Allow ['ANY'] to be treated as ANY

Fixes scitokens#192

src/scitokens/scitokens.py

@@ -598,9 +598,7 @@ def _validate_aud(self, value):
             return False
         elif self._audience == "ANY":
             return False
-        elif value == "ANY":
-            return True
-
+
         # Convert the value and self._audience both to sets
         # Then perform set intersection
         values = []
@@ -609,6 +607,11 @@ def _validate_aud(self, value):
         else:
             values = value
         set_value = set(values)
+
+        # Check if "ANY" is in the set_value, and always accept if that is true
+        if "ANY" in set_value:
+            return True
+
         audiences = []
         if not isinstance(self._audience, list):
             audiences = [self._audience]

tests/test_scitokens.py

@@ -142,6 +142,14 @@ def test_v2(self):
         self._token2["aud"] = "ANY"
         self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure)
 
+        # Now set the audience to ANY
+        self._token2["aud"] = ["ANY"]
+        self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure)
+
+        # Now set the audience to ANY
+        self._token2["aud"] = ["notathing.com", "ANY"]
+        self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure)
+
         # Now to the correct audience
         self._token2["aud"] = "https://example.unl.edu"
         self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure)