<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 10/14/15 3:04 PM, Alan Angulo
(Office365 admin) wrote:<br>
</div>
<blockquote
cite="mid:BLUPR0201MB152176D5ABEADBB7A94D1A4EF93F0@BLUPR0201MB1521.namprd02.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
<div id="divtagdefaultwrapper"
style="font-size:10pt;color:#000000;background-color:#FFFFFF;font-family:Century
Gothic;"><br>
<p>I am able to authenticate and send the assertion to the SP
but the SP complains that the "<font color="#006fc9"><strong>NotOnOrAfter</strong></font>"
condition is missing:
</p>
<p><b style="color: rgb(0, 0, 0); text-transform: none;
line-height: normal; text-indent: 0px; letter-spacing:
normal; font-family: Arial; font-size: small; font-style:
normal; font-variant: normal; word-spacing: 0px;
white-space: normal; widows: 1; background-color: rgb(204,
204, 204); -webkit-text-stroke-width: 0px;">Information :<span
class="Apple-converted-space"> </span></b><span
style="font: small/normal Arial; color: rgb(0, 0, 0);
text-transform: none; text-indent: 0px; letter-spacing:
normal; word-spacing: 0px; float: none; display: inline
!important; white-space: normal; widows: 1;
font-size-adjust: none; font-stretch: normal;
background-color: rgb(204, 204, 204);
-webkit-text-stroke-width: 0px;">SAML Response is not well
formed. Missing SAML 2.0 attribute 'NotOnOrAfter'.</span></p>
<p><br>
</p>
</div>
</blockquote>
<br>
There's actually 2 NotOnOrAfter attributes in a typical SAML 2
Assertion in a Response: 1) the bearer SubjectConfirmationData,
where it's required 2) the Conditions, where it's optional. They
don't mention which one they're complaining about there, but...<br>
<br>
<br>
<blockquote
cite="mid:BLUPR0201MB152176D5ABEADBB7A94D1A4EF93F0@BLUPR0201MB1521.namprd02.prod.outlook.com"
type="cite">
<div id="divtagdefaultwrapper"
style="font-size:10pt;color:#000000;background-color:#FFFFFF;font-family:Century
Gothic;">
<p>
</p>
<p>I placed the IdP in debugging mode and I can see that the
NotOnOrAfter condition *is* indeed being added.</p>
<p><br>
</p>
</div>
</blockquote>
<br>
My 3.x test IdP also shows both NotOnOrAfter attributes being
populated on an unsolicited SSO response.<br>
<br>
<br>
<blockquote
cite="mid:BLUPR0201MB152176D5ABEADBB7A94D1A4EF93F0@BLUPR0201MB1521.namprd02.prod.outlook.com"
type="cite">
<div id="divtagdefaultwrapper"
style="font-size:10pt;color:#000000;background-color:#FFFFFF;font-family:Century
Gothic;">
<p>
</p>
<p><br>
</p>
<p>Could someone shed some light as to why is the SP stating
that the condition is non-existing.</p>
<p><br>
</p>
<br>
</div>
</blockquote>
<br>
We're pretty clearly sending it I think. If you want to
double-check, just turn on the PROTOCOL_MESSAGE logger to DEBUG to
see the actual response that's being returned. If the assertion is
encrypted, you'll either need to disable that temporarily or else
also turn on DEBUG for category
'org.opensaml.saml.saml2.encryption.Encrypter'.<br>
<br>
If you confirm your IdP is sending those, as I suspect you will,
then they have a bug, which you should report to them.<br>
</body>
</html>