IdP version 3.1.2 - NotOnOrAfter condition not being set.

[Brent Putman]

On 10/14/15 3:04 PM, Alan Angulo (Office365 admin) wrote:
>
> I am able to authenticate and send the assertion to the SP but the SP
> complains that the "*NotOnOrAfter*" condition is missing:
>
> *Information : *SAML Response is not well formed. Missing SAML 2.0
> attribute 'NotOnOrAfter'.
>
>

There's actually 2 NotOnOrAfter attributes in a typical SAML 2
Assertion in a Response: 1) the bearer SubjectConfirmationData, where
it's required 2) the Conditions, where it's optional. They don't
mention which one they're complaining about there, but...


> I placed the IdP in debugging mode and I can see that the
> NotOnOrAfter condition *is* indeed being added.
>
>

My 3.x test IdP also shows both NotOnOrAfter attributes being populated
on an unsolicited SSO response.


>
> Could someone shed some light as to why is the SP stating that the
> condition is non-existing.
>
>
>

We're pretty clearly sending it I think.  If you want to double-check,
just turn on the PROTOCOL_MESSAGE logger to DEBUG to see the actual
response that's being returned.  If the assertion is encrypted, you'll
either need to disable that temporarily or else also turn on DEBUG for
category 'org.opensaml.saml.saml2.encryption.Encrypter'.

If you confirm your IdP is sending those, as I suspect you will, then
they have a bug, which you should report to them.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151014/a488df63/attachment.html>