Policy Rule "saml2:OneTimeUse"

[Peter Schober]

* Daniel J. Kuen <Daniel.Kuen at ecointense.de> [2014-03-05 10:09]:
> 1.       Is it true that a SP by default ignores the condition
> "OneTimeUse" in the assertions sent by an SAML2-IDP? Will the SP
> reject the reuse of the assertion automatically?

Trying to answer your questions with emails from the threads you
already know (as you cited them):

Yes, which is explained here:
http://marc.info/?l=shibboleth-users&m=131914718629138&w=2

> If this is the default behavior why is it necessary to set
> <PolicyRule type="Ignore">saml2:OneTimeUse</PolicyRule>?

Because of
http://marc.info/?l=shibboleth-users&m=122185301313033&w=2

This is also stated in the documentation you quote:
"In the absence of this rule, any conditions found will result in
rejection of an assertion."

> 2.       Exists there other types than "Ignore" for the Policy Rules
> containing the "OneTimeUse" value? Unfortunately it's not explained
> under
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPPolicyRule

You can always check the the code if you feel the documentation is
incomplete (the XSD doesn't help here, unfortunately).

> 3.       How can we test the whole thing? Is it possible to include
> the condition "OneTimeUse" in the assertions sent from an Shibboleth
> IDP and how?

Not unless you've found indication in the documentation that this is
the case (so no). Again: If you think the documentation is incomplete
feel free to look for hidden features in the code.
-peter