How are the SPConfig clockSkew attribute and a Conditions NotBefore related?

[Cantor, Scott]

On 6/23/14, 11:54 AM, "Brian Reindel" <giantjamsandwich at gmail.com> wrote:

>We're having issues where a third party identity provider on Windows
>is setting the NotBefore correctly, but our CentOS box that has our
>service provider is 30 seconds in the past. The session is expiring
>immediately as a result. I thought the clockSkew would take care of
>this discrepancy, and it is set to the default of 180. Am I
>misunderstanding how clockSkew works?

A session wouldn't expire, it wouldn't be created to begin with. They
might be setting SessionNotOnOrAfter, and that doesn't quite have the same
allowance for skew because of how it works.

-- Scott