IdP and SP clock tolerance

[Cantor, Scott]

On 10/6/20, 3:09 PM, "users on behalf of Paul Fardy" <users-bounces at shibboleth.net on behalf of paul.fardy at utoronto.ca> wrote:

>    We have an SP that's rejecting our SAML responses, apparently due to clock differences. The SP uses Unsolicited SAML >requests, so I cannot see a SAML AuthnRequest and, thus far, I have no means of checking the SP's clock.

Modulo web site architecture, curl -i to examine the header from the server. It's usually a decent hint.

Clock skew is, by definition, the message recipient's responsibility, not the sender's. If it had occurred to anybody writing the standard that this was ever in question, we would have said so.

-- Scott