Element <OneTimeUse> and attributes "NotBefore"/"NotOnOrAfter" in SP side

[Teruaki.Ichikawa at mk.scsk.jp]

Thanks Scott.

I understood OneTimeUse and NotBefore/NotOnOrAfter in shibboleth SP.

Teruaki Ichikawa

>>1. <OneTimeUse> elements
>>I would like to have Shibboleth SP accepted SAML assertion "only once".
>>And I would like to refuse the assetion if it's Assertion ID is equal to
>>the last Assertion ID.
>>Does Shibboleth SP accept the SAML assertion only once with default
>>configuration ?
>
>There's a ReplayCache on by default. It does not rely on OneTimeUse
>conditions, which are generally meaningless and unused in SAML.
>
>>Referring to the following URL, I'm afraid that the OneTimeUse policy is
>>ignored by the default conditions rule.
>
>They're ignored because they don't tell the SP to do anything it isn't
>already doing.
>
>>2. "NotBefore" and "NotOnOrAfter"
>>Does Shibboleth SP verify "NotBefore" and "NotOnOrAfter" attributes if
>>SAML assertion issued by IdP have the attributes?
>
>Anywhere the SP accepts an assertion as valid, it checks them.
>
>>How should I set up shibboleth2.xml ?
>
>You don't.
>
>-- Scott