[WSS-639] IssueInstant NotOnOrAfter is not checked when specified

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 2.2.1, 2.2.2
• Component/s: WSS4J Core
• Assignee: Colm O hEigeartaigh
• Reporter: Ralph Bastiaansen
• Created: 19/Dec/18 14:45
• Updated: 20/Dec/18 06:46
• Resolved: 19/Dec/18 23:14

Description

In org.apache.wss4j.common.saml.SamlAssertionWrapper in method checkIssueInstance, line 862.

When validTill is not null, no check is performed.

 

// If there is no NotOnOrAfter, then impose a TTL on the IssueInstant.
if (validTill == null) {
    currentTime = new DateTime().minusSeconds(ttl);

    if (issueInstant.isBefore(currentTime)) {
        LOG.debug("SAML Token IssueInstant not met. The assertion was created too long ago.");
        throw new WSSecurityException(WSSecurityException.ErrorCode.FAILURE, "invalidSAMLsecurity");
    }
}