adjusting assertion validity times

[Cantor, Scott]

On 9/11/12 1:17 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>
>The SP is asking us to set up issued notBefore times back a few seconds
>to try to widen the acceptable window.  I didn't see a knob to configure
>this on the IdP - does such a thing exist?

No, I don't think so. Clock skew has to be allowed for any time an SP (or
IdP) evaluates a timestamp.

>We haven't seen this problem with any other SP.  It looks to me like the
>Shib SP (used by the most of our SPs) does not check notBefore, or if it
>does applies a clock skew factor before rejecting based on it.

It applies clock skew.

>Is it reasonable to expect the SP to allow for clock skew on the
>notBefore, or should we be hacking things to work around it?

It is reasonable to require that.

An errata was issued to provide ammunition because a particular
implementer decided that common sense had to be spelled out before they
would consider engaging in it.

-- Scott