Element <OneTimeUse> and attributes "NotBefore"/"NotOnOrAfter" in SP side

[Cantor, Scott]

On 10/18/11 4:00 AM, "Teruaki.Ichikawa at mk.scsk.jp"
<Teruaki.Ichikawa at mk.scsk.jp> wrote:
>
>1. <OneTimeUse> elements
>I would like to have Shibboleth SP accepted SAML assertion "only once".
>And I would like to refuse the assetion if it's Assertion ID is equal to
>the last Assertion ID.
>Does Shibboleth SP accept the SAML assertion only once with default
>configuration ?

There's a ReplayCache on by default. It does not rely on OneTimeUse
conditions, which are generally meaningless and unused in SAML.

>Referring to the following URL, I'm afraid that the OneTimeUse policy is
>ignored by the default conditions rule.

They're ignored because they don't tell the SP to do anything it isn't
already doing.

>2. "NotBefore" and "NotOnOrAfter"
>Does Shibboleth SP verify "NotBefore" and "NotOnOrAfter" attributes if
>SAML assertion issued by IdP have the attributes?

Anywhere the SP accepts an assertion as valid, it checks them.

>How should I set up shibboleth2.xml ?

You don't.

-- Scott