[java-plugin-shibd-saml] branch main updated: Clean up time-based settings in SAML flows.

[Codeberg]

This is an automated email from the git hooks/post-receive script.

codeberg pushed a commit to branch main
in repository java-plugin-shibd-saml.

View the commit online:
https://codeberg.org/Shibboleth/java-plugin-shibd-saml/commit/478668115a2e2e731282c87c70482095138d45a9

The following commit(s) were added to refs/heads/main by this push:
     new 4786681  Clean up time-based settings in SAML flows.
4786681 is described below

commit 478668115a2e2e731282c87c70482095138d45a9
Author: Scott Cantor <scott at restingparrotsoftware.com>
AuthorDate: Wed Sep 2 15:55:57 2026 -0400

    Clean up time-based settings in SAML flows.
---
 .../net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml | 10 +++++-----
 .../idp/flows/sp/logout/consumer/saml2/saml2-beans.xml         |  6 +++---
 .../net/shibboleth/idp/module/conf/sp/saml.properties          |  3 +++
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
index 72d2a0c..99c01db 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/consumer/saml2/saml2-beans.xml
@@ -78,10 +78,10 @@
                         <bean class="org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler" scope="prototype"
                             p:activationCondition="%{sp.saml.checkReplay:true}"
                             p:replayCache-ref="shibboleth.ReplayCache"
-                            p:expires="%{sp.policy.messageLifetime:PT3M}" />
+                            p:expires="%{sp.saml.messageLifetime:%{sp.policy.messageLifetime:PT3M}}" />
                         <bean class="org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler" scope="prototype"
-                            p:messageLifetime="%{sp.policy.messageLifetime:PT3M}"
-                            p:clockSkew="%{sp.policy.clockSkew:PT3M}" />
+                            p:messageLifetime="%{sp.saml.messageLifetime:%{sp.policy.messageLifetime:PT3M}}"
+                            p:clockSkew="%{sp.saml.clockSkew:%{sp.policy.clockSkew:PT3M}}" />
                         <bean class="org.opensaml.saml.common.binding.impl.CheckMessageStatusHandler" scope="prototype" />
                         <bean class="org.opensaml.saml.common.binding.security.impl.SAMLProtocolMessageXMLSignatureSecurityHandler" scope="prototype" />
                         <bean class="org.opensaml.saml.saml2.binding.security.impl.SAML2HTTPPostSimpleSignSecurityHandler" scope="prototype"
@@ -148,8 +148,8 @@
     </bean>
 
     <bean id="AssertionValidationContextBuilder" class="org.opensaml.saml.saml2.assertion.messaging.impl.DefaultAssertionValidationContextBuilder">
-        <property name="clockSkew" value="%{sp.policy.clockSkew:PT3M}" />
-        <property name="lifetime" value="%{sp.policy.assertionLifetime:PT3M}" />
+        <property name="clockSkew" value="%{sp.saml.clockSkew:%{sp.policy.clockSkew:PT3M}}" />
+        <property name="lifetime" value="%{sp.saml.messageLifetime:%{sp.policy.messageLifetime:PT3M}}" />
         <property name="validIssuers">
             <!-- This is wrapping the valid issuer into a set but via a Function. -->
             <bean parent="shibboleth.ContextFunctions.Expression"
diff --git a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
index 104cbef..c4bf16c 100644
--- a/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
+++ b/sp-saml-conf-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/sp/logout/consumer/saml2/saml2-beans.xml
@@ -96,10 +96,10 @@
                             p:httpServletRequestSupplier-ref="shibboleth.RemotedHttpServletRequestSupplier" />
                         <bean class="org.opensaml.saml.common.binding.security.impl.MessageReplaySecurityHandler" scope="prototype"
                             p:replayCache-ref="shibboleth.ReplayCache"
-                            p:expires="%{sp.policy.messageLifetime:PT3M}" />
+                            p:expires="%{sp.saml.messageLifetime:%{sp.policy.messageLifetime:PT3M}}" />
                         <bean class="org.opensaml.saml.common.binding.security.impl.MessageLifetimeSecurityHandler" scope="prototype"
-                            p:messageLifetime="%{sp.policy.messageLifetime:PT3M}"
-                            p:clockSkew="%{sp.policy.clockSkew:PT3M}" />
+                            p:messageLifetime="%{sp.saml.messageLifetime:%{sp.policy.messageLifetime:PT3M}}"
+                            p:clockSkew="%{sp.saml.clockSkew:%{sp.policy.clockSkew:PT3M}}" />
                     </list>
                 </property>
              </bean>
diff --git a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
index 093547e..fbb78bf 100644
--- a/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
+++ b/sp-saml-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/sp/saml.properties
@@ -8,11 +8,14 @@ sp.saml.encryption.key = %{idp.home}/credentials/sp/saml-default-encryption.key
 sp.saml.encryption.cert = %{idp.home}/credentials/sp/saml-default-encryption.crt
 
 # Global profile defaults
+#sp.saml.clockSkew = PT3M
 #sp.saml.encryption.optional = true
 # Turn off to allow SubjectConfirmationData/@Recipient to be absent
 #sp.saml.requireRecipient = true
 # Turn off to allow SubjectConfirmationData/@NotOnOrAfter to be absent
 #sp.saml.requireNotOnOrAfter = true
+# Allowable message acceptance window
+#sp.saml.messageLifetime = PT3M
 # Turn off to disallow unsolicited SSO responses
 #sp.saml.allowUnsolicited = true
 # Turn off to disable address check during assertion validation

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.