What you’ll be able to do
- Name the ID Token claims iss, sub, aud, exp, and iat, and say when nonce matters.
- List the relying-party checks for issuer, audience, expiry, and nonce at literacy level.
- Read SAML Conditions for time and audience without treating the assertion as admin rights.
- Finish the sentence: SSO success means an assertion arrived; the app still authorizes the action.
A sign-in claim is a different object
Harbor Mail can hold an OAuth access token and still not know who signed in. OpenID Connect adds an identity layer on OAuth. The ID Token is a JSON Web Token. OpenID Connect Core 1.0, incorporating errata set 2 (15 December 2023), puts iss, sub, aud, exp, and iat on that token. nonce and auth_time are optional and matter when the flow uses them.
iss is the issuer, Riverstone IdP. sub is the subject identifier at that issuer. aud is the audience, which must include this client. exp and iat bound the time. nonce ties the token to the request Harbor Mail sent, when a nonce was used. The access token, not the ID Token, is what a mail API should see for a read.
The relying party still checks the claim
Harbor Mail is the relying party. OpenID Connect Core section 3.1.3.7 is the validation list at literacy level: the issuer matches the expected IdP, the audience includes this client, the token is inside its expiry, and the nonce matches when one was sent. Use a maintained library. This lesson does not paste a validator.
A valid ID Token means Riverstone IdP asserts a sign-in for this client. Harbor Mail still maps sub to a local account and still decides which mailbox that account may open. The glossary line stands: the ID Token asserts a sign-in, and the relying party still authorizes.
- Issuer: iss matches Riverstone IdP, not a lookalike host.
- Audience: aud includes Harbor Mail’s client id.
- Time: now is before exp, and iat is plausible.
- Nonce: when Harbor Mail sent one, the token carries that same value.
SAML carries an assertion, not a blank pass
Some Riverstone apps still speak SAML 2.0. OASIS SAML Core 2.0, saml-core-2.0-os, 15 March 2005, defines XML assertions about authentication and attributes, issued by an identity provider. Conditions constrain use. NotBefore and NotOnOrAfter bound the time. AudienceRestriction names the service provider that may accept the assertion.
A signed assertion is not a blank admin pass. The warehouse portal can trust an assertion for Priya and still apply the Warehouse role locally. F4 and the SAML term guide already say that. This lesson only asks you to mark which checks the service provider still owns.
Enterprises keep SAML where legacy apps and XML identity estates already speak it. Newer relying parties often speak OIDC. That is a pattern, not a verdict. This path does not claim SAML is obsolete.
Two synthetic claims, one job left for the app
Synthetic ID Token for Harbor Mail: iss https://idp.riverstone.example, sub user-1844, aud harbor-mail, iat 2026-09-24T16:00:00Z, exp 2026-09-24T16:10:00Z, nonce n-77. Synthetic SAML Conditions on a second app: NotBefore 2026-09-24T16:00:00Z, NotOnOrAfter 2026-09-24T16:05:00Z, AudienceRestriction harbor-portal. Neither snippet grants the export button.
The relying party or service provider still checks issuer, audience, and the time window, plus nonce when the OIDC flow used one. After those checks pass, local authorization still names the action. SSO success means the issuer asserted a sign-in for this client. The app still must allow or refuse the mailbox action.
| Claim | Check the app still owns | Not granted by the claim |
|---|---|---|
| OIDC ID Token | iss is Riverstone IdP, aud includes harbor-mail, exp has not passed, nonce matches n-77. | Permission to export every mailbox. |
| SAML assertion | Issuer, AudienceRestriction harbor-portal, and the NotBefore / NotOnOrAfter window. | A blank admin pass inside the portal. |
CHECK YOUR JUDGMENT
Harbor Mail accepts an ID Token for user-1844 and opens a session. Sam asks what SSO success means. Which sentence is right?
NEXT FIELD LESSON