java - java中的SAML : timezone converts to UTC from Eastern automatically

Question

我正在使用 opensaml 在 java 应用程序中创建 SAML 断言。但是NotBefore和NotOnOrAfter时间在 <saml2:Conditions>总是改回 UTC 时区，即使我专门使用 DateTimeZone dtZone = DateTimeZone.forID("America/New_York");在 Joda Time 。

我还再次尝试将其转换回 EST，但即使在下面之后我仍然得到 UTC:conditions.setNotBefore(conditions.getNotBefore().toDateTime(dtZone));

由于这是奇怪的时区冲突，SAML 会过期，从而产生安全错误。
有什么想法吗？

Answer 1

绿洲 SAML 2.0 specification 强制断言中的时间戳被编码/规范化为 UTC :

2.5.1 Element <Conditions>

The element MAY contain the following elements andattributes:

NotBefore [Optional]

Specifies the earliest time instantat which the assertion is valid. The time value is encoded in UTC, asdescribed in Section 1.3.3.

NotOnOrAfter [Optional]

Specifies the timeinstant at which the assertion has expired. The time value is encodedin UTC, as described in Section 1.3.3.

...规范前面的内容:

1.3.3 Time Values

All SAML time values have the type xs:dateTime, which is built in to the W3C XML Schema Datatypes specification[Schema2], and MUST be expressed in UTC form, with no time zonecomponent. SAML system entities SHOULD NOT rely on time resolutionfiner than milliseconds. Implementations MUST NOT generate timeinstants that specify leap seconds.

我认为您将需要断言创建应用程序来翻译所需的 NotBefore或NotOnOrAfter往返 UTC 以适应。既然您提到使用 jodatime，那么它将类似于 new DateTime(DateTimeZone.UTC);如果您希望断言使用者在两小时后认为您的断言无效，则需要在当前时间上添加两个小时。您可以使用DateTime “加...()/减...()”API:

DateTime now = new DateTime(DateTimeZone.UTC);
DateTime twoHoursLater = now.plusHours(2);
DateTime myAssertionExpiry = twoHoursLater;
//use myAssertionExpiry for SAML NotOnOrAfter
DateTime fiveMinutesAgo = now.minusMinutes(5)
//could use fiveMinutesAgo for SAML NotBefore to allow recipient to have 5 minutes different clock time; use 'now' for NotBefore for more realtime/time-critical assertions