Is SP expiring user session prematurely?

[Cantor, Scott]

> We understand various time restrictions in above message as below
> -- saml:Conditions = Grant access to the user only in between the NotBefore
> and NotOnOrAfter time

No. That has nothing to do with granting access, it's the validity of the assertion and matters only at login time or if the assertion is reused for some other purpose.

> -- saml:AuthnStatement = Create a session only between the AuthnInstant
> and SessionNotOnOrAfter

No. The AuthnInstance doesn't matter, SessionNotOnOrAfter is all that matters. That is the only relevant detail for the SP in session policy, and that's what causes the problem. The SP is doing what it's been told to do by the IdP.

> As we see in the logs, SP expires the session at 2013-03-20 11:54:20. If the
> session is being removed because the time period specified by IdP has
> passed we would expect it to do after 2013-03-20T12:01:14Z. 

That isn't what SessionNotOnOrAfter says, so that's not what I would expect.

-- Scott