Bearer Rule

Identified by type="Bearer", this rule allows a SAML 2.0 assertion with the "bearer" subject confirmation method to be accepted when possible. Normally not used explicitly, this rule is applied automatically to any policy running inside an AssertionConsumerService that implements SAML 2.0 profiles that make use of this confirmation type.

Attributes

Name	Type	Default	Description
`checkValidity`	boolean	true	When true, the enclosed `<SubjectConfirmationData>` element must include a `NotOnOrAfter` attribute, and both it and the optional `NotBefore` attribute are checked for validity.
`checkRecipient`	boolean	true	When true, and the URL to which the assertion was submitted is available, the `<SubjectConfirmationData>` element's `Recipient` attribute is checked against that value. If no attribute is present, this setting has no effect.
`checkCorrelation`	boolean	false	Enables request/response correlation checking based on use of a cookie to track request IDs, subsequently recovered to compare to the `InResponseTo` attribute in the `<SubjectConfirmationData>` element. This setting previous defaulted to "true" but had no effect because there was no supporting request tracking implementation. This is now implemented, but the default has been reversed for compatibility with existing behavior.
`blockUnsolicited`^3.1	boolean	false	Enables the `checkCorrelation` option and adds rejection of any message with an empty `InResponseTo` attribute

Example

<PolicyRule type="Bearer" blockUnsolicited="true" />