protected final boolean isValidBearerSubjectConfirmationData ( final SubjectConfirmationData data , final SAML2MessageContext context ) { if ( data == null ) { logger . debug ( "SubjectConfirmationData cannot be null for Bearer confirmation" ) ; return false ; } // TODO Validate inResponseTo if ( data . getNotBefore ( ) != null ) { logger . debug ( "SubjectConfirmationData notBefore must be null for Bearer confirmation" ) ; return false ; } if ( data . getNotOnOrAfter ( ) == null ) { logger . debug ( "SubjectConfirmationData notOnOrAfter cannot be null for Bearer confirmation" ) ; return false ; } if ( data . getNotOnOrAfter ( ) . plusSeconds ( acceptedSkew ) . isBeforeNow ( ) ) { logger . debug ( "SubjectConfirmationData notOnOrAfter is too old" ) ; return false ; } try { if ( data . getRecipient ( ) == null ) { logger . debug ( "SubjectConfirmationData recipient cannot be null for Bearer confirmation" ) ; return false ; } else { final Endpoint endpoint = context . getSAMLEndpointContext ( ) . getEndpoint ( ) ; if ( endpoint == null ) { logger . warn ( "No endpoint was found in the SAML endpoint context" ) ; return false ; } final URI recipientUri = new URI ( data . getRecipient ( ) ) ; final URI appEndpointUri = new URI ( endpoint . getLocation ( ) ) ; if ( ! SAML2Utils . urisEqualAfterPortNormalization ( recipientUri , appEndpointUri ) ) { logger . debug ( "SubjectConfirmationData recipient {} does not match SP assertion consumer URL, found. " + "SP ACS URL from context: {}" , recipientUri , appEndpointUri ) ; return false ; } } } catch ( URISyntaxException use ) { logger . error ( "Unable to check SubjectConfirmationData recipient, a URI has invalid syntax." , use ) ; return false ; } return true ; }
Validate Bearer subject confirmation data - notBefore - NotOnOrAfter - recipient