The assertion parameter MUST NOT contain more than one SAML 2.0 Assertion..

Condition: When presenting a SAML bearer assertion as an authorization grant.

It MUST NOT contain more than one SAML 2.0 Assertion.

The base64url-encoded assertion data MUST NOT be line wrapped..

Condition: When encoding the assertion parameter.

the base64url-encoded data MUST NOT be line wrapped

Base64url pad characters ('=') MUST NOT be included in the assertion parameter..

Condition: When encoding the assertion parameter.

pad characters ("=") MUST NOT be included

The SAML Assertion XML data MUST be base64url encoded according to RFC 4648 Section 5, with padding bits set to zero..

Condition: When encoding the assertion parameter.

The SAML Assertion XML data MUST be encoded using base64url.

The authorization server MUST validate the assertion according to the criteria in RFC 7522 Section 3 before issuing an access token..

Condition: Before issuing an access token based on the assertion.

the authorization server MUST validate the Assertion according to the criteria below

The authorization server MUST reject an assertion that does not identify it as an intended audience..

MUST reject any Assertion that does not contain its own identity as the intended audience

The authorization server MUST verify that Recipient matches the token endpoint URL or acceptable alias receiving the assertion..

Condition: When SubjectConfirmationData contains Recipient.

MUST verify that the value of the Recipient attribute matches the token endpoint URL

The authorization server MUST reject the entire assertion when the Conditions NotOnOrAfter instant has passed, subject to allowable clock skew..

Condition: When the Conditions NotOnOrAfter instant has passed.

MUST reject the entire Assertion if the NotOnOrAfter instant on the <Conditions> element has passed

The authorization server MUST reject a SubjectConfirmation when its SubjectConfirmationData NotOnOrAfter instant has passed, subject to allowable clock skew..

Condition: When the SubjectConfirmationData NotOnOrAfter instant has passed.

MUST reject the <SubjectConfirmation> if the NotOnOrAfter instant ... has passed

The authorization server MUST reject assertions with an invalid signature or MAC..

MUST reject Assertions with an invalid signature or MAC

The authorization server MUST reject an assertion that is otherwise invalid under the SAML 2.0 core specification..

MUST reject an Assertion that is not valid in all other respects

The authorization server MUST validate client credentials when they are present in the request..

Condition: If client credentials are present.

if client credentials are present ... the authorization server MUST validate them

The error parameter MUST be invalid_grant when the assertion is invalid or its subject-confirmation requirements cannot be met..

Condition: When rejecting an invalid assertion.

The value of the "error" parameter MUST be the "invalid_grant" error code.

The authorization server MAY prevent bearer assertion replay by retaining used assertion ID values for the assertion's validity period..

The authorization server MAY ensure that Bearer Assertions are not replayed

The assertion's Issuer element MUST contain a unique identifier for the entity that issued it..

The Assertion's <Issuer> element MUST contain a unique identifier

The assertion MUST contain Conditions, AudienceRestriction, and Audience elements identifying the authorization server as an intended audience..

The Assertion MUST contain a <Conditions> element with an <AudienceRestriction> element

The assertion MUST contain a Subject element identifying its subject principal..

The Assertion MUST contain a <Subject> element identifying the principal

The assertion MUST have an expiry limiting the period during which it can be used..

The Assertion MUST have an expiry that limits the time window

The Subject element MUST contain at least one bearer-method SubjectConfirmation element..

The <Subject> element MUST contain at least one <SubjectConfirmation> element

The SubjectConfirmation element MUST contain SubjectConfirmationData when Conditions lacks a suitable NotOnOrAfter attribute..

Condition: If the Conditions element lacks a suitable NotOnOrAfter attribute.

the <SubjectConfirmation> element MUST contain a <SubjectConfirmationData> element

SubjectConfirmationData MUST contain a Recipient identifying the authorization server's token endpoint URL or an acceptable alias..

Condition: When SubjectConfirmationData is present.

MUST have a Recipient attribute with a value indicating the token endpoint URL

SubjectConfirmationData MUST contain a NotOnOrAfter attribute limiting the assertion confirmation period..

Condition: When SubjectConfirmationData is present.

MUST have a NotOnOrAfter attribute that limits the window

The assertion MUST be digitally signed or have a MAC applied by its issuer..

The Assertion MUST be digitally signed or have a Message Authentication Code

Issuer values MUST be compared using RFC 3986 simple string comparison unless an application profile specifies otherwise..

Condition: In the absence of an application profile specifying otherwise.

compliant applications MUST compare Issuer values using the Simple String Comparison method

Audience values MUST be compared using RFC 3986 simple string comparison unless an application profile specifies otherwise..

Condition: In the absence of an application profile specifying otherwise.

compliant applications MUST compare the Audience values using the Simple String Comparison method