response a KO to the first IDP Response?
I tried setting PolicyRule in security-policy.xml with no success.

Thanks.