Add Skew to NotOnOrAfter and NotBefore Assertion Conditions

[ahavriluk]

Attribute assertionTimeSkew from sp-extended.xml is ignored.
See: https://bugster.forgerock.org/jira/browse/OPENAM-10191

[vharseko]

please attach config and har log

[ahavriluk]

Description of a problem: https://medium.com/@PrakhashS/saml-assertion-condition-notbefore-notonorafter-problem-due-to-unsynced-clocks-explained-90455bc8822f

Log:

SAML2Utils.isBearerSubjectConfirmation:timeskew = 3000
libSAML2:10/24/2018 05:50:07:418 PM PDT: Thread[http-nio-9080-exec-33,5,main]: TransactionId[unknown]
SAML2Utils.checkConditions: NotOnOrAfter Condition = Wed Oct 24 17:55:09 PDT 2018
libSAML2:10/24/2018 05:50:07:419 PM PDT: Thread[http-nio-9080-exec-33,5,main]: TransactionId[unknown]
SAML2Utils.checkConditions: NotBefore Condition = Wed Oct 24 17:50:09 PDT 2018
libSAML2:10/24/2018 05:50:07:419 PM PDT: Thread[http-nio-9080-exec-33,5,main]: TransactionId[unknown]
SAML2Utils.checkConditions: The assertion does not meet NotOnOrAfter or NotBefore condition.
24-Oct-2018 17:50:07.419 INFO [http-nio-9080-exec-33] com.sun.identity.plugin.log.impl.FedletLogger.error DATE_CONDITION_NOT_MET

sp-extended.xml must have the attribute specified:

       <Attribute name="assertionTimeSkew">
           <Value>300</Value>
       </Attribute>

To reproduce: The clock on host (SP) and remote (IdP) machines must be off about 2-3 sec. Do SAML SSO with remote IdP. I was testing against Shibboleth IdP.
Your SAML response must have Conditions:
<saml2:Conditions NotBefore="2018-10-25T00:50:09.210Z" NotOnOrAfter="2018-10-25T00:55:09.210Z"><saml2:AudienceRestriction><saml2:Audience>http://www.example.com:9080/fedlet</saml2:Audience></saml2:AudienceRestriction></saml2:Conditions>

To fix:

The code which processes assertionTimeSkew for SubjectConfirmation is located in SAML2Utils.java class in openam-federation/openam-federation-library.

The snipped which reads time skew:

            // in seconds
            int timeskew = SAML2Constants.ASSERTION_TIME_SKEW_DEFAULT;
            String timeskewStr = getAttributeValueFromSPSSOConfig(
                    spConfig,
                    SAML2Constants.ASSERTION_TIME_SKEW);
            if (timeskewStr != null && timeskewStr.trim().length() > 0) {
                timeskew = Integer.parseInt(timeskewStr);
                if (timeskew < 0) {
                    timeskew = SAML2Constants.ASSERTION_TIME_SKEW_DEFAULT;
                }
            }
            if (debug.messageEnabled()) {
                debug.message(method + "timeskew = " + timeskew);
            }

The method checkConditions in SAML2Utils.java should have the code above, and code in line 901 should be updated:
the currentTimeMillis() value passed in should be adjusted to timeSkew value:

if (!conditions.checkDateValidity(currentTimeMillis())) {
...
}

Let me know if you need more details.

[vharseko]

you can make pull request ?

[mattieb2013]

@ahavriluk Do you hav any plan for creating pull request for this any time soon ?

@vharseko If @ahavriluk doesn't get time to creat pull request can you please create a pull request and resolve this bug? We've run into this bug with a new integration.

[ajlugt]

I'm currently preparing a branch to solve this issue, I could be ready for a pull request in a matter of days. Is that OK? I'm just asking because @vharseko already self-assigned this.