SAML Elements in Assertions --------------------------- The following list provides details for designers on the correct handling of Security Assertion Markup Language (SAML) elements in assertions: 1. When using the ``SubjectConfirmation`` element in a SAML assertion, the ``NotOnOrAfter`` condition shall be used. #. When using the ``Conditions`` element in a SAML assertion, both the ``NotBefore`` and ``NotOnOrAfter`` elements or the ``OneTimeUse`` element shall be used. #. If a ``OneTimeUse`` element is used in an assertion, there shall only be one used in the ``Conditions`` element portion of an assertion. The |VOSS-4-UC| system will inspect SAML messages and raise error messages if the elements do not follow the rules for SAML assertions specified above. The list below shows the respective error numbers and messages as they will show in the logs, as well as example error SAML snippets: 1. NOTONORAFTER_SUBJECTCONFIRMATION_ERROR (14010) "SubjectConfirmation is used but there is no NotOnOrAfter attribute" :: <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml2:SubjectConfirmationData/> </saml2:SubjectConfirmation> 2. a) CONDITION_NOT_BOTH (14012) "NotBefore and NotOnOrAfter should be present when using either in Condition" :: <saml2:Conditions NotOnOrAfter="2015-11-20T12:32:23.645Z"> <saml2:AudienceRestriction> <saml2:Audience>http://functional.fedrampfail.plain/sso/metadata/</saml2:Audience> </saml2:AudienceRestriction> </saml2:Conditions> 2. b) CONDITION_ONETIMEUSE (14013) "OneTimeUse element should be present when neither NotBefore nor NotOnOrAfter attributes in Condition" :: <saml2:Conditions> <saml2:AudienceRestriction> <saml2:Audience>http://functional.fedrampfail.plain/sso/metadata/</saml2:Audience> </saml2:AudienceRestriction> </saml2:Conditions> 3. CONDITION_MULTIPLE_ONETIMEUSE (14014) "Only one OneTimeUse element should be present in Condition" :: <saml2:Conditions> <saml2:AudienceRestriction> <saml2:Audience>http://functional.fedrampfail.plain/sso/metadata/</saml2:Audience> </saml2:AudienceRestriction> <saml2:OneTimeUse/> <saml2:OneTimeUse/> </saml2:Conditions> .. |VOSS-4-UC| replace:: VOSS-4-UC .. |Unified CM| replace:: Unified CM