NotBefore condition in assertions

[Michael A Grady]

I'm trying to fully understand the value of the NotBefore condition in SAML assertions. For example, is there an actual use case where one would generate an assertion that you didn't want to be valid until N hours from now? If not, what exact value is it adding, given that you already have an IssueInstant for the assertion (and an AuthnInstant for the AuthnStatement)? What are the security use cases/"threats" that the NotBefore serves as a solution/mitigation for?

The SAML core standard has NotBefore as optional, the only mention of it in the OASIS SAML Profiles document is a mention of where it *must not* be used, and the core standard indicates it is optional for the IdP to return it even if the SP requests it in the Authn Request. In fact, the only place I can find that suggests it as a "must" is the document from the "Interoperable SAML 2.0 Web Browser SSO Deployment Profile group" that states:

"The Identity Provider MUST include a <saml:Conditions> element. Conditions restricting the period when the assertion is valid, the @NotBefore and @NotOnOrAfter MUST be included."

  https://rnd.feide.no/documents/saml2simple.html

So maybe the security of SAML would be compromised if SAML assertions did not contain NotBefore, but if that's the case, I'd like to understand exactly why it is key to have it. Because the one thing I see NotBefore yielding now is interoperability problems, because a number of SPs are incapable/unwilling to apply skewing factors.

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.