diff --git a/docs/simplesamlphp-reference-sp-remote.md b/docs/simplesamlphp-reference-sp-remote.md index fb71d24c00a1c78bccb8096263b6c23e2e8713fc..63e01f86039b580a26a7b42227d423542af05605 100644 --- a/docs/simplesamlphp-reference-sp-remote.md +++ b/docs/simplesamlphp-reference-sp-remote.md @@ -160,6 +160,9 @@ The following options can be set: : (This option was previously named `AttributeNameFormat`.) +`audience` +: An array of additional entities to be added to the AudienceRestriction. By default the only audience is the SP's entityID. + `certData` : The base64 encoded certificate for this SP. This is an alternative to storing the certificate in a file on disk and specifying the filename in the `certificate`-option. diff --git a/modules/saml/lib/IdP/SAML2.php b/modules/saml/lib/IdP/SAML2.php index 4e8aaed3170bac3531205567cf0e26151daac1f4..13baa121e4f5da2581e8c549fb3bd28398f51d31 100644 --- a/modules/saml/lib/IdP/SAML2.php +++ b/modules/saml/lib/IdP/SAML2.php @@ -1126,7 +1126,9 @@ class SAML2 $issuer->setValue($idpMetadata->getString('entityid')); $issuer->setFormat(Constants::NAMEID_ENTITY); $a->setIssuer($issuer); - $a->setValidAudiences([$spMetadata->getString('entityid')]); + + $audience = array_merge([$spMetadata->getString('entityid')], $spMetadata->getArray('audience', [])); + $a->setValidAudiences($audience); $a->setNotBefore($now - 30);