{"action":"created","issue":{"url":"https://api.github.com/repos/KentorIT/authservices/issues/500","repository_url":"https://api.github.com/repos/KentorIT/authservices","labels_url":"https://api.github.com/repos/KentorIT/authservices/issues/500/labels{/name}","comments_url":"https://api.github.com/repos/KentorIT/authservices/issues/500/comments","events_url":"https://api.github.com/repos/KentorIT/authservices/issues/500/events","html_url":"https://github.com/KentorIT/authservices/issues/500","id":160281418,"number":500,"title":"Assertion NotBefore conditions not being set in ToSaml2Assertion ClaimsIdentityExtensions","user":{"login":"namreid","id":7796582,"avatar_url":"https://avatars.githubusercontent.com/u/7796582?v=3","gravatar_id":"","url":"https://api.github.com/users/namreid","html_url":"https://github.com/namreid","followers_url":"https://api.github.com/users/namreid/followers","following_url":"https://api.github.com/users/namreid/following{/other_user}","gists_url":"https://api.github.com/users/namreid/gists{/gist_id}","starred_url":"https://api.github.com/users/namreid/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/namreid/subscriptions","organizations_url":"https://api.github.com/users/namreid/orgs","repos_url":"https://api.github.com/users/namreid/repos","events_url":"https://api.github.com/users/namreid/events{/privacy}","received_events_url":"https://api.github.com/users/namreid/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-06-14T20:53:55Z","updated_at":"2016-06-16T07:57:57Z","closed_at":null,"body":"I am using authservices to post a saml response to salesforce and it requires I provide NotBefore in the assertion conditions. I noticed that this isn't set in the ToSaml2Assertion method. Is this an oversight?\r\n\r\n```XML\r\n\t<saml2:Assertion xmlns:saml2=\"urn:oasis:names:tc:SAML:2.0:assertion\" Version=\"2.0\" ID=\"_93cee6b9-6265-4a58-8202-82bc9e4904de\" IssueInstant=\"2016-06-14T20:16:44Z\">\r\n\t\t<saml2:Issuer>XXX</saml2:Issuer>\r\n\t\t<saml2:Subject>\r\n\t\t\t<saml2:NameID>XXX</saml2:NameID>\r\n\t\t\t<saml2:SubjectConfirmation Method=\"urn:oasis:names:tc:SAML:2.0:cm:bearer\">\r\n\t\t\t\t<saml2:SubjectConfirmationData NotOnOrAfter=\"2016-06-14T20:18:44Z\" InResponseTo=\"_2CAAAAVXgwC3tME8wNEIwMDAwMDAwMDA2AAAAyvZfv23ciYNFJC-LJV71KQo43g2Y7hBQK2uMbOjhCo-LlUzWq3oPHtBYQ3Yf0P0AbHKEQcmZSQyN2FDF9mfC5r3Ae1HFG7afEHRa-YJqRWNuIP_akHdWjJy8NUi0M6ItQibzzis4dfNDbaLiHKBmpxnqcVuYhAUMBGnNOj0njkjtOK-WoQmlLfAY1R1DDLKxLe5uWeGgRuRho56Lg1_14tRUGOPusfCl9ztFKSLCN_PiXr-Q-AUO4_nO97v6RrG0xA\" Recipient=\"XXX\" />\r\n\t\t\t</saml2:SubjectConfirmation>\r\n\t\t</saml2:Subject>\r\n\t\t<saml2:Conditions NotOnOrAfter=\"2016-06-14T20:18:44Z\" />\r\n\t\t<saml2:AuthnStatement AuthnInstant=\"2016-06-14T20:16:44Z\">\r\n\t\t\t<saml2:AuthnContext>\r\n\t\t\t\t<saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml2:AuthnContextClassRef>\r\n\t\t\t</saml2:AuthnContext>\r\n\t\t</saml2:AuthnStatement>\r\n\t</saml2:Assertion>\r\n```"},"comment":{"url":"https://api.github.com/repos/KentorIT/authservices/issues/comments/226414522","html_url":"https://github.com/KentorIT/authservices/issues/500#issuecomment-226414522","issue_url":"https://api.github.com/repos/KentorIT/authservices/issues/500","id":226414522,"user":{"login":"AndersAbel","id":4894558,"avatar_url":"https://avatars.githubusercontent.com/u/4894558?v=3","gravatar_id":"","url":"https://api.github.com/users/AndersAbel","html_url":"https://github.com/AndersAbel","followers_url":"https://api.github.com/users/AndersAbel/followers","following_url":"https://api.github.com/users/AndersAbel/following{/other_user}","gists_url":"https://api.github.com/users/AndersAbel/gists{/gist_id}","starred_url":"https://api.github.com/users/AndersAbel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AndersAbel/subscriptions","organizations_url":"https://api.github.com/users/AndersAbel/orgs","repos_url":"https://api.github.com/users/AndersAbel/repos","events_url":"https://api.github.com/users/AndersAbel/events{/privacy}","received_events_url":"https://api.github.com/users/AndersAbel/received_events","type":"User","site_admin":false},"created_at":"2016-06-16T07:57:57Z","updated_at":"2016-06-16T07:57:57Z","body":"I found a mention of `NotBefore` in the SAML2 Web SSO Profile specification. In section 4.1.4.2 it says\r\n\r\n> At lease one bearer <SubjectConfirmation> element MUST contain a <SubjectConfirmationData> element that itself MUST contain a Recipient attribute containing the service provider's assertion consumer service URL and a NotOnOrAfter attribute that limits the window during which the assertion can be [E52]confirmed by the relying party. It MAY also contain an Address attribute limiting the client address from which the assertion can be delivered. It MUST NOT contain a NotBefore attribute. If the containing message is in response to an <AuthnRequest>, then the InResponseTo attribute MUST match the request's ID.\r\n\r\nSo using `NotBefore` is not compatible with the specification. I'd suggest you bring this up with SalesForce.\r\n\r\nIf support for adding a `NotBefore` attribute is to be implemented in AuthServices it must be a non-standard behaviour that is explicitly activated."}}
{"actor":{"display_login":"AndersAbel"}}