Comparing changes

@@ -50,16 +50,17 @@ module Saml
         end
 
         def subject_confirmation_data_options
-          options = { NotOnOrAfter: 3.hours.since(now).utc.iso8601 }
-          options[:Recipient] = destination if destination.present?
+          options = {}
           options[:InResponseTo] = request.id if request.present?
+          options[:NotOnOrAfter] = (not_on_or_after - 1.second).iso8601
+          options[:Recipient] = destination if destination.present?
           options
         end
 
         def conditions_options
           {
             NotBefore: now.utc.iso8601,
-            NotOnOrAfter: configuration.session_timeout.since(now).utc.iso8601,
+            NotOnOrAfter: not_on_or_after.iso8601,
           }
         end
 
@@ -67,13 +68,16 @@ module Saml
           {
             AuthnInstant: now.iso8601,
             SessionIndex: reference_id,
-            SessionNotOnOrAfter: configuration.session_timeout.since(now).utc.iso8601,
           }
         end
 
         def name_id_options
           { Format: name_id_format || default_name_id_format }
         end
+
+        def not_on_or_after
+          configuration.session_timeout.since(now).utc
+        end
       end
     end
   end

@@ -2,6 +2,6 @@
 
 module Saml
   module Kit
-    VERSION = '1.0.19'.freeze
+    VERSION = '1.0.20'.freeze
   end
 end

@@ -76,7 +76,7 @@ RSpec.describe Saml::Kit::Builders::Response do
 
       expect(hash['Response']['Assertion']['Subject']['NameID']).to eql(user.name_id)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['Method']).to eql('urn:oasis:names:tc:SAML:2.0:cm:bearer')
-      expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['NotOnOrAfter']).to eql(3.hours.from_now.utc.iso8601)
+      expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['NotOnOrAfter']).to eql((3.hours.from_now.utc - 1.second).iso8601)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['Recipient']).to eql(assertion_consumer_service_url)
       expect(hash['Response']['Assertion']['Subject']['SubjectConfirmation']['SubjectConfirmationData']['InResponseTo']).to eql(request.id)
 
@@ -85,7 +85,6 @@ RSpec.describe Saml::Kit::Builders::Response do
       expect(hash['Response']['Assertion']['Conditions']['AudienceRestriction']['Audience']).to eql(request.issuer)
 
       expect(hash['Response']['Assertion']['AuthnStatement']['AuthnInstant']).to eql(Time.now.utc.iso8601)
-      expect(hash['Response']['Assertion']['AuthnStatement']['SessionNotOnOrAfter']).to eql(3.hours.from_now.utc.iso8601)
       expect(hash['Response']['Assertion']['AuthnStatement']['SessionIndex']).to eql(hash['Response']['Assertion']['ID'])
       expect(hash['Response']['Assertion']['AuthnStatement']['AuthnContext']['AuthnContextClassRef']).to eql('urn:oasis:names:tc:SAML:2.0:ac:classes:Password')