Shibboleth SP 500 after processing valid SAML response and assertion

[Cantor, Scott]

On 10/1/18, 8:46 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

> The AuthnInstant is not going to matter to the SP unless it's told to look at it, so that wasn't the issue

Unless it was in the future. I forgot that it checked for that. I assume it was forward an hour. If it's future-dated, it won't accept it, and it tracks that as a message and throws an exception with that error message in it.

It just didn't log it where you looked, but most of those error paths are rare and have been getting plugged gradually if they're not getting logged on that side of the system. A few are still probably leaking out and they would show up in native.log / Event Log and in the browser unless the web server is broken (i.e. IIS) and deliberately configured to hide the errors.

But yes, that will fail the login as it turns out, my mistake initially.

-- Scott