opensaml::SecurityPolicyException: Message expired, was issued too long ago.

[Cantor, Scott]

On 7/1/15, 5:01 PM, "users on behalf of James W. Anderson" <users-bounces at shibboleth.net on behalf of jamesanderson at coca-cola.com> wrote:



>I don't understand what you mean by the values "already have the skew applied."

The value it logged/reported is already adjusted in the direction required to allow for skew. It's still invalid, which means the clocks were out of sync by at least as much time as the skew setting.

> How does Shibboleth use the clock skew setting?

By adjusting every value consumed from a different system in a favorable direction to maximize validity. That's the definition.

-- Scott

>