Allow AudienceRestriction to be missing

re #198
crewjam · May 8, 2019 · ca21de9 · ca21de9
1 parent d288d9a
commit ca21de9
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 1 deletion.
diff --git a/service_provider.go b/service_provider.go
@@ -549,7 +549,7 @@ func (sp *ServiceProvider) validateAssertion(assertion *Assertion, possibleReque
 		return fmt.Errorf("Conditions is expired")
 	}
 
-	audienceRestrictionsValid := false
+	audienceRestrictionsValid := len(assertion.Conditions.AudienceRestrictions) == 0
 	for _, audienceRestriction := range assertion.Conditions.AudienceRestrictions {
 		if audienceRestriction.Audience.Value == sp.MetadataURL.String() {
 			audienceRestrictionsValid = true

diff --git a/service_provider_test.go b/service_provider_test.go
@@ -785,6 +785,11 @@ func (test *ServiceProviderTest) TestInvalidAssertions(c *C) {
 	c.Assert(err.Error(), Equals, "Conditions AudienceRestriction does not contain \"https://15661444.ngrok.io/saml2/metadata\"")
 	assertion = Assertion{}
 	xml.Unmarshal(assertionBuf, &assertion)
+
+	// Not having an audience is not an error
+	assertion.Conditions.AudienceRestrictions = []AudienceRestriction{}
+	err = s.validateAssertion(&assertion, []string{"id-9e61753d64e928af5a7a341a97f420c9"}, TimeNow())
+	c.Assert(err, Equals, nil)
 }
 
 func (test *ServiceProviderTest) TestRealWorldKeyInfoHasRSAPublicKeyNotX509Cert(c *C) {