IdP and SP clock tolerance

[Paul Fardy]

Hi,

We have an SP that's rejecting our SAML responses, apparently due to clock differences. The SP uses Unsolicited SAML requests, so I cannot see a SAML AuthnRequest and, thus far, I have no means of checking the SP's clock. The SP suggests that we set our NotBefore time back a minute. They offer an ADFS recipe:

Set-ADFSRelyingPartyTrust -TargetIdentifier "$entityID" -NotBeforeSkew 1

and it's interesting that this ADFS feature exists.

But we're running Shibboleth, so that doesn't help us. And I don't think our system is the problem. Our servers appear to be within milliseconds of Stratus1 NTP servers. The clocks match time.gov and time.apple.com within a second.

But I wonder what the NotBefore tolerance is. We usually see that security data is valid for a few minutes with most protocols (e.g. NotOnOrAfter=(now + 5 minutes)), but what about NotBefore? How many seconds difference is permitted? If an SP is 5 seconds behind the IdP, will that break logins? Is it tunable?

Thanks,

Paul
--
Paul Fardy, Shib Admin, Info Security, ITS
University of Toronto
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20201006/2fd79408/attachment.htm>