validating forceAuthn: comparing to "now" vs comparing to "IssueInstant"

[Cantor, Scott]

On 6/29/15, 8:14 PM, "users on behalf of Eric Goodman" <users-bounces at shibboleth.net on behalf of Eric.Goodman at ucop.edu> wrote:



>The maxTimeSinceAuthn setting on the SP claims to measure the authnInstant vs. “now”. Is there a reason the comparison isn’t vs. the “IssueInstant” on the assertion itself? Seems like that
> might be a better way to check for a recent authentication, while leaving the overall timeskew adjustment work elsewhere. I can imagine cases where the timeskew on maxTimeSinceAuthn needs to be long enough to cause concerns with measuring “currentness”.

Never really thought about it.

-- Scott