All IAM glossary termsProtocols · glossary
AudienceRestriction
Also known as: SAML Audience Restriction
Definition
AudienceRestriction is the SAML 2.0 element that limits which Service Provider may consume an assertion — preventing replay against the wrong SP.
In more depth
A SAML assertion includes a Conditions element with AudienceRestriction listing the intended audience (typically the SP's EntityID). The SP must validate that its EntityID matches the AudienceRestriction; if not, reject the assertion.
This defends against assertions issued for SP-A being replayed against SP-B. Combined with NotOnOrAfter (expiration) and InResponseTo (request binding), it forms the SAML security foundation.
Want the work, not just the definition?