What is the correct AuthnInstant value for a proxy IdP

[Cantor, Scott]

On 11/8/15, 8:11 PM, "users on behalf of Stefan Santesson" <users-bounces at shibboleth.net on behalf of stefan at aaa-sec.com> wrote:



>Just after writing this I realise that what I suggested won’t fly in my own implementation.
>In my proxy IdP I use a standard Shib V3 IdP to perform the IdP part, while the SP part of the proxy is running as an external Authn servlet. And I don’t think there is any way I could forward the upstream AuthnInstant value to Shibboleth IdP anyway from the ExternalAuthn servlet.

That’s entirely possible [1].

And yes, it’s exactly correct to be maintaining the timestamp across the entire sequence.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAuthnConfiguration