Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

[Michael Nielsen]

Thanks Scott.

After considerable testing and inspection of traces and console messages, I'm very certain of the behavior I'm seeing.

I looked at the assertion closely -- it does not have a SessionNotOnOrAfter.

If there is not one specified in the AuthnStatement would AuthnInstant+5 minutes be implicit, or would it be up to the SP?

If it's up to the SP, then I clearly have timeout="1800" specified in the Sessions element, so I'm not understanding why it times-out in 5 minutes.

Thanks again for your kind assistance.

--assertion--

<Samlpx:Response ID="_f7b032ad-606a-4315-89f5-01af930e9192"
                Version="2.0"
                IssueInstant="2018-10-19T13:57:25.274Z"
                Destination="https://sp.my-sp.com/Shibboleth.sso/SAML2/POST"
                Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified"
                InResponseTo="_56deb945fdc3aafcd17ab5b7211fba18"
                xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol">
  <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion">http://idp.them.org/adfs/services/trust</Issuer>
  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success" /></samlp:Status>
  <Assertion ID="_6f649816-7ab4-4d15-88e3-fd835e0f4882"
             IssueInstant="2018-10-19T13:57:25.273Z"
             Version="2.0"
             xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
    <Issuer>http://idp.them.org/adfs/services/trust</Issuer>
    <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
        <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
        <ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
        <ds:Reference URI="#_6f649816-7ab4-4d15-88e3-fd835e0f4882">
          <ds:Transforms>
            <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
            <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /></ds:Transforms>
          <ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
          <ds:DigestValue>wvw0vJ5XwtYs5mv/75QVTicubjc=</ds:DigestValue>
        </ds:Reference>
      </ds:SignedInfo>
      <ds:SignatureValue>...</ds:SignatureValue>
      <KeyInfo
      xmlns="http://www.w3.org/2000/09/xmldsig#">
        <ds:X509Data>
          <ds:X509Certificate>...</ds:X509Certificate>
        </ds:X509Data>
        </KeyInfo>
    </ds:Signature>
    <Subject>
      <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
        <SubjectConfirmationData InResponseTo="_56deb945fdc3aafcd17ab5b7211fba18"
                                 NotOnOrAfter="2018-10-19T14:02:25.274Z"
                                 Recipient="https://sp.my-sp.com/Shibboleth.sso/SAML2/POST" />
      </SubjectConfirmation>
    </Subject>
    <Conditions NotBefore="2018-10-19T13:57:25.271Z"
                NotOnOrAfter="2018-10-19T21:57:25.271Z">
      <AudienceRestriction>
        <Audience>https://sp.my-sp.com/shibboleth</Audience>
      </AudienceRestriction>
    </Conditions>
    <AttributeStatement>
      <Attribute Name="uid">
        <AttributeValue>xsamlgate</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
        <AttributeValue>xsamlgate at them.org</AttributeValue>
      </Attribute>
      <Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name">
        <AttributeValue>xsamlgate</AttributeValue>
      </Attribute>
      <Attribute Name="username">
        <AttributeValue>xsamlgate at them.org</AttributeValue>
      </Attribute>
      <Attribute Name="https://my-sp.com/CustomAttributes/iLabFlags">
        <AttributeValue>p,t</AttributeValue>
      </Attribute>
    </AttributeStatement>
    <AuthnStatement AuthnInstant="2018-10-19T13:57:25.184Z">
      <AuthnContext>
        <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef>
      </AuthnContext>
    </AuthnStatement>
  </Assertion>
</samlp:Response>
-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Sunday, October 21, 2018 12:17 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

On 10/20/18, 8:56 PM, "users on behalf of Michael Nielsen" <users-bounces at shibboleth.net on behalf of michael.nielsen at cedargate.com> wrote:

> Is this the timeout to which you refer?

Yes.

>  I'm guessing not, since I'm pretty sure I get at most 5 minutes of inactivity before being 302'd back to the IdP.

Then the IdP is doing what I told you it's doing, or you're mistaken about what's really happening.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net