code: protected final boolean isValidBearerSubjectConfirmationData(final SubjectConfirmationData data,
                                                                   final SAML2MessageContext context) {
          if (data == null) {
              logger.debug("SubjectConfirmationData cannot be null for Bearer confirmation");
              return false;
          }
  
          // TODO Validate inResponseTo
  
          if (data.getNotBefore() != null) {
              logger.debug("SubjectConfirmationData notBefore must be null for Bearer confirmation");
              return false;
          }
  
          if (data.getNotOnOrAfter() == null) {
              logger.debug("SubjectConfirmationData notOnOrAfter cannot be null for Bearer confirmation");
              return false;
          }
  
          if (data.getNotOnOrAfter().plusSeconds(acceptedSkew).isBeforeNow()) {
              logger.debug("SubjectConfirmationData notOnOrAfter is too old");
              return false;
          }
  
          try {
              if (data.getRecipient() == null) {
                  logger.debug("SubjectConfirmationData recipient cannot be null for Bearer confirmation");
                  return false;
              } else {
                  final Endpoint endpoint = context.getSAMLEndpointContext().getEndpoint();
                  if (endpoint == null) {
                      logger.warn("No endpoint was found in the SAML endpoint context");
                      return false;
                  }
  
                  final URI recipientUri = new URI(data.getRecipient());
                  final URI appEndpointUri = new URI(endpoint.getLocation());
                  if (!SAML2Utils.urisEqualAfterPortNormalization(recipientUri, appEndpointUri)) {
                      logger.debug("SubjectConfirmationData recipient {} does not match SP assertion consumer URL, found. "
                          + "SP ACS URL from context: {}", recipientUri, appEndpointUri);
                      return false;
                  }
              }
          } catch (URISyntaxException use) {
              logger.error("Unable to check SubjectConfirmationData recipient, a URI has invalid syntax.", use);
              return false;
          }
  
          return true;
      }
docs: Validate Bearer subject confirmation data
  - notBefore
  - NotOnOrAfter
  - recipient
  
  @param data    the data
  @param context the context
  @return true if all Bearer subject checks are passing