NotBefore condition in assertions

[Christopher Bongaarts]

On 10/17/2012 2:16 PM, Michael A Grady wrote:

> Any thoughts on this? Anyone else who would like to see this option
> exist in the IdP? (Note I'm intentionally starting this discussion on
> the Users list, for the widest input/feedback/thoughts, but recognize
> that eventually the conversation would most appropriately move to the
> Dev list.)

So far we have encountered just one SP that had this issue.  I suspect 
they were using a homebrew SP of some sort.  I quoted the line from the 
SAML standard that indicates that it is the SP's responsibility to deal 
with clock skew.  After trying to see if there was some way we could 
apply an offset to our IdP's NotBefores (we said no), they eventually 
took it back to their development team.

Not sure how their SP would behave without a NotBefore...
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%