Policy wasn't receiving access to HTTP request so as to check Recipient values in assertions.
Basics
Technical
Logistics
Basics
Technical
Logistics
Description
The SAML 2 profile handler wasn't checking the subject confirmation's Recipient attribute because of an error in the policy evaluation step. Audience was still checked, and a separate bug prevented unsigned responses from working properly anyway, so there's little or no security impact at this point.
The SAML 2 profile handler wasn't checking the subject confirmation's Recipient attribute because of an error in the policy evaluation step. Audience was still checked, and a separate bug prevented unsigned responses from working properly anyway, so there's little or no security impact at this point.