<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>What is the max time devaiation that Shib allows? They are running Shib it seems.</span></div><div><br></div> <div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Christopher Bongaarts <cab@umn.edu><br> <b><span style="font-weight: bold;">To:</span></b> users@shibboleth.net <br> <b><span style="font-weight: bold;">Sent:</span></b> Friday, January 18, 2013 9:26 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Internation dateline issue<br> </font> </div> <br>
On 1/18/2013 8:52 AM, Cantor, Scott wrote:<br>> On 1/18/13 9:10 AM, "Mike Flynn" <<a ymailto="mailto:shibbolethlynda@yahoo.com" href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:<br>><br>>> I'll gather more info from these guys. They sent me a message stating<br>>> that the date was an issue and gave me this error message:<br>>><br>>> <a target="_blank" href="http://org.opensaml.ws.security.se/">org.opensaml.ws</a>.security.SecurityPolicyException:<br>>> Message was rejected due to issue instant expiration<br>><br>> Well, that's OpenSAML, but not necessarily Shibboleth. And could be<br>> nothing more than their clock being off.<br>><br>> I don't really see how a bug that obvious would have gone unnoticed all<br>> this time, it would suppose that nobody with an IdP in Australia ever used<br>> an SP in the US, which beggars belief.<br><br>One explanation is if
their timezone is set wrong on their server, which <br>would result in incorrect GMT times being sent in the SAML assertion. <br>One could use SAML Tracer or turn up debugging to show the raw SAML <br>assertion in logs to see what they are actually sending.<br><br>-- <br>%% Christopher A. Bongaarts %% <a ymailto="mailto:cab@umn.edu" href="mailto:cab@umn.edu">cab@umn.edu</a> %%<br>%% OIT - Identity Management %% http://umn.edu/~cab %%<br>%% University of Minnesota %% +1 (612) 625-1809 %%<br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br> </div> </div> </div></body></html>