diff --git a/lib/passport-saml/saml.js b/lib/passport-saml/saml.js index 2ef65955..579f14e2 100644 --- a/lib/passport-saml/saml.js +++ b/lib/passport-saml/saml.js @@ -759,6 +759,15 @@ SAML.prototype.processValidlySignedAssertion = function(xml, inResponseTo, callb throw conErr; } + var audienceRestriction = conditions.AudienceRestriction ? conditions.AudienceRestriction[0] : null; + + if (audienceRestriction.Audience && audienceRestriction.Audience.length > 0) { + if (audienceRestriction.Audience.indexOf(self.options.issuer) === -1) { + msg = 'Audience does not match ' + self.options.issuer; + throw new Error(msg); + } + } + var attributeStatement = assertion.AttributeStatement; if (attributeStatement) { var attributes = [].concat.apply([], attributeStatement.filter(function (attr) {