How Should Shib SP Handle an Expired Assertion?

[Andrew Owen]

Thank you Scott and Peter -- looks like I was just missing the maximumSPSessionLifetime IdP configuration for the SAML2SSOProfile.  


-Andrew
916.215.3933

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, August 16, 2013 11:11 AM
To: Shib Users
Subject: Re: How Should Shib SP Handle an Expired Assertion?

On 8/16/13 10:56 AM, "Andrew Owen" <andrew at search.org> wrote:

>(well, I¹m writing to confirm whether this is an issue) I¹m seeing is 
>that the SP allows a user to access a protected resource even when the 
>SAML assertion has expired.

The assertion expiration has nothing to do with session lifetime. It applies to initial acceptance, and applies to reuse, not to session behavior. The actual time that matters is the bearer confirmation expiration, but the overall expiration is also checked at initial acceptance, though it's redundant. I don't know which one you're even checking here, but there are two, and neither of them mean what you're thinking about.

SessionNotOnOrAfter does however, and is the only aspect of SAML, apart from logout, that has anything to say about a session of any kind.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net