NotBefore attribute in the IdP

[Niva Agmon]

Hello,

After  a recent clock drift in one of the idp nodes that caused some applications to fail (specifically the Casified Banner and an adobe SAML integration), we are looking to better understand the need  for the NotBefore attribute being set by the Idp and to possibly disable it.

Are there any specific security considerations beyond forcing a valid time frame for the assertion?

I know that there was a way to disable NotBefore in v2.4, but am not sure if it was kept in idpv3.x, and whether it could be disabled for specific RPs.

Any tips or suggestions would be greatly appreciated!

Thanks,
Niva
Niva Agmon
Temple University

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190319/e1793d81/attachment.html>