[java-plugin-shibd-saml] branch main updated: Fix maxTimeSinceAuthn and add global property for it.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/7b0ca2d24fbb29999d13fbce2d0bbaf8dc44c4a3

The following commit(s) were added to refs/heads/main by this push:
     new 7b0ca2d  Fix maxTimeSinceAuthn and add global property for it.
7b0ca2d is described below

commit 7b0ca2d24fbb29999d13fbce2d0bbaf8dc44c4a3
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Apr 6 10:46:08 2026 -0400

    Fix maxTimeSinceAuthn and add global property for it.
---
 .../META-INF/net/shibboleth/sp/service/agent/postconfig.xml | 13 +++++++------
 .../net/shibboleth/idp/module/conf/sp/saml.properties       |  2 ++
 .../profile/config/impl/BrowserSSOProfileConfiguration.java |  4 ++--
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
index 1a0dd0b..4fa5c27 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/sp/service/agent/postconfig.xml
@@ -61,11 +61,12 @@
         class="net.shibboleth.sp.saml.saml2.profile.config.impl.BrowserSSOProfileConfiguration"
         p:securityConfiguration-ref="%{sp.saml.security.config:shibboleth.sp.DefaultXMLSecurityConfiguration}"
         p:encryptionOptionalPredicate="%{sp.saml.encryption.optional:true}"
-        p:checkAddress="%{sp.saml.checkAddress:true}"
-        p:checkInResponseTo="%{sp.saml.checkInResponseTo:true}"
-        p:allowUnsolicited="%{sp.saml.allowUnsolicited:true}"
-        p:extractStandardAttributes="%{sp.saml.extractStandardAttributes:false}"
-        p:resolveAttributes="%{sp.saml.resolveAttributes:false}" />
+        p:maximumTimeSinceAuthn="%{sp.saml.maxTimeSinceAuthn:0}"
+        p:checkAddressPredicate="%{sp.saml.checkAddress:true}"
+        p:checkInResponseToPredicate="%{sp.saml.checkInResponseTo:true}"
+        p:allowUnsolicitedPredicate="%{sp.saml.allowUnsolicited:true}"
+        p:extractStandardAttributesPredicate="%{sp.saml.extractStandardAttributes:false}"
+        p:resolveAttributesPredicate="%{sp.saml.resolveAttributes:false}" />
 
     <util:constant id="SAML2.SSO.FEATURE_AUTHNCONTEXT"
         static-field="net.shibboleth.saml.saml2.profile.config.BrowserSSOProfileConfiguration.FEATURE_AUTHNCONTEXT"/>
@@ -89,7 +90,7 @@
         class="net.shibboleth.sp.saml.saml2.profile.config.impl.SingleLogoutProfileConfiguration"
         p:securityConfiguration-ref="%{sp.saml.security.config:shibboleth.sp.DefaultXMLSecurityConfiguration}"
         p:encryptionOptionalPredicate="%{sp.saml.encryption.optional:true}"
-        p:asynchronous="%{sp.saml.logout.asynchronous:true}" />
+        p:asynchronousPredicate="%{sp.saml.logout.asynchronous:true}" />
     
     <!--
     Security Configuration Defaults
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index 2669d87..b5cd27a 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -21,6 +21,8 @@ sp.saml.encryption.cert = %{idp.home}/credentials/sp/sp-encryption.crt
 #sp.saml.checkAddress = true
 # Turn off to disable message correlation checking
 #sp.saml.checkInResponseTo = true
+# Set to non-zero duration to limit time since authentication
+#sp.saml.maxTimeSinceAuthn = 0
 
 # Default security configuration for SAML
 #sp.saml.security.config = shibboleth.sp.DefaultXMLSecurityConfiguration
diff --git a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
index d055ab5..fd62d39 100644
--- a/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
+++ b/sp-saml-impl/src/main/java/net/shibboleth/sp/saml/saml2/profile/config/impl/BrowserSSOProfileConfiguration.java
@@ -332,8 +332,8 @@ public class BrowserSSOProfileConfiguration extends AbstractSAML2AssertionConsum
     @Nullable public Duration getMaximumTimeSinceAuthn(@Nullable final ProfileRequestContext profileRequestContext) {
         final Duration amount = maximumTimeSinceAuthnLookupStrategy.apply(profileRequestContext);
         Constraint.isFalse(amount != null && amount.isNegative(),
-                "Maximum time since authentication must be greater than or equal to 0");
-        return amount;
+                "Maximum time since authentication must be null or non-negative");
+        return amount != null && !amount.isZero() ? amount : null;
     }
 
     /**

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.