NotBefore condition in assertions

[Michael A Grady]

On Dec 11, 2014, at 9:25 PM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:

> On 12/12/14, 3:00 AM, "msvk" <sajidvk at hotmail.com> wrote:
>> 
>> 1) Is there any way to configure shibboleth IdP to adjust the "NotBefore"
>> timestamp in the SAML assertion to few seconds into the past instead of
>> current time?
> 
> No, because that isn't how clock skew works. That SP has a bug, and they 
> need to fix it.
> 
>> 2) Assuming IdP & SP are synced to GPS clock, would 20ms network delay 
>> help
>> in covering for IdP clock drift into future?
> 
> I don't know what that means, but tolerating clock skew on the order of 
> minutes is a responsibility of any recipient in a protocol that relies on 
> accurate time.
> 

You do have the option to "turn off" sending the NotBefore condition. It's perfectly valid (by the SAMLv2 standard) to omit it, and we've done so with certain vendor SAML implementations where no clock skew was allowed for. You can specify that option as a default, or for a specific Relying Party, in the IdP's relying-party.xml config. Look for the "includeConditionsNotBefore" attribute (set it to "false", it's "true" by default).

  https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2SSOProfileConfig


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.