0

We have several service providers using Saml 2.0 for single sign-on and they are all working fine. Our most recent addition is balking because we send a NotBefore attribute on the SubjectConfirmationData element. As far as I can tell, this is part of the xsd schema for Saml 2.0 (https://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd) but then it is marked as MUST NOT in this profiles PDF (https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf).

What am I missing?

1 Answer 1

0

As you figured out, the Web Browser SSO profile - which is the one you are using to provide single sign on for your users as an Identity Provider - dictates that you should not set NotBefore. The profile sets further limitations to the schema defined for Assertion to be used generically, which is totally fine.

The service provider at hand strictly checks compliance and thus rejects your Assertion. The fact that it has been working so far probably means that the other service provider implementations were more lenient.

2
  • My question is, why the conflict? Why have it in the schema at all if you aren't supposed to use it?
    – user34314
    Aug 21, 2017 at 14:14
  • There is no conflict. The schema defines how the assertion can be structured and different profiles set their own limitations. As you can see in docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf, it's only the Web Browser SSO profile that sets this limitation, so NotBefore may well be used in any of the other profiles in there. Aug 21, 2017 at 14:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.