Empty Conditions Element w/out NotBefore or NotOnOrAfter attributes

[Walden H. Leverich]

We're an SP running 2.5.2. We're receiving a SAML response from an IdP that includes an empty conditions element (<Conditions/>) which seems to be causing us a problem, specifically a xmltooling::ValidationException with the error "Conditions must have NotBefore or NotOnOrAfter."

The reason for the exception is rather obvious, the IdP is including neither the NotBefore nor the NotOnOrAfter attribute. This is thankfully from their test IdP, while their production IdP returns a conditions element with the OneTimeUse subelement. However, their production IdP doesn't include the attributes either, but the conditions element isn't empty. Near as we can tell from the source code (http://svn.shibboleth.net/view/cpp-opensaml/tags/2.5.2/saml/saml2/core/impl/Assertions20SchemaValidators.cpp?revision=760&amp;view=markup) the issue is at line 97, specifically the check that if the element doesn't have children then one of those attributes is required.

So here's the question... Who's wrong in this case? The OASIS schema seems to imply that neither the NotBefore nor the NotOnOrAfter attributes are actually required. But I know the schema doesn't always tell the whole story. Additionally, it makes sense that if there are no subelements then the only reason for including the conditions element would be to indicate a date range.

But, what does the official specification say? And where? MUST the IdP include those attributes, or SHOULD they? And even if they MUST, SHOULD the SP be that restrictive, or should it allow an empty conditions element anyway? Finally, and I don't see how looking at the source, but is there a flag/setting we can enable to tell the validation to be more permissive?

Thanks,
-Walden


--
Walden H Leverich III
Tech Software &
BEC - IRBManager
(516) 627-3800 x3051
WaldenL at TechSoftInc.com<mailto:WaldenL at TechSoftInc.com>
http://www.TechSoftInc.com<https://urldefense.proofpoint.com/v1/url?u=http://www.techsoftinc.com/&k=WP1bMHVseboJL1xhlI0uEw%3D%3D%0A&r=GnLiemISRMhJdRORs%2BauZA%3D%3D%0A&m=thWPQY36Sv%2FJ%2BviYqaY0wBRwadUK8MONZjrQLZheC1M%3D%0A&s=2b03463412bd480492a2b8a923359ef028507388a594a90ebaedaf2912a34618>
http://www.IRBManager.com<https://urldefense.proofpoint.com/v1/url?u=http://www.irbmanager.com/&k=WP1bMHVseboJL1xhlI0uEw%3D%3D%0A&r=GnLiemISRMhJdRORs%2BauZA%3D%3D%0A&m=thWPQY36Sv%2FJ%2BviYqaY0wBRwadUK8MONZjrQLZheC1M%3D%0A&s=b473038fbeaca73729c1fba0ddd743b4adcbb988d7e53ce22e0ef5423630cf63>

Quiquid latine dictum sit altum viditur.
(Whatever is said in Latin seems profound.)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141209/c0ebbaf6/attachment.html