Commit 57ee72a

mo <mo@mokhan.ca>
2018-08-13 18:11:58
pingfed demands that SubjectConfirmationData#NotOnOrAfter be present.
From the spec: https://www.oasis-open.org/committees/download.php/35711/sstc-saml-core-errata-2.0-wd-06-diff.pdf ```text 2.4.1.2 Element <SubjectConfirmationData> The <SubjectConfirmationData> element has the SubjectConfirmationDataType complex type. It specifies additional data that allows the subject to be confirmed or constrains the circumstances under which the act of subject confirmation can take place. Subject confirmation takes place when a relying party seeks to verify the relationship between an entity presenting the assertion (that is, the attesting entity) and the subject of the assertion's claims. It contains the following optional attributes that can apply to any method: NotBefore [Optional] A time instant before which the subject cannot be confirmed. The time value is encoded in UTC, as described in Section 1.3.3. NotOnOrAfter [Optional] A time instant at which the subject can no longer be confirmed. The time value is encoded in UTC, as described in Section 1.3.3. ``` From PingFed. ```text The status code of the Response was not Success, was Responder -> (reference# SGKBSKUD) Response contains no valid assertions: [ Assertion (_4c5a7b29-f1a6-4388-9742-07d138ab3bed) Status: INVALID Remarks: (Profiles 4.1.4.2) assertion could not be confirmed - here's why: [#1 subject confirmation is unsatisfactory: [The bearer <SubjectConfirmation> element MUST contain a <SubjectConfirmationData> element that MUST contain a NotOnOrAfter attribute that limits the window during which the assertion can be delivered]]]. InMessageContext XML: <Response ID="_55bd9f0f-77d6-4bd6-a63d-689f0ce95660" Version="2.0" IssueInstant="2018-08-13T17:52:13Z" Consent="urn:oasis:names:tc:SAML:2.0:consent:unspecified" Destination="" InResponseTo="CVsw0s5XmowOa_f7KC0cxnepadE" xmlns="urn:oasis:names:tc:SAML:2.0:protocol"> <Issuer xmlns="urn:oasis:names:tc:SAML:2.0:assertion"></Issuer> ```
main
1 parent 54495cf
Changed files (3)
lib
saml
kit
builders
assertion.rb
version.rb
spec
saml
kit
builders
response_spec.rb
lib/saml/kit/builders/assertion.rb
@@ -53,6 +53,7 @@ module Saml
           options = {}
           options[:InResponseTo] = request.id if request.present?
           options[:Recipient] = destination if destination.present?
+          options[:NotOnOrAfter] = (now + 5.minutes).utc.iso8601
           options
         end
lib/saml/kit/version.rb
@@ -2,6 +2,6 @@
 
 module Saml
   module Kit
-    VERSION = '1.0.21'.freeze
+    VERSION = '1.0.22'.freeze
   end
 end
spec/saml/kit/builders/response_spec.rb
@@ -76,7 +76,7 @@ RSpec.describe Saml::Kit::Builders::Response do
 
       expect(hash['Response']['Assertion']['Subject']['NameID']).to eql(user.name_id)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['Method']).to eql('urn:oasis:names:tc:SAML:2.0:cm:bearer')
-      expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['NotOnOrAfter']).to be_nil
+      expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['NotOnOrAfter']).to eql(5.minutes.from_now.utc.iso8601)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['Recipient']).to eql(assertion_consumer_service_url)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['InResponseTo']).to eql(request.id)