NotBefore / NotOnOrAfter from SAML1 IDP not honored by Shib SP2

[Martin Haase]

Hi Scott,

Am 02.04.2012 15:07, schrieb Cantor, Scott:
> On 4/2/12 4:38 AM, "Martin Haase" <martin.haase at daasi.de> wrote:
>
>> we have a SAML1 IdP (presumably not Shibboleth) and a 2.4.3 Shib SP.
>> Everything works well, except the NotBefore / NotOnOrAfter attributes.
>> Some security setting be the IdP's organization sets the limit to one
>> minute. So they issue the assertion, send it after one minute to the SP,
>> however, the SP does accept it. Is this a known limitation? The
>> NotBefore / NotOnOrAfter attributes come from the IdP enclosed in the
>> elements samlp:response/saml:Asserion/saml:Conditions. The SP's
>> clockSkew is set at 60.
> If clock skew is 60, then it's going to accept anything with an expiration
> of a minute older than the current time. Just for starters.
>
> There's no bug here I'm aware of. I'd start by testing it with a more
> extreme value
Is one hour extreme enough? They said it accepted the response even then.
>  and if that's accepted, then there might be a bug. It's moot
> anyway, the IssueInstant check 
Can the IssueInstant check be influenced anyhow?

...of course one could let the application check the
shib-authentication-instant, but that's an ugly workaround...

Thanks,
Martin

> serves essentially the same purpose, so the
> widest the window would get is a few minutes.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
-----------------------------------------------------------------------
Dr. Martin Haase
DAASI International GmbH                   phone:     +49 7071 407109-6
Europaplatz 3                              Fax  :     +49 7071 407109-9
D-72072 Tübingen                           email: Martin.Haase at DAASI.de
Germany                                    Web  :   http://www.daasi.de

Directory Applications for Advanced Security and Information Management
-----------------------------------------------------------------------


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2332 bytes
Desc: S/MIME Kryptografische Unterschrift
Url : http://shibboleth.net/pipermail/users/attachments/20120402/b6bece95/attachment.bin