Spring 安全 SAML 断言已过期

Question

服务提供程序（Spring Security SAML）如何以及何时验证断言是否过期？我在webbapplication中创建和配置了一个服务提供程序。我的身份提供程序是ADFS 2.0进行身份验证并返回带有断言的SAML响应。此断言有一个“条件”，带有标志“NotBy”和“NotOnOrAfter”。到目前为止，我的断言有效期为1分钟。

当我通过身份验证时，我的客户端会话有效期为10分钟。这意味着我的断言将在客户端会话仍然有效时过期。服务提供商是否应该检测到我的断言已过期并因此要求IDP重新身份验证？我错过了什么？

Answer 1

我遇到了你同样的问题，并仍在调查。sp和isp之间的时间似乎不同。您可以测试它扩展WebSSOProfileConsumerImpl，实现verifyAssertion方法。这里的代码注释如下：

@Override
protected void verifyAssertion(Assertion assertion, AuthnRequest request,   SAMLMessageContext context) throws AuthenticationException, SAMLException, org.opensaml.xml.security.SecurityException, ValidationException, DecryptionException {

    /*// Verify storage time skew
    if (!isDateTimeSkewValid(getResponseSkew(), getMaxAssertionTime(), assertion.getIssueInstant())) {
        throw new SAMLException("Assertion is too old to be used, value can be customized by setting maxAssertionTime value " + assertion.getIssueInstant());
    }*/

    // Verify validity of storage
    // Advice is ignored, core 574
    verifyIssuer(assertion.getIssuer(), context);
    verifyAssertionSignature(assertion.getSignature(), context);

    // Check subject
    if (assertion.getSubject() != null) {
        verifySubject(assertion.getSubject(), request, context);
    } else {
        throw new SAMLException("Assertion does not contain subject and is discarded");
    }

    // Assertion with authentication statement must contain audience restriction
    if (assertion.getAuthnStatements().size() > 0) {
        //verifyAssertionConditions(assertion.getConditions(), context, true);
        for (AuthnStatement statement : assertion.getAuthnStatements()) {
            if (request != null) {
                verifyAuthenticationStatement(statement, request.getRequestedAuthnContext(), context);
            } else {
                verifyAuthenticationStatement(statement, null, context);
            }
        }
    } else {
        verifyAssertionConditions(assertion.getConditions(), context, false);
    }

}