NotBefore condition in assertions

[msvk]

Hello, 

We are using Shibboleth IdP as IdP for an authentication service. 

We have a customer who is using a third party SP software. Third party
software configured as SP currently does not tolerate "NotBefore" timestamp
in the future. 
Both the Shibboleth IdP and SP systems are synced to Atomic or equivalent
clock(GPS). We expect at least 20-40ms delay between SAML assertion
generation and SP receiving it. 
Due to an issue with Java clock, IdP clock drifted into future and caused
Assertion validations at SP. By setting certain Java parameters, we were
able to correct the IdP clock issue. 

Questions: 

1) Is there any way to configure shibboleth IdP to adjust the "NotBefore"
timestamp in the SAML assertion to few seconds into the past instead of
current time? 

2) Assuming IdP & SP are synced to GPS clock, would 20ms network delay help
in covering for IdP clock drift into future? 

-Saj 



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/NotBefore-condition-in-assertions-tp7582535p7610011.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.