diff --git a/src/scitokens/scitokens.py b/src/scitokens/scitokens.py index bf9cd74..b88b638 100644 --- a/src/scitokens/scitokens.py +++ b/src/scitokens/scitokens.py @@ -598,9 +598,7 @@ def _validate_aud(self, value): return False elif self._audience == "ANY": return False - elif value == "ANY": - return True - + # Convert the value and self._audience both to sets # Then perform set intersection values = [] @@ -609,6 +607,11 @@ def _validate_aud(self, value): else: values = value set_value = set(values) + + # Check if "ANY" is in the set_value, and always accept if that is true + if "ANY" in set_value: + return True + audiences = [] if not isinstance(self._audience, list): audiences = [self._audience] diff --git a/tests/test_scitokens.py b/tests/test_scitokens.py index 92ecac4..11a435e 100644 --- a/tests/test_scitokens.py +++ b/tests/test_scitokens.py @@ -142,6 +142,14 @@ def test_v2(self): self._token2["aud"] = "ANY" self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure) + # Now set the audience to ANY + self._token2["aud"] = ["ANY"] + self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure) + + # Now set the audience to ANY + self._token2["aud"] = ["notathing.com", "ANY"] + self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure) + # Now to the correct audience self._token2["aud"] = "https://example.unl.edu" self.assertTrue(enf.test(self._token2, "read", "/foo/bar"), msg=enf.last_failure)