<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi All,<br>
<br>
We are implementing local weblogic SPs. After many trials we have
finally succeeded with authentication, most of the time. The issue
is that our SPs are receiving the response before it is valid, ie.
the not-before timestamp is in the future. Our servers are running
on windows, and Windows Time Services don't cut the mustard. We
have installed real NTP services and brought tolerances down to
acceptable levels where the probability of a failure is very low,
but not zero. Weblogic, I mean Oracle, has settings for time skew
in their IdP impl, not there SP impl. I know that shib's SP allows
for such a skew and I completely agree that this setting belongs in
the SP, but is there anything in the SAML 2.0 specification that
hints to such a practice. Oracle is taking a stance that they are
SAML 2.0 compliant and this functionality would be a feature
request, but if I had the spec behind me, I might be able to get it
in as a defect and have a quicker time to implementation.<br>
<br>
Thanks in advance,<br>
<br>
- Joe<br>
<br>
<div class="moz-signature">-- <br>
<span style="font-family: monospace;">
Joseph Valerio<br>
<br>
Senior Solution Architect<br>
<br>
Yale University<br>
Shared Solution Group<br>
Information Technology Services<br>
<br>
phone: 203-432-1196<br>
email: <a class="moz-txt-link-abbreviated" href="mailto:joseph.valerio@yale.edu">joseph.valerio@yale.edu</a><br>
smail: 25 Science Park, New Haven, CT 06511<br>
</span>
</div>
</body>
</html>