diff --git a/docs/simplesamlphp-reference-sp-remote.md b/docs/simplesamlphp-reference-sp-remote.md index 485d996bfca8c024ee0c36e448f4fe2496570a86..345cf4cbae069cf4cbc9999e50ea0b9d6f7cf40f 100644 --- a/docs/simplesamlphp-reference-sp-remote.md +++ b/docs/simplesamlphp-reference-sp-remote.md @@ -168,6 +168,9 @@ The following SAML 2.0 options are available: : (This option was previously named `AttributeNameFormat`.) +`audience` +: An array of additional entities to be added to the AudienceRestriction. By default the only audience is the SP's entityID. + `certData` : The base64 encoded certificate for this SP. This is an alternative to storing the certificate in a file on disk and specifying the filename in the `certificate`-option. diff --git a/modules/saml/lib/IdP/SAML2.php b/modules/saml/lib/IdP/SAML2.php index c07cfb4f001b152ce67d9dd866d73d87563f9f02..37faa0d8ed1f188a1b574493d6689172a49da72c 100644 --- a/modules/saml/lib/IdP/SAML2.php +++ b/modules/saml/lib/IdP/SAML2.php @@ -1144,7 +1144,9 @@ class SAML2 $issuer->setValue($idpMetadata->getString('entityid')); $issuer->setFormat(Constants::NAMEID_ENTITY); $a->setIssuer($issuer); - $a->setValidAudiences([$spMetadata->getString('entityid')]); + + $audience = array_merge([$spMetadata->getString('entityid')], $spMetadata->getArray('audience', [])); + $a->setValidAudiences($audience); $a->setNotBefore($now - 30);