IdP version 3.1.2 - NotOnOrAfter condition not being set.

[Alan Angulo (Office365 admin)]

Dear list,

I have a shibboleth IdP v3.1.2 implemented.

I'm issuing an unsolicited IdP initiated SSO request as follows:

https://MyIdP312.esu.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=SPId


I am able to authenticate and send the assertion to the SP but the SP complains that the "NotOnOrAfter" condition is missing:

Information : SAML Response is not well formed. Missing SAML 2.0 attribute 'NotOnOrAfter'.


I placed the IdP in debugging mode and I can see that the NotOnOrAfter condition *is* indeed being added.


The following debugging lines from the idp-process.log depict the section where the NotOnOrAfter conditions is being set (Item 11 of this transcript).


Could someone shed some light as to why is the SP stating that the condition is non-existing.


Thank you.



-------------------------------------------------

idp-process log transcript (BEGIN)

-------------------------------------------------

1->    2015-10-14 13:38:16,209 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction at 15b48cc8 expression = AddNotOnOrAfterConditionToAssertions, resultExpression = [null]]

2->    2015-10-14 13:38:16,210 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]

3->    2015-10-14 13:38:16,210 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:450] - Creating instance of bean 'AddNotOnOrAfterConditionToAssertions'

4->    2015-10-14 13:38:16,213 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:450] - Creating instance of bean 'net.shibboleth.idp.saml.profile.config.navigate.AssertionLifetimeLookupFunction#641d8c43'

5->    2015-10-14 13:38:16,216 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1657] - No default init method named 'initialize' found on bean with name 'net.shibboleth.idp.saml.profile.config.navigate.AssertionLifetimeLookupFunction#641d8c43'

6->    2015-10-14 13:38:16,216 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:478] - Finished creating instance of bean 'net.shibboleth.idp.saml.profile.config.navigate.AssertionLifetimeLookupFunction#641d8c43'

7->    2015-10-14 13:38:16,217 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1666] - Invoking init method  'initialize' on bean with name 'AddNotOnOrAfterConditionToAssertions'

8->    2015-10-14 13:38:16,217 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:478] - Finished creating instance of bean 'AddNotOnOrAfterConditionToAssertions'

9->    2015-10-14 13:38:16,217 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor at 6218c78e

10->    2015-10-14 13:38:16,218 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:114] - Profile Action AddNotOnOrAfterConditionToAssertions: Attempting to add NotOnOrAfter condition to every Assertion in outgoing Response

11->    2015-10-14 13:38:16,226 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:169] - Profile Action AddNotOnOrAfterConditionToAssertions: Added NotOnOrAfter condition, indicating an expiration of 2015-10-14T17:43:16.084Z, to Assertion _06e7be12e7537b0a6dea870ec68e00b4

12->    2015-10-14 13:38:16,227 - DEBUG [org.opensaml.saml.saml2.profile.SAML2ActionSupport:129] - Profile Action AddNotOnOrAfterConditionToAssertions: Assertion _06e7be12e7537b0a6dea870ec68e00b4 already contained Conditions, nothing was done

13->    2015-10-14 13:38:16,227 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor at 6218c78e; result = null

14->    2015-10-14 13:38:16,227 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]

15->    2015-10-14 13:38:16,227 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction at 15b48cc8 expression = AddNotOnOrAfterConditionToAssertions, resultExpression = [null]]; result = null


-------------------------------------------------

idp-process log transcript (END)

-------------------------------------------------


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151014/6566efdc/attachment.html>