What is the correct AuthnInstant value for a proxy IdP

[Stefan Santesson]

Thanks Scott,

I’v seen but totally forgot about that option.
That means that my original assessment stands and that we are in full agreement about that.

/Stefan




On 09/11/15 15:47, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>On 11/8/15, 8:11 PM, "users on behalf of Stefan Santesson" <users-bounces at shibboleth.net on behalf of stefan at aaa-sec.com> wrote:
>
>
>
>>Just after writing this I realise that what I suggested won’t fly in my own implementation.
>>In my proxy IdP I use a standard Shib V3 IdP to perform the IdP part, while the SP part of the proxy is running as an external Authn servlet. And I don’t think there is any way I could forward the upstream AuthnInstant value to Shibboleth IdP anyway from the ExternalAuthn servlet.
>
>That’s entirely possible [1].
>
>And yes, it’s exactly correct to be maintaining the timestamp across the entire sequence.
>
>-- Scott
>
>[1] https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAuthnConfiguration
>
>-- 
>To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net