NotBefore / NotOnOrAfter from SAML1 IDP not honored by Shib SP2

[Cantor, Scott]

On 4/2/12 4:38 AM, "Martin Haase" <martin.haase at daasi.de> wrote:

>we have a SAML1 IdP (presumably not Shibboleth) and a 2.4.3 Shib SP.
>Everything works well, except the NotBefore / NotOnOrAfter attributes.
>Some security setting be the IdP's organization sets the limit to one
>minute. So they issue the assertion, send it after one minute to the SP,
>however, the SP does accept it. Is this a known limitation? The
>NotBefore / NotOnOrAfter attributes come from the IdP enclosed in the
>elements samlp:response/saml:Asserion/saml:Conditions. The SP's
>clockSkew is set at 60.

If clock skew is 60, then it's going to accept anything with an expiration
of a minute older than the current time. Just for starters.

There's no bug here I'm aware of. I'd start by testing it with a more
extreme value and if that's accepted, then there might be a bug. It's moot
anyway, the IssueInstant check serves essentially the same purpose, so the
widest the window would get is a few minutes.

-- Scott