NotBefore condition in assertions

[Michael A Grady]

On Jan 16, 2014, at 2:39 PM, Cantor, Scott wrote:

> On 1/16/14, 2:19 PM, "Russell Beall" <beall at usc.edu> wrote:
> 
>> It appears that a solution was developed and placed into the 2.4.0
>> release.  That setting only allows for the removal of the NotBefore
>> attribute.  Am I correct in assuming that there is no setting which will
>> allow for a skew to be forced into that setting from the IdP side?
> 
> Correct.
> 
>> If there is a reference in the SAML standard that indicates a service is
>> expected to have a clock skew tolerance, that would be good to see.
> 
> There isn't. It's part of common sense practice developing security
> software.
> 
> -- Scott

Of course, the standard does explicitly state that NotBefore and NotAfter are optional, even if requested, so requiring both can easily be argued to violate the standard.

Russ, if you need any guidance, I have all the changes I made for allowing the option of removing NotBefore, every place you'd need to make a change. I'd originally, for Unicon's own purposes (the biggest use of our own IdP) "brazenly" just removed NotBefore altogether, until I made the richer change to make it configurable. I assume you'd also want to make the subtraction of a factor configurable. (I.e. just apply it to that one vendor.)


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.