Survey: (IssueInstant - AuthnInstant) vs. (SP local clock time - AuthnInstant) or SP clockskew

[Eric Goodman]

>No, I don't see what kind of "variance" you mean really. 

I was thinking about a case where the Shib IdP has clockskew compared to the (separate) server doing the authentication, and was thinking that could potentially cause the reported AuthnInstant to report a greater variance (IssueInstant-AuthnInstant) than one for a forms based authentication done by the Shib server itself.


>I think your original question is the relevant thing here, I don't think it really matters what login method is involved, that just muddies up the conversation.

Fair enough. In any case it's the more critical question. If we run across any (relatively) odd IdPs, investigation can be done from there.


So if anyone's still reading....

One person responded off list so far. I'm still interested in more data if others are willing to do some quick tests. Again, the question is:

If you look in an arbitrary SAML assertion following an interactive IdP login (that is, where you are actively authenticated rather than using an existing IdP SSO session), what do you see as IssueInstant vs. AuthnInstant in the resulting assertion?

Thanks, and have a great long weekend (at least for those here in the States!)

--- Eric