NotBefore condition in assertions

[Paul Hethmon]

On 10/21/12 7:08 PM, "Peter Schober" <peter.schober at univie.ac.at> wrote:

>* Michael A Grady <mgrady at unicon.net> [2012-10-21 23:44]:
>> I guess the IdP operators on this list have been successful with one
>> or more of the following:
>> 
>>  - get all their SPs to allow skew
>>  - get their organization to NOT use an SP that won't allow skew
>>  - simply not have a problem with skew
>
>Or more likely: just didn't have to federate with such SPs -- yet.
>-peter

I will admit first up that I haven't followed this discussion fully, but
isn't this more of a matter of time synchronization? If the IdP issues a
response with a NotBefore set to the current time (accurate), then a skew
factor should not be needed. The transmission of the SAML response from
the IdP back to the SP will always take a measurable amount of time and as
such should always reach the SP at a time past the NotBefore instance. If
not, is the SP synchronizing with a stratum 1 time server? If not, why not?

In the 70 odd integrations I've done with different SP's, I've not had a
problem with this.

Paul