3149136 - "SAML2Assertion does not specify SubjectConfDataNotOnOrAfter" error in Identity Authentication

• Identity Authentication acts as a proxy to delegate the authentication to a corporate identity provider.
• SAML2 SSO fails and the error "Sorry, but you are currently not authorized for access" is returned by Identity Authentication.
• In SAML2 trace generated as described in KBA 2461862, SAML response from the corporate identity provider looks like:
      <saml:Subject>
          <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">XXXX</saml:NameID>
          <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
              <saml:SubjectConfirmationData Recipient=https://<tenantID>.accounts.ondemand.com/saml2/idp/acs/<tenantID>.ondemand.com?sp=XXX />
          </saml:SubjectConfirmation>
      </saml:Subject>
• The following error occurs in troubleshooting logs:
          "SAML2Assertion does not specify SubjectConfDataNotOnOrAfter"

Identity Authentication

IAS "SAML2Assertion does not specify SubjectConfDataNotOnOrAfter" "Sorry, but you are currently not authorized for access" , KBA , BC-IAM-IDS , Identity Authentication Service , Problem