SubjectConfirmation

The SubjectConfirmation exists in a Subject, and is used in two manners on Subjects:

To hold a 'bearer' confirmation in a response to an AuthnRequest, to conform to the WebSSO profile.

A <Subject> in an <Assertion> can contain two different types of <SubjectConfirmation> elements. Below is a description for each of these usages. Note that bearer confirmations MAY be applicable to a single Assertion.

SubjectConfirmation for bearer confirmation (WebSSO)

In case a relying party is requesting authentication of a user according to the SAML Web SSO profile, a 'bearer' SubjectConfirmation (see SAML 2.0 Profiles, §3.3 and §4.1.4).

Element/@Attribute	0..n	Description
<SubjectConfirmation>	0..1	(Only for the Declaration of Identity or a HM Summary Declaration to the DV) Allows for association of client with assertion to conform to the SAML Web SSO profile.
@Method	1	MUST contain the value 'urn:oasis:names:tc:SAML:2.0:cm:bearer'.
<SubjectConfirmationData>	1
@NotBefore	0	MUST NOT be used.
@NotOnOrAfter	1	Indicates maximum validity of the assertion
@Recipient	1	The assertion consumer Service index of the immediate requester to which an attesting entity can present the assertion
@InResponseTo	1	The ID of the request this assertion is in response to
@Address	0	MUST NOT be used.

Example SubjectConfirmation WebSSO

XML

...
    <saml:Subject>
        ...
        <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
            <saml:SubjectConfirmationData InResponseTo="_52B816C631C564BACF59E758CBA91717" NotOnOrAfter="2016-02-05T09:11:48Z" Recipient="https://..."/>
        </saml:SubjectConfirmation>
    </saml:Subject>
...