[java-identity-provider] branch main updated: OSJ-346: Assertion validator is not checking IssueInstant

[Brent Putman]

This is an automated email from the git hooks/post-receive script.

putmanb pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=1e218f9c5ea50beea3bc82a78b220e2cae4b2a40

The following commit(s) were added to refs/heads/main by this push:
     new 1e218f9c5 OSJ-346: Assertion validator is not checking IssueInstant
1e218f9c5 is described below

commit 1e218f9c5ea50beea3bc82a78b220e2cae4b2a40
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Mar 3 14:04:11 2022 -0500

    OSJ-346: Assertion validator is not checking IssueInstant
    
    Add prop wiring and default config for idp.policy.assertionLifetime.
---
 .../main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml   | 1 +
 idp-conf/src/main/resources/conf/idp.properties                          | 1 +
 2 files changed, 2 insertions(+)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
index fd8ee2e0c..7b6728de5 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/flows/authn/saml-authn-beans.xml
@@ -384,6 +384,7 @@
 
     <bean id="AssertionValidationContextBuilder" class="org.opensaml.saml.saml2.profile.impl.DefaultAssertionValidationContextBuilder">
         <property name="clockSkew" value="%{idp.policy.clockSkew:PT3M}" />
+        <property name="lifetime" value="%{idp.policy.assertionLifetime:PT3M}" />
         <property name="checkAddress">
             <bean class="net.shibboleth.idp.saml.saml2.profile.config.logic.CheckAddressPredicate" />
         </property>
diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 9ec6659d0..413bed209 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -200,6 +200,7 @@ idp.bindings.inMetadataOrder = false
 
 # Message freshness and replay cache tuning
 #idp.policy.messageLifetime = PT3M
+#idp.policy.assertionLifetime = PT3M
 #idp.policy.clockSkew = PT3M
 
 # Set to custom bean for alternate storage of replay cache

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.