NotBefore condition in assertions

[David Langenberg]

As we will soon be in the same boat, I'm also very interested in what you
cook up to deal with the skew issue Russ.

Dave


On Thu, Jan 16, 2014 at 3:54 PM, Russell Beall <beall at usc.edu> wrote:

>
> On Jan 16, 2014, at 1:40 PM, Michael A Grady <mgrady at unicon.net>
>  wrote:
>
> > Of course, the standard does explicitly state that NotBefore and
> NotAfter are optional, even if requested, so requiring both can easily be
> argued to violate the standard.
>
> Yes, and I've been trying to push this back on them.  They are at least
> looking into the possibility of adjusting their code.
>
> > Russ, if you need any guidance, I have all the changes I made for
> allowing the option of removing NotBefore, every place you'd need to make a
> change. I'd originally, for Unicon's own purposes (the biggest use of our
> own IdP) "brazenly" just removed NotBefore altogether, until I made the
> richer change to make it configurable. I assume you'd also want to make the
> subtraction of a factor configurable. (I.e. just apply it to that one
> vendor.)
>
> That's very generous, thank you.  It sounds like the code you wrote has
> the same purpose as the option 'includeConditionsNotBefore' found in the
> 2.4.0 release of the IdP. If that is the case, then I probably will try to
> explore expediting the upgrade to 2.4.0 rather than putting in more custom
> code.  If your code offers a customization which readily allows a custom
> skew per service, I might have to get back to you on that depending on the
> fallout around here…
>
> Thanks again,
> Russ.
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140116/2473ab1c/attachment.html