protected void validateAudienceRestrictions(final Collection<AudienceRestriction> audienceRestrictions,
                                                final String spEntityId) {

        if (audienceRestrictions == null || audienceRestrictions.isEmpty()) {
            throw new SAMLAssertionAudienceException("Audience restrictions cannot be null or empty");
        }

        final Collection<String> audienceUris = new HashSet<>();
        for (val audienceRestriction : audienceRestrictions) {
            if (audienceRestriction.getAudiences() != null) {
                for (val audience : audienceRestriction.getAudiences()) {
                    audienceUris.add(audience.getURI());
                }
            }
        }
        if (!audienceUris.contains(spEntityId)) {
            throw new SAMLAssertionAudienceException("Assertion audience " + audienceUris
                + " does not match SP configuration " + spEntityId);
        }
    }
Validate audience by matching the SP entityId.

@param audienceRestrictions the audience restrictions
@param spEntityId           the sp entity id
pac4j-saml/src/main/java/org/pac4j/saml/sso/impl/SAML2AuthnResponseValidator.java