NotBefore condition in assertions

[Cantor, Scott]

On 1/16/14, 2:19 PM, "Russell Beall" <beall at usc.edu> wrote:

>It appears that a solution was developed and placed into the 2.4.0
>release.  That setting only allows for the removal of the NotBefore
>attribute.  Am I correct in assuming that there is no setting which will
>allow for a skew to be forced into that setting from the IdP side?

Correct.

>If there is a reference in the SAML standard that indicates a service is
>expected to have a clock skew tolerance, that would be good to see.

There isn't. It's part of common sense practice developing security
software.

-- Scott