This may be null, in which case all audiences are allowed.
| public getValidAudiences ( ) : array | null | ||
| return | array | null | The allowed audiences. |
public function validate(Assertion $assertion, Result $result)
{
$intendedAudiences = $assertion->getValidAudiences();
if ($intendedAudiences === null) {
return;
}
$entityId = $this->serviceProvider->getEntityId();
if (!in_array($entityId, $intendedAudiences)) {
$result->addError(sprintf('The configured Service Provider [%s] is not a valid audience for the assertion. Audiences: [%s]', $entityId, implode('], [', $intendedAudiences)));
}
}
public function testUnmarshalling()
{
// Unmarshall an assertion
$xml = <<<XML
<saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
ID="_593e33ddf86449ce4d4c22b60ac48e067d98a0b2bf"
Version="2.0"
IssueInstant="2010-03-05T13:34:28Z"
>
<saml:Issuer>testIssuer</saml:Issuer>
<saml:Conditions>
<saml:AudienceRestriction>
<saml:Audience>audience1</saml:Audience>
<saml:Audience>audience2</saml:Audience>
</saml:AudienceRestriction>
</saml:Conditions>
<saml:AuthnStatement AuthnInstant="2010-03-05T13:34:28Z">
<saml:AuthnContext>
<saml:AuthnContextClassRef>someAuthnContext</saml:AuthnContextClassRef>
<saml:AuthenticatingAuthority>someIdP1</saml:AuthenticatingAuthority>
<saml:AuthenticatingAuthority>someIdP2</saml:AuthenticatingAuthority>
</saml:AuthnContext>
</saml:AuthnStatement>
</saml:Assertion>
XML;
$document = DOMDocumentFactory::fromString($xml);
$assertion = new Assertion($document->firstChild);
// Test for valid audiences
$assertionValidAudiences = $assertion->getValidAudiences();
$this->assertCount(2, $assertionValidAudiences);
$this->assertEquals('audience1', $assertionValidAudiences[0]);
$this->assertEquals('audience2', $assertionValidAudiences[1]);
// Test for Authenticating Authorities
$assertionAuthenticatingAuthorities = $assertion->getAuthenticatingAuthority();
$this->assertCount(2, $assertionAuthenticatingAuthorities);
$this->assertEquals('someIdP1', $assertionAuthenticatingAuthorities[0]);
$this->assertEquals('someIdP2', $assertionAuthenticatingAuthorities[1]);
}