Time skew issue?

[Peter Schober]

* Ernie Kinsey <Ernie.Kinsey at cpcc.edu> [2018-05-07 17:19]:
> I'm running into an issue wherein the AuthnInstant value is
> preceding the NotBefore value, and I'm working on the assumption
> (unconfirmed) that the app with which I'm integrating (Webex) won't
> authenticate because it thinks I'm asking for access before the
> ticket is valid.  For instance, I'm getting the following:
> 
> AuthnInstant = "2018-05-07T13:43:18.310Z"
> NotBefore    = "2018-05-07T13:43:18.932Z"
> NotOnOrAfter = "2018-05-07T13:48:18.932Z"
> 
> Which makes is look like I'm asking for access about 3/4 of a second
> too soon.

No, AuthnInstant is the time when you authenticated to the IDP.
With a long(er)-lived SSO session that could be hours before trying to
access a given SP.

NotBefore and NotOnOrAfter are from the Conditions element and
describe the Assertion validity period, i.e., when the SP should
accept the whole SAML Assertion.

None of that explains what happended, but the above misinterpretation
seems to be based on guessing (incorrectly assuming that AuthnInstant
would have to be within the values of NotBefore and NotOnOrAfter),
not on looking up those terms in the SAML spec,
https://www.oasis-open.org/committees/download.php/56776/sstc-saml-core-errata-2.0-wd-07.pdf

-peter