SAML Assertion Timing Checker

A signed SAML assertion can be authentic and still be unusable at the instant a service provider receives it. Validity depends on several clocks and several different time limits: when the assertion was issued, when its Conditions begin, when those Conditions expire, when bearer delivery expires, and sometimes when the identity-provider session ends.

SAML uses an inclusive lower bound and an exclusive upper bound. NotBefore allows use at or after its instant. NotOnOrAfter forbids use at that instant and every instant after it. This one-sided edge is important during incident replay because a capture evaluated exactly at expiry is already expired.

Clock skew is verifier leeway for small differences between the identity provider, service provider, and capture clock. It should match the real synchronization policy, not be widened until a stale assertion passes. Larger skew extends both sides of the accepted window and increases replay exposure.

Timing is only one part of SAML verification. A relying party must also validate the signature, trusted issuer, audience, destination, recipient, request correlation, decryption state, and replay protections required by the selected profile. A timing-only pass cannot establish that the assertion should be accepted.

Web SSO and OAuth SAML bearer flows do not require identical evidence. SP-initiated Web SSO normally needs a complete Response, bearer confirmation, recipient, and request correlation. IdP-initiated SSO cannot always supply the same request binding. A forensic excerpt can preserve useful timestamps while remaining incomplete evidence.

How to Use This Tool:

Use the service provider's actual decision instant when reconstructing an incident. The current clock is not a safe substitute for a historical capture.

1. Paste one raw assertion, complete response, SAMLResponse value, or OAuth assertion value. Auto detect resolves the shape; a pinned Source format rejects mismatched input.
2. Select the Review profile that matches the real flow and enter the Reference UTC time as an ISO 8601 instant with a timezone.
3. Choose the narrowest Clock skew policy supported by the environment. Set assertion and bearer window caps as local replay-exposure policies; they flag long windows without changing the captured timestamps.
4. Review Timing findings before the timeline. A fail produces Reject now; warnings produce Review timing. Continue with signature, issuer, audience, endpoint, request-correlation, and replay verification outside this timing review.

Interpreting Results:

Reject now means at least one timing or profile rule failed. Examples include an expired or not-yet-valid assertion, reversed Conditions, missing required bounds, mismatched recipient or request correlation, or an expired bearer confirmation.

Review timing means no fail was found but one or more warnings remain. Long validity windows, missing optional context, future-dated issuance beyond skew, an unbounded optional session, or replay retention shorter than the accepted window can all create warnings.

Usable now means the inspected timing and selected local policies passed. The result explicitly does not verify cryptography or the non-timing SAML checks. A relying party should never accept an assertion because this label appears alone.

Technical Details:

The source is normalized from raw XML, a named form or query value, or base64/base64url text. The parser extracts complete Assertion elements and reads timing attributes from Conditions, bearer SubjectConfirmationData, and AuthnStatement elements. Encrypted assertions cannot be inspected until they are decrypted in an approved environment.

Formula Core:

Let R be the explicit reference instant, K the allowed clock skew, L the effective lower bound, and U the exclusive upper bound. A fully bounded current-time check uses both inequalities below. If no valid lower bound is available, the profile's missing-evidence rule handles that gap while the upper comparison still applies.

The upper comparison remains exclusive: if R minus skew equals U, the assertion or bearer confirmation is expired. The lower bound is Conditions NotBefore when present, otherwise IssueInstant. The upper bound is Conditions NotOnOrAfter; profiles that allow partial evidence may fall back to the earliest valid bearer expiry.

Window durations are measured from the applicable lower bound to the exclusive upper bound.

Assertion and bearer windows warn only when the duration is greater than the selected cap; equality is within policy. Replay-cache retention warns when the accepted assertion duration is greater than the selected retention horizon. Displayed durations are rounded for readability after the millisecond comparison.

Clock-skew presets apply 0, 60, 300, or 600 seconds; custom skew is limited to 0 to 900 seconds. Assertion-window policy accepts 1 to 120 minutes, bearer-window policy accepts 1 to 60 minutes, replay retention accepts 0 to 240 minutes, and the optional session cap accepts 0 to 72 hours.

Rule Core:

Limitations and Privacy Notes:

Assertion text and uploaded XML or TXT files are decoded and inspected in the browser. Sensitive attributes are not sent for timing analysis. Keep incident captures protected when copying, exporting, or sharing results.

• The inspection is timing-focused and does not verify signatures, certificate trust, issuer, audience, destination ownership, decryption, or live replay state.
• The source parser is a bounded extractor, not a validating XML or SAML processor.
• Clock-skew presets and window caps are local review policies, not universal SAML defaults.
• Only complete Assertion elements can be inspected; decrypt encrypted assertions before use.

Worked Examples:

References:

• Assertions and Protocols for SAML V2.0, OASIS, March 15, 2005.
• Profiles for SAML V2.0, OASIS, March 15, 2005.
• SAML 2.0 Profile for OAuth 2.0 Client Authentication and Authorization Grants, RFC Editor, May 2015.