code: func (sp *ServiceProvider) validateAssertion(assertion *Assertion, possibleRequestIDs []string, now time.Time) error {
  	if assertion.IssueInstant.Add(MaxIssueDelay).Before(now) {
  		return fmt.Errorf("expired on %s", assertion.IssueInstant.Add(MaxIssueDelay))
  	}
  	if assertion.Issuer.Value != sp.IDPMetadata.EntityID {
  		return fmt.Errorf("issuer is not %q", sp.IDPMetadata.EntityID)
  	}
  	requestIDvalid := false
  	for _, possibleRequestID := range possibleRequestIDs {
  		if assertion.Subject.SubjectConfirmation.SubjectConfirmationData.InResponseTo == possibleRequestID {
  			requestIDvalid = true
  			break
  		}
  	}
  	if !requestIDvalid {
  		return fmt.Errorf("SubjectConfirmation one of the possible request IDs (%v)", possibleRequestIDs)
  	}
  	if assertion.Subject.SubjectConfirmation.SubjectConfirmationData.Recipient != sp.AcsURL {
  		return fmt.Errorf("SubjectConfirmation Recipient is not %s", sp.AcsURL)
  	}
  	if assertion.Subject.SubjectConfirmation.SubjectConfirmationData.NotOnOrAfter.Before(now) {
  		return fmt.Errorf("SubjectConfirmationData is expired")
  	}
  	if assertion.Conditions.NotBefore.After(now) {
  		return fmt.Errorf("Conditions is not yet valid")
  	}
  	if assertion.Conditions.NotOnOrAfter.Before(now) {
  		return fmt.Errorf("Conditions is expired")
  	}
  	if assertion.Conditions.AudienceRestriction.Audience.Value != sp.MetadataURL {
  		return fmt.Errorf("Conditions AudienceRestriction is not %q", sp.MetadataURL)
  	}
  	return nil
  }
docs: // validateAssertion checks that the conditions specified in assertion match
  // the requirements to accept. If validation fails, it returns an error describing
  // the failure. (The digital signature on the assertion is not checked -- this
  // should be done before calling this function).