<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:10pt;color:#000000;background-color:#FFFFFF;font-family:Century Gothic;">
<p>Dear list,</p>
<p>I have a shibboleth IdP v3.1.2 implemented.</p>
<p>I'm issuing an unsolicited IdP initiated SSO request as follows:</p>
<p><font color="#d05c12"><strong>https://MyIdP312.esu.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=SPId</strong></font></p>
<p><br>
</p>
<p>I am able to authenticate and send the assertion to the SP but the SP complains that the "<font color="#006fc9"><strong>NotOnOrAfter</strong></font>" condition is missing:
</p>
<p><b style="color: rgb(0, 0, 0); text-transform: none; line-height: normal; text-indent: 0px; letter-spacing: normal; font-family: Arial; font-size: small; font-style: normal; font-variant: normal; word-spacing: 0px; white-space: normal; widows: 1; background-color: rgb(204, 204, 204); -webkit-text-stroke-width: 0px;">Information
:<span class="Apple-converted-space"> </span></b><span style="font: small/normal Arial; color: rgb(0, 0, 0); text-transform: none; text-indent: 0px; letter-spacing: normal; word-spacing: 0px; float: none; display: inline !important; white-space: normal; widows: 1; font-size-adjust: none; font-stretch: normal; background-color: rgb(204, 204, 204); -webkit-text-stroke-width: 0px;">SAML
Response is not well formed. Missing SAML 2.0 attribute 'NotOnOrAfter'.</span></p>
<p><br>
</p>
<p>I placed the IdP in debugging mode and I can see that the NotOnOrAfter condition *is* indeed being added.</p>
<p><br>
</p>
<p>The following debugging lines from the idp-process.log depict the section where the NotOnOrAfter conditions is being set (Item 11 of this transcript).
</p>
<p><br>
</p>
<p>Could someone shed some light as to why is the SP stating that the condition is non-existing.</p>
<p><br>
</p>
<p>Thank you.</p>
<p><br>
</p>
<p><br>
</p>
<p>-------------------------------------------------</p>
<p>idp-process log transcript (BEGIN)</p>
<p>-------------------------------------------------</p>
<p><br>
1-> 2015-10-14 13:38:16,209 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction@15b48cc8 expression = AddNotOnOrAfterConditionToAssertions, resultExpression = [null]]<br>
<br>
2-> 2015-10-14 13:38:16,210 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]<br>
<br>
3-> 2015-10-14 13:38:16,210 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:450] - Creating instance of bean 'AddNotOnOrAfterConditionToAssertions'<br>
<br>
4-> 2015-10-14 13:38:16,213 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:450] - Creating instance of bean 'net.shibboleth.idp.saml.profile.config.navigate.AssertionLifetimeLookupFunction#641d8c43'<br>
<br>
5-> 2015-10-14 13:38:16,216 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1657] - No default init method named 'initialize' found on bean with name 'net.shibboleth.idp.saml.profile.config.navigate.AssertionLifetimeLookupFunction#641d8c43'<br>
<br>
6-> 2015-10-14 13:38:16,216 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:478] - Finished creating instance of bean 'net.shibboleth.idp.saml.profile.config.navigate.AssertionLifetimeLookupFunction#641d8c43'<br>
<br>
7-> 2015-10-14 13:38:16,217 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1666] - Invoking init method 'initialize' on bean with name 'AddNotOnOrAfterConditionToAssertions'<br>
<br>
8-> 2015-10-14 13:38:16,217 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:478] - Finished creating instance of bean 'AddNotOnOrAfterConditionToAssertions'<br>
<br>
9-> 2015-10-14 13:38:16,217 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor@6218c78e<br>
<br>
10-> 2015-10-14 13:38:16,218 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:114] - Profile Action AddNotOnOrAfterConditionToAssertions: Attempting to add NotOnOrAfter condition to every Assertion in outgoing Response<br>
<br>
11-> 2015-10-14 13:38:16,226 - DEBUG [org.opensaml.saml.common.profile.impl.AddNotOnOrAfterConditionToAssertions:169] - Profile Action AddNotOnOrAfterConditionToAssertions:
<strong>Added</strong> NotOnOrAfter condition, indicating an expiration of 2015-10-14T17:43:16.084Z, to Assertion _06e7be12e7537b0a6dea870ec68e00b4<br>
<br>
12-> 2015-10-14 13:38:16,227 - DEBUG [org.opensaml.saml.saml2.profile.SAML2ActionSupport:129] - Profile Action AddNotOnOrAfterConditionToAssertions: Assertion _06e7be12e7537b0a6dea870ec68e00b4 already contained Conditions, nothing was done<br>
<br>
13-> 2015-10-14 13:38:16,227 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.profile.impl.WebFlowProfileActionAdaptor@6218c78e; result = null<br>
<br>
14-> 2015-10-14 13:38:16,227 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]<br>
<br>
15-> 2015-10-14 13:38:16,227 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction@15b48cc8 expression = AddNotOnOrAfterConditionToAssertions, resultExpression = [null]]; result = null</p>
<p><br>
</p>
<p></p>
<p>-------------------------------------------------</p>
<p>idp-process log transcript (END)</p>
<p>-------------------------------------------------</p>
<p><br>
</p>
<br>
<p></p>
</div>
</body>
</html>