NotBefore condition in assertions

[Russell Beall]

Oh, cool.

I just finished downloading and trying the 2.4 release.  I confirmed that they are violating the standard by requiring a NotBefore because my login attempts with no NotBefore setting all fail (but do work fine when NotBefore is present).  

They pointed out a spot in their own documentation where they addressed this issue and even their own documentation lists it as an expected practice that the IdP should set the skew window by buffering time into the NotBefore and NotOnOrAfter.

I guess I am still unclear whether your suggestion involves changing code or tweaking configuration.  If it is just a configuration tweak, then I am definitely interested.  If it involves core code changes then I wouldn't want to trouble you unless we decided to implement it in response to a failure of Workday to standardize their skew functionality. 

Thanks,
Russ.

On Jan 16, 2014, at 3:04 PM, Michael A Grady <mgrady at unicon.net> wrote:

> Actually, that code in 2.4 *is* the code, we contributed it and Scott worked it in. I can just highlight the places you need to update something, if you don't already know.
> 
> On Jan 16, 2014, at 4:54 PM, Russell Beall wrote:
> 
>> 
>> On Jan 16, 2014, at 1:40 PM, Michael A Grady <mgrady at unicon.net>
>> wrote:
>> 
>>> Of course, the standard does explicitly state that NotBefore and NotAfter are optional, even if requested, so requiring both can easily be argued to violate the standard.
>> 
>> Yes, and I've been trying to push this back on them.  They are at least looking into the possibility of adjusting their code.
>> 
>>> Russ, if you need any guidance, I have all the changes I made for allowing the option of removing NotBefore, every place you'd need to make a change. I'd originally, for Unicon's own purposes (the biggest use of our own IdP) "brazenly" just removed NotBefore altogether, until I made the richer change to make it configurable. I assume you'd also want to make the subtraction of a factor configurable. (I.e. just apply it to that one vendor.)
>> 
>> That's very generous, thank you.  It sounds like the code you wrote has the same purpose as the option 'includeConditionsNotBefore' found in the 2.4.0 release of the IdP. If that is the case, then I probably will try to explore expediting the upgrade to 2.4.0 rather than putting in more custom code.  If your code offers a customization which readily allows a custom skew per service, I might have to get back to you on that depending on the fallout around here… 
>> 
>> Thanks again,
>> Russ.
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> 
> --
> Michael A. Grady
> Senior IAM Consultant, Unicon, Inc.
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net