title: Multi-Tenant SAML: How can I identify local account from Response element?
body: <p>I am adding SAML Service Provider support to an existing multi-tenant SaaS application.</p>
  
  <p>In a Idp-initiated workflow, assuming I've previously loaded the Idp metadata XML file, what data can I look for in the <code>samlp:Response</code> to match an assertion to a local account?</p>
  
  <p>Is it safe to match the <code>saml:Issuer</code> in the response against the <code>entityID</code> in the metadata? Could <code>saml:Issuer</code> not be unique across different Idp accounts and thus are not distinct enough?</p>
  
  <p>What about using <code>Audience</code> instead?</p>
  
  <p>Or is it safest to provide our own attribute for the Idp to populate?</p>
  
  <p>Are there any best practices for this?</p>