Survey: (IssueInstant - AuthnInstant) vs. (SP local clock time - AuthnInstant) or SP clockskew

[Eric Goodman]

>>2) If you can also include a quick overview of how the authentication is actually done 
>>(i.e., “forms-based LDAP auth in Shib” vs. “external” vs. whatever), that might be 
>>helpful in seeing if specific methods are particularly “laggier” than others.

>The method isn't going to matter, the time is just based on when the result is recorded.

Thanks, I didn't know if any external auth mechanisms keep AuthnInstants unchanged. (And wondered if it's possible for clockskew to ever leave an AuthnInstant > IssueInstant in an assertion...)

--- Eric