NotBefore condition in assertions

[Michael A Grady]

It is optional in the SAML standard (NotBefore), and in fact, I pushed for a way to "turn it off" (and helped get it added) to Shib 2.4, because we were having a problem with a vendor who similarly was not allowing any skew factor. Even adjusting the standard time source we were syncing to to the same they were synced to did not ensure the problem would not occur. Because all it takes is one millisecond off and it didn't work.

So no, you are not really "losing" security. There are still plenty of timestamps to assess and constrain things in the assertions, so as long as they are doing other things correctly, you are ok.

> On Dec 14, 2017, at 12:40 PM, d.alvarez2 <d.alvarez2 at miami.edu> wrote:
> 
> Hi,
> 
> I have a question regarding the NotBefore in the Assertion.
> One of our appliations is not working because the application does require
> the NotBefore and the servers (SP and IdP) are not in synch. We have tried
> to set a synch between our servers but nothing works.
> 
> now, the vendor is advising we turn off option 'includeConditionsNotBefore'
> (set it to false) in order to be able to authenticate and get rid of the
> clock skew error that presently is happening.  THey will not work on the fix
> (to allow a time window for the clock skew until 6 months from now) until
> months from now.
> However, they suggest for the time being, we could turn it off and them not
> require it.
> However, what are the repercussions of doing this? We could temporarily turn
> it off and not send the NotBefore in the assertion, but is that something
> we, as the IdP, should be concern about if we do this?
> 
> Thank you,
> 
> Dyana
> 
> 
> 
> --
> Sent from: http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> ----------
> 
> This email has been scanned for spam and viruses by Proofpoint Essentials. Visit the following link to report this email as spam:
> https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1513276872-UxQEv1gTvrBJ&r_address=mgrady%40unicon.net&report=1

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171214/8fceb4f0/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 874 bytes
Desc: Message signed with OpenPGP
URL: <http://shibboleth.net/pipermail/users/attachments/20171214/8fceb4f0/attachment-0001.sig>