title: IDP initiated SAML login error - Authentication statement is too old to be used with value
body: <p>We are using ADFS as an IDP and our application acts as SP. Below is a sample Auth response</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;Assertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion" ID="_82062d3d-897f-473e-90ad-0bb351d63b22" IssueInstant="2015-04-29T20:39:17.240Z" Version="2.0"&gt;
     &lt;Issuer&gt;http://adfs/services/trust&lt;/Issuer&gt;
     &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
        &lt;ds:SignedInfo&gt;
           &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
           &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
           &lt;ds:Reference URI="#_82062d3d-897f-473e-90ad-0bb351d63b22"&gt;
              &lt;ds:Transforms&gt;
                 &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                 &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;ds:DigestValue /&gt;
           &lt;/ds:Reference&gt;
        &lt;/ds:SignedInfo&gt;
        &lt;ds:SignatureValue /&gt;
        &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
           &lt;ds:X509Data&gt;
              &lt;ds:X509Certificate&gt;certificate..... &lt;/ds:X509Certificate&gt;
           &lt;/ds:X509Data&gt;
        &lt;/KeyInfo&gt;
     &lt;/ds:Signature&gt;
     &lt;Subject&gt;
        &lt;NameID&gt;username&lt;/NameID&gt;
        &lt;SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"&gt;
           &lt;SubjectConfirmationData InResponseTo="923ki0eg8h7g7y2243fi9jbdd1977j9" NotOnOrAfter="2015-04-29T20:44:17.240Z" Recipient="https://localhost/saml/SSO" /&gt;
        &lt;/SubjectConfirmation&gt;
     &lt;/Subject&gt;
     &lt;Conditions NotBefore="2015-04-29T20:39:17.240Z" NotOnOrAfter="2015-04-29T21:39:17.240Z"&gt;
        &lt;AudienceRestriction&gt;
           &lt;Audience&gt;https://localhost/saml/metadata&lt;/Audience&gt;
        &lt;/AudienceRestriction&gt;
     &lt;/Conditions&gt;
     &lt;AuthnStatement AuthnInstant="2015-04-29T20:39:17.162Z" SessionIndex="_92062g3d-897f-473e-90ad-0aa351d63b22"&gt;
        &lt;AuthnContext&gt;
           &lt;AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport&lt;/AuthnContextClassRef&gt;
        &lt;/AuthnContext&gt;
     &lt;/AuthnStatement&gt;
  &lt;/Assertion&gt;
  </code></pre>
  
  <p>The problem I face can be categorized into two scenarios:</p>
  
  <ol>
  <li><p>After 1 hour of Idle time, I logout the user locally. The server session expiry is a default value of 30min. I have my code to send heartbeat pings every 10min, if the user is actively working on something. Now, the problem is that when the user tries to login after the session expiry of 1 hour, I get the below exception</p>
  
  <pre><code>Caused by: org.springframework.security.authentication.CredentialsExpiredException: Authentication statement is too old to be used with value 2015-05-28T17:41:52.648Z
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAuthenticationStatement(WebSSOProfileConsumerImpl.java:538)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertion(WebSSOProfileConsumerImpl.java:306)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:214)
      ... 77 more
  </code></pre></li>
  </ol>
  
  <p>The question here is.. Why would our application try to validate the instance of when the token was issued? It could be granted anytime.. </p>
  
  <ol start="2">
  <li><p>I keep getting SAMLException with message "Local entity is not the intended audience of the assertion in at least one AudienceRestriction". The trace is as below</p>
  
  <pre><code>Caused by: org.opensaml.common.SAMLException: Local entity is not the intended audience of the assertion in at least one AudienceRestriction
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAudience(WebSSOProfileConsumerImpl.java:506)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertionConditions(WebSSOProfileConsumerImpl.java:458)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertion(WebSSOProfileConsumerImpl.java:303)
      at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:214)
      ... 77 more
  </code></pre></li>
  </ol>
  
  <p>I dont understand why this exception occurs. </p>
  
  <p>Please help me to understand the concept.</p>
  
  <p>Thanks!</p>