title: Audience Restriction is missing from SAML 2 response
body: <p>I'm trying to use the Identity Server with ASP.NET (.NET 4.5.1, MVC project) using WIF and WS-Federation. 
  WSO2IS version is 5.0.0</p>
  
  <p><em>Disclaimer: I'm new with WSO2IS and ASP.NET too (not with .NET itself) and with the whole identity stuff so perhaps I've omitted something basic.</em></p>
  
  <p>The problem is that the audience restriction is missing from the SAML 2 response. Otherwise everything looks fine. </p>
  
  <p>In the identity server management console -> service providers -> [my service provider] -> inbound authentication -> SAML2 Web SSO Configuration -> [my issuer] -> edit -> enable audience restriction is checked and my ASP.NET web app url is listed</p>
  
  <p>But this is the response my ASP.NET application gets (audience restriction is missing):</p>
  
  <pre><code>&lt;wst:RequestSecurityTokenResponseCollection xmlns:wst=\"http://docs.oasis-open.org/ws-sx/ws-trust/200512\"&gt;
  &lt;wst:RequestSecurityTokenResponse&gt;
      &lt;wst:TokenType&gt;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1&lt;/wst:TokenType&gt;
      &lt;wst:RequestedAttachedReference&gt;
          &lt;wsse:SecurityTokenReference xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"&gt;
              &lt;wsse:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID\"&gt;_8b7d9425958558c7742bb0cb8e8213e9&lt;/wsse:KeyIdentifier&gt;
          &lt;/wsse:SecurityTokenReference&gt;
      &lt;/wst:RequestedAttachedReference&gt;
      &lt;wst:RequestedUnattachedReference&gt;
          &lt;wsse:SecurityTokenReference xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"&gt;
              &lt;wsse:KeyIdentifier ValueType=\"http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID\"&gt;_8b7d9425958558c7742bb0cb8e8213e9&lt;/wsse:KeyIdentifier&gt;
          &lt;/wsse:SecurityTokenReference&gt;
      &lt;/wst:RequestedUnattachedReference&gt;
      &lt;wst:Lifetime&gt;
          &lt;wsu:Created xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\"&gt;2014-12-02T11:55:13.190Z&lt;/wsu:Created&gt;
          &lt;wsu:Expires xmlns:wsu=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd\"&gt;2014-12-02T12:00:13.190Z&lt;/wsu:Expires&gt;
      &lt;/wst:Lifetime&gt;
      &lt;wst:RequestedSecurityToken&gt;
          &lt;Assertion xmlns=\"urn:oasis:names:tc:SAML:1.0:assertion\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\" xmlns:samlp=\"urn:oasis:names:tc:SAML:1.0:protocol\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" xmlns:saml=\"urn:oasis:names:tc:SAML:1.0:assertion\" AssertionID=\"_8b7d9425958558c7742bb0cb8e8213e9\" IssueInstant=\"2014-12-02T11:55:13.190Z\" Issuer=\"localhost\" MajorVersion=\"1\" MinorVersion=\"1\"&gt;
              &lt;Conditions NotBefore=\"2014-12-02T11:55:13.190Z\" NotOnOrAfter=\"2014-12-02T12:00:13.190Z\"&gt;&lt;/Conditions&gt;
              &lt;AuthenticationStatement AuthenticationInstant=\"2014-12-02T11:55:13.190Z\" AuthenticationMethod=\"urn:oasis:names:tc:SAML:1.0:am:password\"&gt;
              &lt;Subject&gt;
                  &lt;NameIdentifier Format=\"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress\"&gt;admin&lt;/NameIdentifier&gt;
                  &lt;SubjectConfirmation&gt;
                      &lt;ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:bearer&lt;/ConfirmationMethod&gt;
                  &lt;/SubjectConfirmation&gt;
              &lt;/Subject&gt;
              &lt;/AuthenticationStatement&gt;
              &lt;ds:Signature xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\"&gt;
                  &lt;ds:SignedInfo&gt;
                      &lt;ds:CanonicalizationMethod Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"&gt;&lt;/ds:CanonicalizationMethod&gt;
                      &lt;ds:SignatureMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#rsa-sha1\"&gt;&lt;/ds:SignatureMethod&gt;
                      &lt;ds:Reference URI=\"#_8b7d9425958558c7742bb0cb8e8213e9\"&gt;
                          &lt;ds:Transforms&gt;
                              &lt;ds:Transform Algorithm=\"http://www.w3.org/2000/09/xmldsig#enveloped-signature\"&gt;&lt;/ds:Transform&gt;
                              &lt;ds:Transform Algorithm=\"http://www.w3.org/2001/10/xml-exc-c14n#\"&gt;
                                  &lt;ec:InclusiveNamespaces xmlns:ec=\"http://www.w3.org/2001/10/xml-exc-c14n#\" PrefixList=\"code ds kind rw saml samlp typens #default xsd xsi\"&gt;&lt;/ec:InclusiveNamespaces&gt;
                              &lt;/ds:Transform&gt;
                          &lt;/ds:Transforms&gt;
                          &lt;ds:DigestMethod Algorithm=\"http://www.w3.org/2000/09/xmldsig#sha1\"&gt;&lt;/ds:DigestMethod&gt;
                          &lt;ds:DigestValue&gt;cqn2im7M8olMyPuO8BDhQvFlcU8=&lt;/ds:DigestValue&gt;
                      &lt;/ds:Reference&gt;
                  &lt;/ds:SignedInfo&gt;
                  &lt;ds:SignatureValue&gt;jO/kPk+APtOc/gBUsBcLaM4VIbBGe/l2zKAkqjWxfHhkAOx0aduAEt6CssAeY9PrDB/93hxghNPJvn/VAkHKaCLD4/Dt7CwotZHz0l3UABZZiYoMzrZJmO5eOPjA5MAO52Q9vQ+gqLk/iLZCBskgubPmMswi7eufH8jSZES2/ZY=&lt;/ds:SignatureValue&gt;
                  &lt;ds:KeyInfo&gt;
                      &lt;ds:X509Data&gt;
                          &lt;ds:X509Certificate&gt;MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAyMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTousMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44iQlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJRO4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=&lt;/ds:X509Certificate&gt;
                      &lt;/ds:X509Data&gt;
                  &lt;/ds:KeyInfo&gt;
              &lt;/ds:Signature&gt;
          &lt;/Assertion&gt;
      &lt;/wst:RequestedSecurityToken&gt;
  &lt;/wst:RequestSecurityTokenResponse&gt;
  </code></pre>
  
  <p></p>
  
  <p>My one guess is the SAML version is perhaps wrong but I don't see a setting for that.</p>
  
  <p>Also in Tools -> SAML Response Builder I get this:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;saml2p:Response Destination="https://localhost/SSOTestMVC" ID="cieicenceonlnooiogijcipfohekehdpdhmefpgk" IssueInstant="2014-12-02T12:40:35.411Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol"&gt;
      &lt;saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;localhost&lt;/saml2:Issuer&gt;
      &lt;saml2p:Status&gt;
          &lt;saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/&gt;
      &lt;/saml2p:Status&gt;
      &lt;saml2:Assertion ID="jfmphpmhlnedheigcgefihafkehcjlmpminchpgg" IssueInstant="2014-12-02T12:40:35.438Z" Version="2.0" xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"&gt;
          &lt;saml2:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity"&gt;localhost&lt;/saml2:Issuer&gt;
          &lt;saml2:Subject&gt;
              &lt;saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"&gt;admin&lt;/saml2:NameID&gt;
              &lt;saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
                  &lt;saml2:SubjectConfirmationData NotOnOrAfter="2014-12-02T12:45:35.411Z" Recipient="https://localhost/SSOTestMVC"/&gt;
              &lt;/saml2:SubjectConfirmation&gt;
          &lt;/saml2:Subject&gt;
          &lt;saml2:Conditions NotBefore="2014-12-02T12:40:35.438Z" NotOnOrAfter="2014-12-02T12:45:35.411Z"&gt;
              &lt;saml2:AudienceRestriction&gt;
                  &lt;saml2:Audience&gt;localhost&lt;/saml2:Audience&gt;
                  &lt;saml2:Audience&gt;https://localhost/SSOTestMVC&lt;/saml2:Audience&gt;
                  &lt;saml2:Audience&gt;https://localhost/SSOTestMVC/&lt;/saml2:Audience&gt;
              &lt;/saml2:AudienceRestriction&gt;
          &lt;/saml2:Conditions&gt;
          &lt;saml2:AuthnStatement AuthnInstant="2014-12-02T12:40:35.447Z"&gt;
              &lt;saml2:AuthnContext&gt;
                  &lt;saml2:AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/saml2:AuthnContextClassRef&gt;
              &lt;/saml2:AuthnContext&gt;
          &lt;/saml2:AuthnStatement&gt;
      &lt;/saml2:Assertion&gt;
  &lt;/saml2p:Response&gt;
  </code></pre>
  
  <p>The audience correct, what I had added to the list.</p>
  
  <p>And here is mey web.config for reference:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;!--
    For more information on how to configure your ASP.NET application, please visit
    http://go.microsoft.com/fwlink/?LinkId=301880
    --&gt;
  &lt;configuration&gt;
    &lt;configSections&gt;
      &lt;section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/&gt;
      &lt;section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/&gt;
    &lt;/configSections&gt;
      &lt;system.diagnostics&gt;
          &lt;sources&gt;
              &lt;source name="System.IdentityModel" switchValue="Verbose"&gt;
                  &lt;listeners&gt;
                      &lt;add name="xml" type="System.Diagnostics.XmlWriterTraceListener" initializeData="C:\logs\WIF.xml" /&gt;
                  &lt;/listeners&gt;
              &lt;/source&gt;
          &lt;/sources&gt;
          &lt;trace autoflush="true" /&gt;
      &lt;/system.diagnostics&gt;
    &lt;appSettings&gt;
      &lt;add key="webpages:Version" value="3.0.0.0"/&gt;
      &lt;add key="webpages:Enabled" value="false"/&gt;
      &lt;add key="ClientValidationEnabled" value="true"/&gt;
      &lt;add key="UnobtrusiveJavaScriptEnabled" value="true"/&gt;
        &lt;add key="FederationMetadataLocation" value="https://localhost/startersts/FederationMetadata/2007-06/FederationMetadata.xml"/&gt;
    &lt;/appSettings&gt;
    &lt;!--
      For a description of web.config changes see http://go.microsoft.com/fwlink/?LinkId=235367.
  
      The following attributes can be set on the &lt;httpRuntime&gt; tag.
        &lt;system.Web&gt;
          &lt;httpRuntime targetFramework="4.5.1" /&gt;
        &lt;/system.Web&gt;
    --&gt;
  
      &lt;system.webServer&gt;
          &lt;modules&gt;
              &lt;add name="WSFederationAuthenticationModule" type="System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" /&gt;
              &lt;add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" /&gt;
          &lt;/modules&gt;
      &lt;/system.webServer&gt;
  
    &lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.5.1"/&gt;
      &lt;!--&lt;httpRuntime targetFramework="4.5" requestValidationType="SampleRequestValidator"/&gt;--&gt;
      &lt;authorization&gt;
        &lt;deny users="?"/&gt;
      &lt;/authorization&gt;
      &lt;authentication mode="None"/&gt;
      &lt;httpRuntime requestValidationMode="2.0" /&gt;
      &lt;pages validateRequest="false" /&gt;
    &lt;/system.web&gt;
  
    &lt;location path="FederationMetadata"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow users="*"/&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
    &lt;runtime&gt;
      &lt;assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1"&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="Newtonsoft.Json" culture="neutral" publicKeyToken="30ad4fe6b2a6aeed"/&gt;
          &lt;bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0"/&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35"/&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0"/&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35"/&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-1.5.2.14234" newVersion="1.5.2.14234"/&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35"/&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35"/&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/&gt;
        &lt;/dependentAssembly&gt;
        &lt;dependentAssembly&gt;
          &lt;assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35"/&gt;
          &lt;bindingRedirect oldVersion="1.0.0.0-5.2.0.0" newVersion="5.2.0.0"/&gt;
        &lt;/dependentAssembly&gt;
      &lt;/assemblyBinding&gt;
    &lt;/runtime&gt;
    &lt;system.identityModel&gt;
      &lt;identityConfiguration&gt;
        &lt;audienceUris&gt;
          &lt;add value="https://localhost/SSOTestMVC"/&gt;
        &lt;/audienceUris&gt;
        &lt;issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"&gt;
          &lt;trustedIssuers&gt;
            &lt;add thumbprint="6bf8e136eb36d4a56ea05c7ae4b9a45b63bf975d" name="localhost"/&gt;
          &lt;/trustedIssuers&gt;
        &lt;/issuerNameRegistry&gt;
        &lt;certificateValidation certificateValidationMode="None"/&gt;
      &lt;/identityConfiguration&gt;
    &lt;/system.identityModel&gt;
    &lt;system.identityModel.services&gt;
      &lt;federationConfiguration&gt;
        &lt;cookieHandler requireSsl="false"/&gt;
        &lt;wsFederation passiveRedirectEnabled="true" issuer="https://localhost:9443/passivests" realm="https://localhost/SSOTestMVC" requireHttps="true" reply="https://localhost/SSOTestMVC"/&gt;
      &lt;/federationConfiguration&gt;
    &lt;/system.identityModel.services&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I searched for setting the SAML version in the web.config suspecting that might be a problem but no result.</p>