NotBefore condition in assertions

[Michael A Grady]

On Jan 16, 2014, at 7:02 PM, Russell Beall wrote:

> Oh, cool.
> 
> I just finished downloading and trying the 2.4 release.  I confirmed that they are violating the standard by requiring a NotBefore because my login attempts with no NotBefore setting all fail (but do work fine when NotBefore is present).  
> 
> They pointed out a spot in their own documentation where they addressed this issue and even their own documentation lists it as an expected practice that the IdP should set the skew window by buffering time into the NotBefore and NotOnOrAfter.
> 
> I guess I am still unclear whether your suggestion involves changing code or tweaking configuration.  If it is just a configuration tweak, then I am definitely interested.  If it involves core code changes then I wouldn't want to trouble you unless we decided to implement it in response to a failure of Workday to standardize their skew functionality. 

No, you're definitely talking code changes, the code isn't there for a "skew factor" for NotBefore. I'd thought about a time adjustment for our own needs (a key SP Unicon uses that also applies no skew factor, but at least follows the standard and lets NotBefore be optional), even briefly contemplating if we should just adjust the server time back and make the NotOnOrAfter window a bit longer, but decided that would be nonsensical. The frustrating thing with the SP was that we were talking < 1 second differentials (often just some milliseconds, we even adjusted our NTP config to match), but without any skew, that was all it took to reject the assertion. But dropping it solved the problem and led to our contribution of that to the IdP.

> 
> Thanks,
> Russ.
> 
> On Jan 16, 2014, at 3:04 PM, Michael A Grady <mgrady at unicon.net> wrote:
> 
>> Actually, that code in 2.4 *is* the code, we contributed it and Scott worked it in. I can just highlight the places you need to update something, if you don't already know.
>> 
>> On Jan 16, 2014, at 4:54 PM, Russell Beall wrote:
>> 
>>> 
>>> On Jan 16, 2014, at 1:40 PM, Michael A Grady <mgrady at unicon.net>
>>> wrote:
>>> 
>>>> Of course, the standard does explicitly state that NotBefore and NotAfter are optional, even if requested, so requiring both can easily be argued to violate the standard.
>>> 
>>> Yes, and I've been trying to push this back on them.  They are at least looking into the possibility of adjusting their code.
>>> 
>>>> Russ, if you need any guidance, I have all the changes I made for allowing the option of removing NotBefore, every place you'd need to make a change. I'd originally, for Unicon's own purposes (the biggest use of our own IdP) "brazenly" just removed NotBefore altogether, until I made the richer change to make it configurable. I assume you'd also want to make the subtraction of a factor configurable. (I.e. just apply it to that one vendor.)
>>> 
>>> That's very generous, thank you.  It sounds like the code you wrote has the same purpose as the option 'includeConditionsNotBefore' found in the 2.4.0 release of the IdP. If that is the case, then I probably will try to explore expediting the upgrade to 2.4.0 rather than putting in more custom code.  If your code offers a customization which readily allows a custom skew per service, I might have to get back to you on that depending on the fallout around here… 
>>> 
>>> Thanks again,
>>> Russ.
>>> --
>>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>> 
>> 
>> --
>> Michael A. Grady
>> Senior IAM Consultant, Unicon, Inc.
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.