<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br><div><div>On 19 Nov 2012, at 12:08, C G <<a href="mailto:ci_98yr@yahoo.com">ci_98yr@yahoo.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div><div style="background-color: rgb(255, 255, 255); font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; position: static; z-index: auto; "><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; ">Before 'go further,</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; background-color: transparent; font-style: normal; ">let me mention, ' _do not (or prefer)_ have control on setting the clock </div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; background-color: transparent; font-style: normal; ">on
shib idp server</div></div></div></blockquote><div><br></div><div>You can't do networked security without accurate clocks. You need to get the clock on the IdP server set correctly. It doesn't need to be within milliseconds, but it does need to be in the ballpark and more importantly it needs to be actively kept that way. Every modern OS has something built-in to do this, you just need to turn it on.</div><br><blockquote type="cite"><div><div style="background-color: rgb(255, 255, 255); font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; position: static; z-index: auto; "><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; background-color: transparent; font-style: normal; ">, nor 'control the sp's time zone which are <span style="background-color: transparent; ">in a different timezone.</span></div></div></div></blockquote><div><br></div><div>Time zone does not matter, because all times in SAML messages are expressed in UTC.</div><div><br></div><blockquote type="cite"><div><div style="background-color: rgb(255, 255, 255); font-family: 'times new roman', 'new york', times, serif; font-size: 12pt; position: static; z-index: auto; "><div style="background-color: transparent; font-size: 16px; font-family: 'times new roman', 'new york', times, serif; font-style: normal; "><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; font-style: normal; ">Is there a way that 'can tweak the idp config? Any security issues? Is there some valve that 'can turn on to get the message timestamp</div><div style="font-family: 'times new roman', 'new york', times, serif; font-size: 16px; font-style: normal; ">translated into (mapped) to idp server timestamp so it maps and gets correctly interpreted?</div></div></div></div></blockquote><div><br></div><div>Just fix the IdP clock and everything will work.</div><div><br></div><div><span class="Apple-tab-span" style="font-size: 12px; white-space: pre; "> </span><span style="font-size: 12px; ">-- Ian</span></div></div><div apple-content-edited="true"><span class="Apple-style-span" style="border-collapse: separate; border-spacing: 0px; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><span class="Apple-style-span" style="font-size: medium; "><br></span></div></span></span><br class="Apple-interchange-newline">
</div>
<br></body></html>