Policy Rule "saml2:OneTimeUse"

[Daniel J. Kuen]

Hello Shibboleth Community,

referring to the discussions (http://marc.info/?l=shibboleth-users&w=2&r=1&s=onetimeuse&q=b) about the "OneTimeUse" Policy in Shibboleth SP we have the following questions:


1.       Is it true that a SP by default ignores the condition "OneTimeUse" in the assertions sent by an SAML2-IDP? Will the SP reject the reuse of the assertion automatically?
If this is the default behavior why is it necessary to set <PolicyRule type="Ignore">saml2:OneTimeUse</PolicyRule>?

2.       Exists there other types than "Ignore" for the Policy Rules containing the "OneTimeUse" value? Unfortunately it's not explained under https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPPolicyRule.

3.       How can we test the whole thing? Is it possible to include the condition "OneTimeUse" in the assertions sent from an Shibboleth IDP and how?

Thank you very much for your help.

BTW: great OpenSource project!

Daniel Kuen
IT Services
............................................
EcoIntense GmbH
Friedenstraße 91a
10249 Berlin



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140305/563205fc/attachment-0001.html