NotBefore condition in assertions

[Cantor, Scott]

On 12/12/14, 3:00 AM, "msvk" <sajidvk at hotmail.com> wrote:
>
>1) Is there any way to configure shibboleth IdP to adjust the "NotBefore"
>timestamp in the SAML assertion to few seconds into the past instead of
>current time?

No, because that isn't how clock skew works. That SP has a bug, and they 
need to fix it.

>2) Assuming IdP & SP are synced to GPS clock, would 20ms network delay 
>help
>in covering for IdP clock drift into future?

I don't know what that means, but tolerating clock skew on the order of 
minutes is a responsibility of any recipient in a protocol that relies on 
accurate time.

-- Scott