NotBefore attribute in the IdP

[Niva Agmon]

Thanks for your answers, Nate and Scott.
I was pretty much  thinking along these lines, but wanted to confirm. 

We ended up updating the ntp configuration on the Shib nodes to look at multiple time sources and also enhanced our monitoring.

Niva

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, March 18, 2019 9:29 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: NotBefore attribute in the IdP

> You'll need to stick this in a RelyingParty element dedicated to any 
> SP that would break, and as the Wiki page notes, this really isn't the 
> right fix for the problem.  The right fix would be to ensure that the clock doesn't drift again.

You can't fix a broken SP by managing your own clock, it's their bug. Some drift is always going to happen.
 
These features are there to temporarily work around simple bugs while they get fixed.
 
-- Scott

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net