IdP and SP clock tolerance

[Cantor, Scott]

On 10/6/20, 4:34 PM, "users on behalf of Paul Fardy" <users-bounces at shibboleth.net on behalf of paul.fardy at utoronto.ca> wrote:

>    Isn’t some tolerance acceptable, if not valuable?

Yes, that's why it's required of the recipient.

> If I’m running an SP with Discovery Service and one IdP happens to be N seconds fast, how might I address that? The
> right thing is for the IdP to fix its clock. But an SP “fix” might be expedient and, therefore, valuable.

The Shibboleth SP defaults to 3 minutes of allowance, as does the IdP.

>    From the IdP perspective, the ADFS option seems like a hack, except setting notBefore=(now - 4 seconds) seems useful
> and not unreasonable.

All you've done is move the problem 4 seconds off. Then what?

-- Scott