Internation dateline issue

[Christopher Bongaarts]

On 1/18/2013 8:52 AM, Cantor, Scott wrote:
> On 1/18/13 9:10 AM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:
>
>> I'll gather more info from these guys.  They sent me a message stating
>> that the date was an issue and gave me this error message:
>>
>> org.opensaml.ws.security.SecurityPolicyException:
>> Message was rejected due to issue instant expiration
>
> Well, that's OpenSAML, but not necessarily Shibboleth. And could be
> nothing more than their clock being off.
>
> I don't really see how a bug that obvious would have gone unnoticed all
> this time, it would suppose that nobody with an IdP in Australia ever used
> an SP in the US, which beggars belief.

One explanation is if their timezone is set wrong on their server, which 
would result in incorrect GMT times being sent in the SAML assertion. 
One could use SAML Tracer or turn up debugging to show the raw SAML 
assertion in logs to see what they are actually sending.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%