I want to check if the SAML response is within the validity period.
I am using OffsetDateTime class to convert current time in UTC so I can compare SAML response times with the current time.
NotBefore [Optional] Specifies the earliest time instant at which the assertion is valid. The time value is encoded in UTC, as described in Section 1.3.3. NotOnOrAfter [Optional] Specifies the time instant at which the assertion has expired. The time value is encoded in UTC, as described in Section 1.3.3.
My question is: Am I getting in trouble using OffsetDateTime class or should I use ZonedDateTime class to handle different time zones.
It is possible that the code will not work because of the Daylight saving time?
This is what SAML documentation says: Attributes NotBefore and NotOnOrAfter The NotBefore and NotOnOrAfter attributes specify time limits on the validity of the assertion within the context of its profile(s) of use. They do not guarantee that the statements in the assertion will be correct or accurate throughout the validity period. The NotBefore attribute specifies the time instant at which the validity interval begins. The NotOnOrAfter attribute specifies the time instant at which the validity interval has ended. If the value for either NotBefore or NotOnOrAfter is omitted, then it is considered unspecified. If the NotBefore attribute is unspecified (and if all other conditions that are supplied evaluate to Valid), then the assertion is Valid with respect to conditions at any time before the time instant specified by the NotOnOrAfter attribute. If the NotOnOrAfter attribute is unspecified (and if all other conditions that are supplied evaluate to Valid), the assertion is Valid with respect to conditions from the time instant specified by the NotBefore attribute with no expiry. If neither attribute is specified (and if any other conditions that are supplied evaluate to Valid), the assertion is Valid with respect to conditions at any time. If both attributes are present, the value for NotBefore MUST be less than (earlier than) the value for NotOnOrAfter.
This is my code:
import java.time.OffsetDateTime;
public static OffsetDateTime parseOffsetDateAndTime(String date) {
String dateAndTime = new DateTime(date).toString();
return OffsetDateTime.parse(dateAndTime);
}
public boolean isSamlResponseWithinTheValidityPeriod(String notBeforeDate, String notAfterDate) {
OffsetDateTime samlOffsetDateNotBefore = null;
OffsetDateTime samlOffsetDateNotAfter = null;
if (StringUtils.isNotBlank(notBeforeDate)) {
samlOffsetDateNotBefore = DateCalendarUtil.parseOffsetDateAndTime(notBeforeDate);
}
if (StringUtils.isNotBlank(notAfterDate)) {
samlOffsetDateNotAfter = DateCalendarUtil.parseOffsetDateAndTime(notAfterDate);
}
boolean isSamlResponseWithinTheValidityPeriod = true;
String currentSystemDateAndTime = new DateTime().toString();
OffsetDateTime currentDate = OffsetDateTime.parse(currentSystemDateAndTime);
if (samlOffsetDateNotBefore != null && samlOffsetDateNotAfter == null) {
isSamlResponseWithinTheValidityPeriod = currentDate.isAfter(samlOffsetDateNotBefore);
} else if (samlOffsetDateNotBefore == null && samlOffsetDateNotAfter != null) {
isSamlResponseWithinTheValidityPeriod = currentDate.isBefore(samlOffsetDateNotAfter);
} else if (samlOffsetDateNotBefore != null && samlOffsetDateNotAfter != null) {
//both dates exist
isSamlResponseWithinTheValidityPeriod = (samlOffsetDateNotBefore.isBefore(samlOffsetDateNotAfter) &&
currentDate.isAfter(samlOffsetDateNotBefore) && currentDate.isBefore(samlOffsetDateNotAfter));
}
return isSamlResponseWithinTheValidityPeriod;
}