adjusting assertion validity times

[Christopher Bongaarts]

There is an SP having problems with occasional SAML failures due to it 
seeing the notBefore time in our Conditions as being in the future.

We had some initial problems with our IdP's clocks being off by up to a 
second due to the leap second fiasco, but now we've got them all fixed. 
  The SP claims that their clocks are synced to NIST.

The SP is asking us to set up issued notBefore times back a few seconds 
to try to widen the acceptable window.  I didn't see a knob to configure 
this on the IdP - does such a thing exist?

We haven't seen this problem with any other SP.  It looks to me like the 
Shib SP (used by the most of our SPs) does not check notBefore, or if it 
does applies a clock skew factor before rejecting based on it.

Is it reasonable to expect the SP to allow for clock skew on the 
notBefore, or should we be hacking things to work around it?
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%