Survey: (IssueInstant - AuthnInstant) vs. (SP local clock time - AuthnInstant) or SP clockskew

[Eric Goodman]

>>>The method isn't going to matter, the time is just based on when the result is recorded.
>>
>>Thanks, I didn't know if any external auth mechanisms keep 
>>AuthnInstants unchanged. (And wondered if it's possible for 
>>clockskew to ever leave an AuthnInstant > IssueInstant in an assertion...)
>
>The timestamp for an External is set by the method if it wants to, so that doesn't really count.

I'm not sure how I should interpret "doesn't really count" in this context. I think you mean your original response didn't address the External case, because you can't know what it does. But the expectation would still be that the value set should still represent the actual AuthnInstant, and so some External methods may have more variance than say, forms based LDAP from the IdP. Is that a correct interpretation?

(For purposes of this whole thread I'm ignoring the different situations where an IdP might report a "current" AuthnInstant when the user hasn't performed any actual interactive authentication action.)

Thanks!

--- Eric