IC71722: SAML ASSERTIONS CONTAINING TIMESTAMPS USING MILLISECOND PRECISION MAY BE INCORRECTLY MARKED AS INVALID

APAR status

• Closed as program error.

Error description

• When a SAML Assertion that uses millisecond precision in its
  NotBefore or NotOnOrAfter timestamps is processed by DataPower,
  the timestamp comparison may be performed incorrectly if the
  message is processed in the same second as either timestamp.
  
  The resulting behavior is that assertions are falsely marked as
  not yet
  valid when compared during the same second it was created, or
  are
  incorrectly marked as valid if compared in the same second it
  should expire.
  

Local fix

• Do not use millisecond precision when generating the timestamps.
  If currently running 3.8.1, use the skew time option.
  

Problem summary

• If a SAML assertion contains a timestamp with millisecond
  precision, DataPower may reject the assertion as invalid.
  

Problem conclusion

• DataPower processes SAML assertions containing timestamps with
  millisecond precision.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DATAPOWER

• Fixed component ID

  DP1234567

Applicable component levels

• R373 PSY

     UP

• R380 PSY

     UP

• R381 PSY

     UP