NotBefore condition in assertions

[Russell Beall]

I would like to briefly resurrect this issue to check on the current standing of NotBefore configuration.

It appears that a solution was developed and placed into the 2.4.0 release.  That setting only allows for the removal of the NotBefore attribute.  Am I correct in assuming that there is no setting which will allow for a skew to be forced into that setting from the IdP side?

I have been brazenly asked to hack the IdP code to subtract time from the NotBefore setting, and I would prefer not to do that.  We have a vendor (and there is no going back at this point) that falls into the category of both requiring the presence of NotBefore and has no skew tolerance (ahem... Workday...).

If there is a reference in the SAML standard that indicates a service is expected to have a clock skew tolerance, that would be good to see.

Thanks,
Russ.

On Oct 22, 2012, at 7:06 AM, Cantor, Scott wrote:

> On 10/22/12 9:15 AM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
> wrote:
> 
>> I will admit first up that I haven't followed this discussion fully, but
>> isn't this more of a matter of time synchronization? If the IdP issues a
>> response with a NotBefore set to the current time (accurate), then a skew
>> factor should not be needed.
> 
> Even if you're well-configured, you still can't avoid sub-second
> differences in time. Any system that relies on time enforcement has to
> allow skew, that's standard practice.
> 
>> In the 70 odd integrations I've done with different SP's, I've not had a
>> problem with this.
> 
> I really don't think it's all that common.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net