SAML 2.0 profile and NotBefore

[Mike Jones <Michael.Jones@microsoft.com>]

Hi Scott,

 

In working on the 1.1 profile, this question came up about the 2.0 profile.  It currently says “The <saml:SubjectConfirmationData> element, if present, MUST NOT contain a NotBefore or Recipient XML attribute.”  Why is the use of NotBefore prohibited?

 

I’ll note that its use is required in the self-issued token profile.  I’m thinking that, for that reason, I should at least allow its use in 1.1 tokens.

 

Your thoughts?

 

                                                                Thanks,

                                                                -- Mike