RE: SAML 2.0 profile and NotBefore

[Mike Jones <Michael.Jones@microsoft.com>]

Reading further, I’ve discovered that there is a contradiction about NotBefore.  The profile also says “Assertions MAY contain a <saml:Conditions> element with NotBefore and NotOnOrAfter attributes.”

 

I assume that the first MUST NOT was an error.

 

                                                                -- Mike

 

From: Mike Jones
Sent: Monday, December 14, 2009 11:42 AM
To: imi@lists.oasis-open.org
Subject: SAML 2.0 profile and NotBefore

 

Hi Scott,

 

In working on the 1.1 profile, this question came up about the 2.0 profile.  It currently says “The <saml:SubjectConfirmationData> element, if present, MUST NOT contain a NotBefore or Recipient XML attribute.”  Why is the use of NotBefore prohibited?

 

I’ll note that its use is required in the self-issued token profile.  I’m thinking that, for that reason, I should at least allow its use in 1.1 tokens.

 

Your thoughts?

 

                                                                Thanks,

                                                                -- Mike