bergie/passport-saml — pull request #34 by mradamlacey (2014-06-04 20:29:02+00:00)
Title: Support assertion conditions NotBefore and NotOnOrAfter validation

This PR provides support for the Assertion conditions for NotBefore and NotOnOrAfter.

Some design decisions I'd love to hear some feedback on:
- The condition checks are not opt-in - if `NotBefore` or `NotOnOrAfter` are present in the SAML response, they will be validated. You can maybe make the argument some clients might not want these checks, but if this is configurable to turn these off, the default should be *on* at least
- The timestamp comparisons by default account for some clock skew between client and server. The default is 60 seconds. This might be too much for some, and not enough for others. Maybe the default clock skew should be 0 and keep this as a configuration option?
- I have some TODO's for support for `InResponseTo`, need to do some more research to support this. So I can remove this if it offends anyone
- I added `sinon` to the unit tests to make it easy to mock the current date (since the code now relies on `new Date()` to compare against the SAML response validity timestamps

I'd love to help out this great module with this support. Let me know if there's anything else I need to do.

thanks!