NotBefore condition in assertions

[msvk]

Thank you Scott and Michael for your replies.

By setting JVM option -XX:+UseGetTimeOfDay, we were able to resolve java
clock drift issue. That resolved NotBefore timestamp validation at SP for
now.
 Since both clocks are synced to GPS clocks, we are hoping this issue will
not crop up again.

After experiencing this issue, our customer is concerned about this
happening again. 
As Scott mentioned in his reply, we are trying to convince our customer that
we cannot do anything at IdP and it is SPs responsibility. 

SAML spec approved errata clearly says it is the responsibility of relying
party(SP) to apply skew while validating timestamp.

(below approved errata, item E92 details for ref)
http://docs.oasis-open.org/security/saml/v2.0/sstc-saml-approved-errata-2.0.pdf

/E92: Add guidance for implementers on clock skew

Add text to [SAMLCore] after line 314:
New:

SAML system entities SHOULD allow for reasonable clock skew between systems
when interpreting timeinstants and enforcing security policies based on
them. Tolerances of 3-5 minutes are reasonable defaults,but allowing for
configurability is a suggested practice in implementations.

Add text to [SAMLCore] after line 759:
New:

As noted in section 1.3.3, relying parties SHOULD allow for reasonable clock
skew in the interpretation ofboth values.

Add text to [SAMLCore] after line 887:
New:

As noted in section 1.3.3, relying parties SHOULD allow for reasonable clock
skew in the interpretation ofboth values.

Add text to [SAMLCore] after line 2538:
New:

As noted in that same section, relying parties SHOULD allow for reasonable
clock skew in the interpretationof this value./




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/NotBefore-condition-in-assertions-tp7582535p7610059.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141214/b543fed8/attachment.html