Adding option to suppress NotBefore condition in assertions?

[Michael A Grady]

This is one last attempt to see if there is any interest in the Shib community to have a by-relying-party option to suppress sending the NotBefore condition on assertions sent to an SP from the Shib IdP.

Unicon switched in the Fall to using a third-party cloud provider (Replicon) for its time reporting, and Replicon will not support any time skew in its processing of NotBefore or NotAfter conditions. (Unicon was previously using Replicon, but hosted within Unicon and not using SAML.) Replicon otherwise meets the business needs of Unicon, so it wasn't an option to not use them. Even syncing the IdP server clock to the same time sources that Replicon uses did not prevent occasional sub-second differences in the clocks such that assertions were occasionally being rejected for "not yet being valid". To fix this problem, the simple change to the Shib IdP code was to remove sending the NotBefore condition on any assertions, which still adheres to the SAML standard. So the Shib IdP (2.3.8) Unicon is now running will not ever send the NotBefore condition.

The more flexible solution to the problem we were encountering (beyond simply not using that SP :-) would be to implement a configuration option to suppress the NotBefore condition on a relying party basis. Unicon is prepared to do that work using the same pool of Cooperative Support program hours that I referenced in the earlier post about the Login Page design. But my last attempt to see if there was any interest or need for such an option within the Shibboleth community did not yield any "takers". This is one "last call" to see if there is any such interest/need, before we abandon considering doing that work. (Wouldn't be a very useful contribution to the community if no one is going to use/need it.)

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.