bergie/passport-saml — pull request #35 by mradamlacey (2014-06-05 13:34:34+00:00)
Title: NotBefore and NotOnOrAfter - let me try again

Let me try this again... don't think my changes made it in my previous pull request. Sorry/

This PR provides support for the Assertion conditions for `NotBefore` and `NotOnOrAfter`.

Some design decisions I'd love to hear some feedback on:

* The condition checks are not opt-in - if NotBefore or NotOnOrAfter are present in the SAML response, they will be validated. You can maybe make the argument some clients might not want these checks, but if this is configurable to turn these off, the default should be on at least
* The timestamp comparisons by default account for some clock skew between client and server. The default is 60 seconds. This might be too much for some, and not enough for others. Maybe the default clock skew should be 0 and keep this as a configuration option?
* I added sinon to the unit tests to make it easy to mock the current date (since the code now relies on new Date() to compare against the SAML response validity timestamps
I'd love to help out this great module with this support. Let me know if there's anything else I need to do.

thanks!