Migrate saml:Audience

tvdijen · tvdijen · commit a1681a62a555 · 2023-08-02T09:26:49.000+02:00
diff --git a/modules/saml/src/IdP/SAML2.php b/modules/saml/src/IdP/SAML2.php
@@ -18,7 +18,7 @@
 use SimpleSAML\SAML2\Constants as C;
 use SimpleSAML\SAML2\Exception\ArrayValidationException;
 use SimpleSAML\SAML2\XML\md\ContactPerson;
-use SimpleSAML\SAML2\XML\saml\{AttributeValue, Issuer, NameID, SubjectConfirmation, SubjectConfirmationData};
+use SimpleSAML\SAML2\XML\saml\{AttributeValue, Audience, Issuer, NameID, SubjectConfirmation, SubjectConfirmationData};
 use SimpleSAML\SAML2\XML\saml\{AuthenticatingAuthority, AuthnContext, AuthnContextClassRef}; // AuthnContext
 use SimpleSAML\SAML2\XML\samlp\{Status, StatusCode, StatusMessage}; // Status
 use SimpleSAML\XML\DOMDocumentFactory;
@@ -27,6 +27,7 @@
 use Symfony\Component\HttpFoundation\{Request, Response};
 
 use function array_key_exists;
+use function array_map;
 use function array_merge;
 use function array_pop;
 use function array_unique;
@@ -1168,8 +1169,9 @@ private static function buildAssertion(
         $issuer->setFormat(C::NAMEID_ENTITY);
         $a->setIssuer($issuer);
 
-        $audience = array_merge([$spMetadata->getString('entityid')], $spMetadata->getOptionalArray('audience', []));
-        $a->setValidAudiences($audience);
+        $audiences = array_merge([$spMetadata->getString('entityid')], $spMetadata->getOptionalArray('audience', []));
+        $audiences = array_map(fn($audience): Audience => new Audience($audience), $audiences);
+        $a->setValidAudiences($audiences);
 
         $a->setNotBefore($now - 30);
 
diff --git a/modules/saml/src/Message.php b/modules/saml/src/Message.php
@@ -710,6 +710,9 @@ private static function processAssertion(
         }
         $validAudiences = $assertion->getValidAudiences();
         if ($validAudiences !== []) {
+            // Turn array of saml:Audience objects into an array of identifiers
+            $validAudiences = array_map(fn($audience): string => $audience->getContent(), $validAudiences);
+
             $spEntityId = $spMetadata->getString('entityid');
             if (!in_array($spEntityId, $validAudiences, true)) {
                 $candidates = '[' . implode('], [', $validAudiences) . ']';
