NotBefore condition in assertions

[Cantor, Scott]

On 10/16/12 9:46 PM, "Michael A Grady" <mgrady at unicon.net> wrote:

>I'm trying to fully understand the value of the NotBefore condition in
>SAML assertions.

What's the value of it in a certificate or a forward-dated Kerberos
ticket? Same answer. SAML is a generalized security framework. It has a
lot of features that only make sense in a particular context.

> For example, is there an actual use case where one would generate an
>assertion that you didn't want to be valid until N hours from now?

Sure. I don't have any personally at the moment. If I was generating
assertions for an intelligent client, I'd probably have some.

>The SAML core standard has NotBefore as optional, the only mention of it
>in the OASIS SAML Profiles document is a mention of where it *must not*
>be used,

That's not the same attribute, it just happens to have the same name for
consistency.

>In fact, the only place I can find that suggests it as a "must" is the
>document from the "Interoperable SAML 2.0 Web Browser SSO Deployment
>Profile group" that states:
>
>"The Identity Provider MUST include a <saml:Conditions> element.
>Conditions restricting the period when the assertion is valid, the
>@NotBefore and @NotOnOrAfter MUST be included."

I suspect that's because some buggy SPs in the world mistakenly think the
SSO profile requires that, so including it avoided problems. I don't
recall asking for that, so it must have come from Andreas.

>So maybe the security of SAML would be compromised if SAML assertions did
>not contain NotBefore, but if that's the case, I'd like to understand
>exactly why it is key to have it. Because the one thing I see NotBefore
>yielding now is interoperability problems, because a number of SPs are
>incapable/unwilling to apply skewing factors.

Omit it, and now a different set of SPs (or possibly some of the same
ones) break.

It's on the list of yet more toggles and switches to add to the IdP to
deal with interoperability bugs.

-- Scott