How Should Shib SP Handle an Expired Assertion?

[Andrew Owen]

I have setup a federation using Shib SP version 2.4.3 and Shib IdP version 2.3.6.

I currently have two directories protected by the SP, I'll call them "secure1" and "secure2".  When I browse to pages inside of "secure1" or "secure2", the SP redirects me to my IdP to authenticate if my user is not already authenticated - as I would expect. The issue (well, I'm writing to confirm whether this is an issue) I'm seeing is that the SP allows a user to access a protected resource even when the SAML assertion has expired.  Here's the scenario: I set the assertion lifetime to 5 minutes and leave the SP session at 8 hours. I then access a page inside of "secure1" and am redirected to the IdP to login (when I look at the assertion after login, I confirm that NotOnOrAfter is five minutes after IssueInstant).  I let my browser sit for 10 minutes then browse to a page inside of "secure2".  Since the SAML assertion should have expired in this time, I would expect to be redirected to my IdP to login but I am not, instead I just see the protected page - and when I look at the Assertion, the time in "NotOnOrAfter" has passed - even when I take into consideration the clock skew.

The SAML 2.0 SSO profile requires the SP to "Verify that the NotOnOrAfter attribute in any bearer <SubjectConfirmationData> has not passed, subject to allowable clock skew between the providers".  Does this mean the SP should be directing me to the IdP whenever the assertion has expired (the value of "NotOnOrAfter" has passed)?  Is it possible that I need to tweak a configuration on my SP to enable this behavior?  I've read through all of the Shibboleth documentation and nothing is standing out as an obvious fix for the problem I'm seeing.

Thanks,
-Andrew
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130816/30296a5b/attachment.html