Internation dateline issue

[Mike Flynn]

What is the max time devaiation that Shib allows?  They are running Shib it seems.


________________________________
 From: Christopher Bongaarts <cab at umn.edu>
To: users at shibboleth.net 
Sent: Friday, January 18, 2013 9:26 AM
Subject: Re: Internation dateline issue
 
On 1/18/2013 8:52 AM, Cantor, Scott wrote:
> On 1/18/13 9:10 AM, "Mike Flynn" <shibbolethlynda at yahoo.com> wrote:
>
>> I'll gather more info from these guys.  They sent me a message stating
>> that the date was an issue and gave me this error message:
>>
>> org.opensaml.ws.security.SecurityPolicyException:
>> Message was rejected due to issue instant expiration
>
> Well, that's OpenSAML, but not necessarily Shibboleth. And could be
> nothing more than their clock being off.
>
> I don't really see how a bug that obvious would have gone unnoticed all
> this time, it would suppose that nobody with an IdP in Australia ever used
> an SP in the US, which beggars belief.

One explanation is if their timezone is set wrong on their server, which 
would result in incorrect GMT times being sent in the SAML assertion. 
One could use SAML Tracer or turn up debugging to show the raw SAML 
assertion in logs to see what they are actually sending.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130118/5afc6e01/attachment.html