SAML Elements in Assertions¶
The following list provides details for designers on the correct handling of Security Assertion Markup Language (SAML) elements in assertions:
- When using the
SubjectConfirmation
element in a SAML assertion, theNotOnOrAfter
condition shall be used. - When using the
Conditions
element in a SAML assertion, both theNotBefore
andNotOnOrAfter
elements or theOneTimeUse
element shall be used. - If a
OneTimeUse
element is used in an assertion, there shall only be one used in theConditions
element portion of an assertion.
The VOSS-4-UC system will inspect SAML messages and raise error messages if the elements do not follow the rules for SAML assertions specified above.
The list below shows the respective error numbers and messages as they will show in the logs, as well as example error SAML snippets:
NOTONORAFTER_SUBJECTCONFIRMATION_ERROR (14010)
“SubjectConfirmation is used but there is no NotOnOrAfter attribute”
<saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml2:SubjectConfirmationData/> </saml2:SubjectConfirmation>
- CONDITION_NOT_BOTH (14012)
“NotBefore and NotOnOrAfter should be present when using either in Condition”
<saml2:Conditions NotOnOrAfter="2015-11-20T12:32:23.645Z"> <saml2:AudienceRestriction> <saml2:Audience>http://functional.fedrampfail.plain/sso/metadata/</saml2:Audience> </saml2:AudienceRestriction> </saml2:Conditions>
- CONDITION_ONETIMEUSE (14013)
“OneTimeUse element should be present when neither NotBefore nor NotOnOrAfter attributes in Condition”
<saml2:Conditions> <saml2:AudienceRestriction> <saml2:Audience>http://functional.fedrampfail.plain/sso/metadata/</saml2:Audience> </saml2:AudienceRestriction> </saml2:Conditions>
CONDITION_MULTIPLE_ONETIMEUSE (14014)
“Only one OneTimeUse element should be present in Condition”
<saml2:Conditions> <saml2:AudienceRestriction> <saml2:Audience>http://functional.fedrampfail.plain/sso/metadata/</saml2:Audience> </saml2:AudienceRestriction> <saml2:OneTimeUse/> <saml2:OneTimeUse/> </saml2:Conditions>