Survey: (IssueInstant - AuthnInstant) vs. (SP local clock time - AuthnInstant) or SP clockskew

[Eric Goodman]

Following up on my last query, I have a request if people are willing to take this on.

I presume that assertion (IssueInstant - AuthnInstant) is a better measure of "how recently did the person authenticate?" than AuthnInstant vs. the local SP clock setting, but I'd like to have some data behind that presumption.

1) If folks don't mind doing some simple research, can people do a quick interactive login, and report back to me (offlist is probably best!) what you see as the AuthnInstant and IssueInstant in the SAML response?

2) If you can also include a quick overview of how the authentication is actually done (i.e., "forms-based LDAP auth in Shib" vs. "external" vs. whatever), that might be helpful in seeing if specific methods are particularly "laggier" than others.

I'd also like to know how this value compares to the difference between the AuthnInstant and the time the SP clock time when the Assertion is received, but that's more work and it's probably good enough to just look at common SP clockskew settings.

Presuming I get responses, I will compile results and summarize back to the list.

Thanks!


To help scan SAML Tracer output, here's where these values are in the assertions:

    <saml2p:Response ... IssueInstant="2015-06-30T16:49:51.359Z">
        ...
        <saml2:Assertion ... IssueInstant="2015-06-30T16:49:51.359Z">
            ...
            <saml2:AuthnStatement ... AuthnInstant="2015-06-30T16:49:51.161Z">

(saml1 is "AuthenticationStatement", not "AuthnStatement").


--- Eric

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150630/136264da/attachment-0001.html>