Commit 53acaa9e authored by Eric Chiang's avatar Eric Chiang Committed by GitHub

Merge pull request #896 from Calpicow/audience_validate_fix

Validate audience with entityIssuer if present, use redirectURI otherwise
parents 40f0265a 47897f73
......@@ -40,6 +40,8 @@ connectors:
# insecureSkipSignatureValidation: true
# Optional: Issuer value for AuthnRequest
# Must be contained within the "AudienceRestriction" attribute in all responses
# If not set, redirectURI will be used for audience validation
entityIssuer: https://dex.example.com/callback
# Optional: Issuer value for SAML Response
......
......@@ -466,6 +466,10 @@ func (p *provider) validateConditions(assertion *assertion) error {
}
}
// Validates audience
audienceValue := p.entityIssuer
if audienceValue == "" {
audienceValue = p.redirectURI
}
audienceRestriction := conditions.AudienceRestriction
if audienceRestriction != nil {
audiences := audienceRestriction.Audiences
......@@ -473,14 +477,14 @@ func (p *provider) validateConditions(assertion *assertion) error {
values := make([]string, len(audiences))
issuerInAudiences := false
for i, audience := range audiences {
if audience.Value == p.redirectURI {
if audience.Value == audienceValue {
issuerInAudiences = true
break
}
values[i] = audience.Value
}
if !issuerInAudiences {
return fmt.Errorf("required audience %s was not in Response audiences %s", p.redirectURI, values)
return fmt.Errorf("required audience %s was not in Response audiences %s", audienceValue, values)
}
}
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment