AW: <saml2:Conditions> in AuthnRequest

[Dominik Strecker]

It's working now. Thank you a lot, Scott!

>> I'm trying to configure my SP 2.6.1 (on IIS) to send out <saml2:Conditions NotOnOrAfter="...">
>> in the AuthnRequest but cannot get it to work. The closest I could find is a
>> SessionInitiator with embedded <saml2p:AuthnRequest>, but that didn't work either.

> It works, it's just not dynamic. There are ways to do it dynamically that are documented,
> you can pass an entire AuthnRequest to the SessionInitiator now.

For anyone interested, here is a snippet from a tiny .NET application that prepares the AuthnRequest template:

                string authnRequestTemplate = "<samlp:AuthnRequest xmlns:samlp=\"urn:oasis:names:tc:SAML:2.0:protocol\" ID=\"_\" "
                    + "IssueInstant=\"2018-01-01T00:00:00Z\" Version=\"2.0\">"
                    + "<saml:Conditions xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" "
                    + "NotBefore=\"$NotBefore\" NotOnOrAfter=\"$NotOnOrAfter\" /></samlp:AuthnRequest>";

                // replace timestamps
                DateTime now = DateTime.UtcNow;
                string notBefore = now.ToString("yyyy-MM-ddTHH\\:mm\\:ss.fffK");
                now = now.Add(TimeSpan.FromSeconds(10));
                string notOnOrAfter = now.ToString("yyyy-MM-ddTHH\\:mm\\:ss.fffK");
                authnRequestTemplate = System.Text.RegularExpressions.Regex.Replace(authnRequestTemplate, "\\$NotBefore", notBefore);
                authnRequestTemplate = System.Text.RegularExpressions.Regex.Replace(authnRequestTemplate, "\\$NotOnOrAfter", notOnOrAfter);

                // convert to base64
                byte[] authnRequestTemplateBytes = System.Text.Encoding.UTF8.GetBytes(authnRequestTemplate);
                authnRequestTemplate = System.Convert.ToBase64String(authnRequestTemplateBytes);

                // retain original query string
                string query = context.Request.QueryString.ToString();
                if (query.StartsWith("?"))
                {
                    query += "&";
                }
                else
                {
                    query += "?";
                }
                context.Response.Redirect("/Shibboleth.sso/Login" + query + "template=" + authnRequestTemplate);

>> Can anyone point me in the right direction?

> You shouldn't do this, that's my advice.

I'd love to leave it out, but the IDP requires me to send it. :(