SES-172: please add one time use condition support on saml assertion

[spring-projects-issues]

Antonio Casino (Migrated from SES-172) said:

On spring security saml there is no support for one time use on the assertion. This could lead to Replay attack.

[davidjayb]

Both OWASP (SAML Security section Validate Security Countermeasures) and Oasis (Security and Privacy Considerations section 6.4.5) recommend utilizing the OneTimeUse condition element (Assertions and Protocols section 2.5.1.5) to prevent replay attacks for the Redirect and POST bindings.

It seems that this was not implemented initially due to concerns that you cannot request a new assertion: https://stackoverflow.com/questions/33356020/spring-saml-one-time-use-condition