How Should Shib SP Handle an Expired Assertion?

[Peter Schober]

* Andrew Owen <andrew at search.org> [2013-08-16 16:57]:
> I currently have two directories protected by the SP, I'll call them
> "secure1" and "secure2".  When I browse to pages inside of "secure1"
> or "secure2", the SP redirects me to my IdP to authenticate if my
> user is not already authenticated - as I would expect. The issue
> (well, I'm writing to confirm whether this is an issue) I'm seeing
> is that the SP allows a user to access a protected resource even
> when the SAML assertion has expired.  Here's the scenario: I set the
> assertion lifetime to 5 minutes and leave the SP session at 8
> hours. I then access a page inside of "secure1" and am redirected to
> the IdP to login (when I look at the assertion after login, I
> confirm that NotOnOrAfter is five minutes after IssueInstant).  I
> let my browser sit for 10 minutes then browse to a page inside of
> "secure2".  Since the SAML assertion should have expired in this
> time, I would expect to be redirected to my IdP to login but I am
> not, instead I just see the protected page - and when I look at the
> Assertion, the time in "NotOnOrAfter" has passed - even when I take
> into consideration the clock skew.

You seem to be confusing NotOnOrAfter with SessionNotOnOrAfter.
-peter