An authorization server like PingFederate might set an audience field on the access tokens that it issues, naming one or more services that are allowed to accept the access token. A REST service can use the audience field to ensure that it does not accept access tokens that are intended for use with a different service.

As with the Permitted Clients policy, each rule in the Permitted Audiences policy defines an acceptable audience value.

  1. Go to Policies > Policies.
  2. Expand Global Decision Point and SCIM Policy Set.
  3. Highlight Token Policies and click + and then Add Policy.
  4. For the name, replace Untitled with Permitted Audiences.
  5. From the Combining Algorithm list, select Unless one decision is permit, the decision will be deny.
  6. Click + Add Rule.
  7. For the name, replace Untitled with Audience: https://example.com.
  8. From the Effect list, select Permit.
  9. In the Condition section:
    1. Click + Comparison.
    2. From the Select an Attribute list, select HttpRequest.AccessToken.audience.
    3. From the middle, comparison-type list, select Equals.
    4. In the final field, enter https://example.com.
  10. Expand + Statements.
  11. Click the Components tab, expand Statements, and drag Unauthorized Audience to the Statements box.
    Note:

    Do not click Show Statements within the "Audience: https://example.com" rule.

  12. Click Save changes.
The final configuration should resemble the following image.
Screen capture of the Permitted audiences policy configuration window with a perm rule configured as specified, and an Unauthorized Audience statement, flagged as Obligatory