NotBefore condition in assertions

[Russell Beall]

On Jan 16, 2014, at 1:40 PM, Michael A Grady <mgrady at unicon.net>
 wrote:

> Of course, the standard does explicitly state that NotBefore and NotAfter are optional, even if requested, so requiring both can easily be argued to violate the standard.

Yes, and I've been trying to push this back on them.  They are at least looking into the possibility of adjusting their code.

> Russ, if you need any guidance, I have all the changes I made for allowing the option of removing NotBefore, every place you'd need to make a change. I'd originally, for Unicon's own purposes (the biggest use of our own IdP) "brazenly" just removed NotBefore altogether, until I made the richer change to make it configurable. I assume you'd also want to make the subtraction of a factor configurable. (I.e. just apply it to that one vendor.)

That's very generous, thank you.  It sounds like the code you wrote has the same purpose as the option 'includeConditionsNotBefore' found in the 2.4.0 release of the IdP. If that is the case, then I probably will try to explore expediting the upgrade to 2.4.0 rather than putting in more custom code.  If your code offers a customization which readily allows a custom skew per service, I might have to get back to you on that depending on the fallout around here… 

Thanks again,
Russ.