How are the SPConfig clockSkew attribute and a Conditions NotBefore related?

[Brian Reindel]

The decrypted assertion has no SessionNotOnOrAfter set. This is the
AuthnStatement:

<AuthnStatement AuthnInstant="2014-06-23T14:55:23.376Z">
    <AuthnContext>
        <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</AuthnContextClassRef>
    </AuthnContext>
</AuthnStatement>

Is there a fallback in that case to some other time comparison?

On Mon, Jun 23, 2014 at 12:58 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 6/23/14, 12:50 PM, "Brian Reindel" <giantjamsandwich at gmail.com> wrote:
>
>>It appears that the session is being created and then removed. I see
>>this in the logs:
>
> Yeah, looks like it. That rules out NotBefore as a cause.
>
>>This is the conditions node from the assertion that comes back:
>>
>><Conditions NotBefore="2014-06-23T14:55:23.501Z"
>>NotOnOrAfter="2014-06-23T15:55:23.501Z">
>
> That's not the cause, I can tell you that definitively.
>
>>The clock time in the log (zone of America/New_York) is 2014-06-23
>>10:54:55. You can see there is about a 30 second lag after accounting
>>for the Identity Provider's time zone. The clock time is in the past.
>>I'm in a phase now where I'm looking for options to eliminate the
>>discrepancy if at all possible within the service provider.
>
> The cause is almost certainly what I described in my original response.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net