<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>OK, the customer in AU (University of the Sunshine Coast) is running Shibboleth. I had them try both SP and Idp initiated...</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; background-color: transparent; font-style: normal;"><span><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.571428298950195px;">When service started at the SP, their Shibboleth IDP threw the error below:</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.571428298950195px;"><br></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size:
12.571428298950195px;"><b>org.opensaml.ws.security.<wbr>SecurityPolicyException: Message was rejected due to issue instant expiration</b><br></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.571428298950195px;"><b><br></b></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.571428298950195px;">An IDP initiated attempt produced the error below:</div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.571428298950195px;"><br></div><div style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: 12.571428298950195px;"><div><b>07:23:11.330 - WARN [edu.internet2.middleware.<wbr>shibboleth.idp.profile.saml2.<wbr>SSOProfileHandler:348] - Message did not meet security requirements</b></div><div><b>org.opensaml.ws.security.<wbr>SecurityPolicyException: Validation of request simple signature failed for context
issuer</b></div></div></span></div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: arial, helvetica, sans-serif; background-color: transparent; font-style: normal;">He has the same 3 minute window that I use on my server. I have asked if they connect to any other SPs on this side of the dateline - Nighttime there now so I won't hear anything until tomorrow. Just thought I would throw this up here again in case anyone had any insight on it.</div> <div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Mike Flynn <shibbolethlynda@yahoo.com><br> <b><span style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b>
Friday, January 18, 2013 10:34 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Internation dateline issue<br> </font> </div> <br>
<div id="yiv884367197"><div><div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><div><span>Thanks, Scott.</span></div><div><br></div> <div style="font-family: arial, helvetica, sans-serif; font-size: 12pt;"> <div style="font-family: 'times new roman', 'new york', times, serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> "Cantor, Scott" <cantor.2@osu.edu><br> <b><span style="font-weight:bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight:bold;">Sent:</span></b> Friday, January 18, 2013 10:28 AM<br> <b><span style="font-weight:bold;">Subject:</span></b> Re: Internation dateline issue<br> </font> </div> <br>
On 1/18/13 12:55 PM, "Mike Flynn" <<a rel="nofollow" ymailto="mailto:shibbolethlynda@yahoo.com" target="_blank" href="mailto:shibbolethlynda@yahoo.com">shibbolethlynda@yahoo.com</a>> wrote:<br><br>>What is the max time devaiation that Shib allows? They are running Shib<br>>it seems.<br><br>Defaults to 3 minutes on the SP, I think the IdP is the same.<br><br>-- Scott<br><br><br>--<br>To unsubscribe from this list send an email to <a rel="nofollow" ymailto="mailto:users-unsubscribe@shibboleth.net" target="_blank" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br><br> </div> </div> </div></div></div><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br> </div> </div> </div></body></html>