saml - SubjectConfirmationData 和 Condition 中的 NotOnOrAfter 和 SessionNotOnOrAfter

Question

在 SAML2 规范中，断言中有几个地方可以指定生命周期。

<SubjectConfirmationData>元素包含 NotOnOrAfter属性。

<Conditions>元素包含 NotOnOrAfter属性。

<AuthnStatement>元素包含 SessionNotOnOrAfter属性。

它们各自的含义是什么？它们之间的关系如何？

具体来说，当...

... 使用 Web SSO 使用传入的 Saml2Response

... 在 SP

中建立应用程序 session

... 刷新(扩展)SP 中的应用程序 session

... 将断言转发到 Web 服务，以代表主体行事(如@Thuan 所述)

... 向 idp 发出单个注销请求，以确保 idp 仍然知道 session ？

每个 NotOnOrAfter 都在 SAML2 core specification 中描述。 .我在此处包含了我可以找到的描述这些属性的部分。

主题确认数据/@NotOnOrAfter

A time instant at which the subject can no longer be confirmed. The time value is encoded in UTC, as described in Section 1.3.3.

Note that the time period specified by the optional NotBefore and NotOnOrAfter attributes, if present, SHOULD fall within the overall assertion validity period as specified by the element's NotBefore and NotOnOrAfter attributes. If both attributes are present, the value for NotBefore MUST be less than (earlier than) the value for NotOnOrAfter.

条件/@NotOnOrAfter

Specifies the time instant at which the assertion has expired. The time value is encoded in UTC, as described in Section 1.3.3.

The NotBefore and NotOnOrAfter attributes specify time limits on the validity of the assertion within the context of its profile(s) of use. They do not guarantee that the statements in the assertion will be correct or accurate throughout the validity period. The NotBefore attribute specifies the time instant at which the validity interval begins. The NotOnOrAfter attribute specifies the time instant at which the validity interval has ended. If the value for either NotBefore or NotOnOrAfter is omitted, then it is considered unspecified. If the NotBefore attribute is unspecified (and if all other conditions that are supplied evaluate to Valid), then the assertion is Valid with respect to conditions at any time before the time instant specified by the NotOnOrAfter attribute. If the NotOnOrAfter attribute is unspecified (and if all other conditions that are supplied evaluate to Valid), the assertion is Valid with respect to conditions from the time instant specified by the NotBefore attribute with no expiry. If neither attribute is specified (and if any other conditions that are supplied evaluate to Valid), the assertion is Valid with respect to conditions at any time.

If both attributes are present, the value for NotBefore MUST be less than (earlier than) the value for NotOnOrAfter.

AuthnStatement/@SessionNotOnOrAfter

Indicates an upper bound on sessions with the subject derived from the enclosing assertion. The time value is encoded in UTC, as described in Section 1.3.3. There is no required relationship between this attribute and a NotOnOrAfter condition attribute that may be present in the assertion. It's left to profiles to provide specific processing rules for relying parties based on this attribute.

Answer 1

我将此问题交叉发布到 SAML-dev mailing list并得到了 Scott Cantor 的回答，他一直是规范的编辑。

时代在<SubjectConfirmationData>表明断言可以与主题相关多长时间的信号。在 Web SSO 中，通常使用主体确认方法“承载者”，这意味着在这段时间内我们可以相信断言适用于提供断言的人。断言可能在更长的时间内有效，但我们必须在此时间范围内创建 session 。这在 Web SSO Profile 中有描述第 4.1.4.3 节。时代在<SubjectConfirmationData>必须在 <Conditions> 中的区间内.

时代在<Conditions>是整个断言的有效性。在此之后不应食用。但是，没有什么可以阻止 SP 上的用户 session 超出此时间点。

SessionNotOnOrAfter是完全不同的东西，与断言或主题的生命周期没有直接关系。它是 idp 可用于控制 SP session 时长的参数。请注意，根据 SAML2Core 规范，此参数被定义为应该由 SP 处理，但与所有 SP 实现相去甚远。一个实现的例子是像往常一样 Shibboleth，它总是会尊重这个参数的出现。使用 Single Logout 时，此参数更为关键，因为它同步 SP 和 Idp 上的 session 超时，以确保 SP 不会为 Idp 不再知道的 session 发出注销请求。