Define If Logic to Validate Audience in SAML2 Token Handler Is Accurate For Both New and Old Paths.

[FuPingFranco]

During the work to migrate Saml2SecurityTokenHandler to our new validation model I'd like to clarify a couple of scenarios that are possible to break on the snip of code below:

var foundAudienceRestriction = false;
foreach (var audienceRestriction in samlToken.Assertion.Conditions.AudienceRestrictions)
{
    if (!foundAudienceRestriction)
        foundAudienceRestriction = true;

    ValidateAudience(audienceRestriction.Audiences, samlToken, validationParameters); //This will only run once reagardless of a successful validation or not.
}

Points to clarify:

• Do we need the loop at all?
• If we keep the loop, should we return as soon as we find a valid audience
• Is there an scenario where the valid audience is on the second audience restriction obj?
• Is unclear from the SAML 2 spec, what is our current guideline for this case?

[FuPingFranco]

This is also handled differently in SamlSecurityTokenHandler

            var foundAudienceRestriction = false;
            foreach (var condition in securityToken.Assertion.Conditions.Conditions)
            {
                if (condition is SamlAudienceRestrictionCondition audienceRestriction)
                {
                    if (!foundAudienceRestriction)
                        foundAudienceRestriction = true;

                    ValidateAudience(audienceRestriction.Audiences.ToDictionary(x => x.OriginalString).Keys, securityToken, validationParameters);
                }
            }

It might be worthwhile to have them follow the same logic but there is a caveat where samlCondition.audiences return different values. One returns an ICollection<Uri> and the other ICollection<String>

[brentschmaltz]

We should be trying all Audience Conditions and not faulting on the first one.