NotBefore condition in assertions

[Michael A Grady]

On Oct 22, 2012, at 9:06 AM, Cantor, Scott wrote:

> On 10/22/12 9:15 AM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
> wrote:
> 
>> I will admit first up that I haven't followed this discussion fully, but
>> isn't this more of a matter of time synchronization? If the IdP issues a
>> response with a NotBefore set to the current time (accurate), then a skew
>> factor should not be needed.
> 
> Even if you're well-configured, you still can't avoid sub-second
> differences in time.

Yes, the differences in the use case I cited were almost all sub-second. This was even with ensuring syncing to the same time sources. Things would be fine for awhile, and then get milliseconds off and cause problems. And when an SP is applying the NotBefore check without *any* allowance for skew, then a millisecond is all it takes to invalidate the assertion.


> Any system that relies on time enforcement has to
> allow skew, that's standard practice.
> 
>> In the 70 odd integrations I've done with different SP's, I've not had a
>> problem with this.
> 
> I really don't think it's all that common.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.