NotBefore attribute in the IdP

[Nate Klingenstein]

Niva,

> Are there any specific security considerations beyond forcing a valid time frame for the assertion?

It depends on your use case, like always, but in virtually all situations, no.

> I know that there was a way to disable NotBefore in v2.4, but am not sure if it was kept in idpv3.x, and whether it could be disabled for specific RPs.

For SAML, yes:

https://wiki.shibboleth.net/confluence/display/IDP30/ProfileConfiguration-SAML

For CAS, I'm not sure, but probably not:

https://wiki.shibboleth.net/confluence/display/IDP30/CasProtocolConfiguration

You'll need to stick this in a RelyingParty element dedicated to any SP that would break, and as the Wiki page notes, this really isn't the right fix for the problem.  The right fix would be to ensure that the clock doesn't drift again.

Hope this helps,
Nate.