opensaml::SecurityPolicyException: Message expired, was issued too long ago.

[James W. Anderson]

I don't understand what you mean by the values "already have the skew applied." How does Shibboleth use the clock skew setting?

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, July 01, 2015 11:52 AM
To: Shib Users
Cc: Mathi Vairaperumal
Subject: Re: opensaml::SecurityPolicyException: Message expired, was issued too long ago.

On 7/1/15, 11:40 AM, "users on behalf of James W. Anderson" <users-bounces at shibboleth.net on behalf of jamesanderson at coca-cola.com> wrote:



>We temporarily worked around this by changing the clockSkew setting in shibboleth2.xml to 7200 seconds, but I’d like to understand what is causing this, because it looks the time values are well within the default skew setting of 180 seconds.

The values you're looking at already have the skew applied, it's a bit non-obvious. So nothing mysterious.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________

CONFIDENTIALITY NOTICE
NOTICE: This message is intended for the use of the individual or entity to which it is addressed and may contain information that is confidential, privileged and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any printing, copying, dissemination, distribution, disclosure or forwarding of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and delete it from your system. Thank You.

________________________________