You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It's not uncommon for the asserting and relying parties to have system clocks that aren't perfectly synchronized.
99
-
For that reason, you can configure `OpenSaml4AuthenticationProvider`'s default assertion validator with some tolerance:
99
+
For that reason, you can configure ``OpenSaml4AuthenticationProvider``'s default assertion validator with some tolerance:
100
100
101
101
====
102
102
.Java
@@ -238,7 +238,7 @@ open class SecurityConfig {
238
238
<3> Third, return a custom authentication that includes the user details
239
239
240
240
[NOTE]
241
-
It's not required to call `OpenSaml4AuthenticationProvider`'s default authentication converter.
241
+
It's not required to call ``OpenSaml4AuthenticationProvider``'s default authentication converter.
242
242
It returns a `Saml2AuthenticatedPrincipal` containing the attributes it extracted from ``AttributeStatement``s as well as the single `ROLE_USER` authority.
@@ -271,7 +271,7 @@ After verifying the signature, it will:
271
271
1. Validate `<AudienceRestriction>` and `<DelegationRestriction>` conditions
272
272
2. Validate ``<SubjectConfirmation>``s, expect for any IP address information
273
273
274
-
To perform additional validation, you can configure your own assertion validator that delegates to `OpenSaml4AuthenticationProvider`'s default and then performs its own.
274
+
To perform additional validation, you can configure your own assertion validator that delegates to ``OpenSaml4AuthenticationProvider``'s default and then performs its own.
While recommended, it's not necessary to call `OpenSaml4AuthenticationProvider`'s default assertion validator.
328
+
While recommended, it's not necessary to call ``OpenSaml4AuthenticationProvider``'s default assertion validator.
329
329
A circumstance where you would skip it would be if you don't need it to check the `<AudienceRestriction>` or the `<SubjectConfirmation>` since you are doing those yourself.
0 commit comments