validating forceAuthn: comparing to "now" vs comparing to "IssueInstant"

[Eric Goodman]

I was looking at the NativeSPSessions settings again wrt forceAuthn validation, and I was wondering:

The maxTimeSinceAuthn setting on the SP claims to measure the authnInstant vs. "now". Is there a reason the comparison isn't vs. the "IssueInstant" on the assertion itself? Seems like that might be a better way to check for a recent authentication, while leaving the overall timeskew adjustment work elsewhere. I can imagine cases where the timeskew on maxTimeSinceAuthn needs to be long enough to cause concerns with measuring "currentness".

I have no idea whether there's any real stats out there as to observed reasonable "maxTimeSinceAuthn" vs. "IssueInstant - AuthnInstant" values to use in a real deployment, but curious what people's thoughts are.

Thanks!

--- Eric
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150630/01cb524c/attachment.html>