NotBefore condition in assertions

[Cantor, Scott]

On 10/22/12 9:15 AM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:

>I will admit first up that I haven't followed this discussion fully, but
>isn't this more of a matter of time synchronization? If the IdP issues a
>response with a NotBefore set to the current time (accurate), then a skew
>factor should not be needed.

Even if you're well-configured, you still can't avoid sub-second
differences in time. Any system that relies on time enforcement has to
allow skew, that's standard practice.

>In the 70 odd integrations I've done with different SP's, I've not had a
>problem with this.

I really don't think it's all that common.

-- Scott