<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">We have three application environments, all running RHEL 6, Apache 2.4 and Shibboleth 2.5.4. Two of them work correctly, but In one of our environments we’re getting this exception when the IDP POSTs the assertion:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;text-autospace:none">
<b><span style="font-size:16.0pt;font-family:"Times New Roman",serif">opensaml::SecurityPolicyException</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif">The system encountered an error at Wed Jul 1 15:23:19 2015</span><o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">To report this problem, please contact the site administrator at <a href="mailto:xxxxxxxx@xxxxxxxxxx.com">xxxxxxxx@xxxxxxxxxx.com</a></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif">Please include the following message in any email:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif">opensaml::SecurityPolicyException at (https://xxxxxxxxxx.com/Shibboleth.sso/SAML2/POST)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;text-autospace:none">
<b><span style="font-size:12.0pt;font-family:"Times New Roman",serif;color:red">Message expired, was issued too long ago.</span><span style="color:red"><o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The hosting provider insists the clocks on all servers are synched using NTP.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In the shibd.log file we see this:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:2.0pt;margin-right:0in;margin-bottom:2.0pt;margin-left:0in;text-autospace:none">
<b><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:red">2015-07-01 14:42:53 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [1]: rejected expired message, timestamp (1435761510), oldest allowed (1435761533)</span><span style="color:red"><o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When we convert the epoch values, our assertion timestamp is “Wed, 01 Jul 2015 14:38:<span style="color:red">30</span> GMT” and the oldest allowed is “Wed, 01 Jul 2015 14:38:<span style="color:red">53
</span>GMT.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We temporarily worked around this by changing the clockSkew setting in shibboleth2.xml to 7200 seconds, but I’d like to understand what is causing this, because it looks the time values are well within the default skew setting of 180 seconds.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any thoughts?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="margin-left:5.4pt;border-collapse:collapse">
<tbody>
<tr>
<td width="163" valign="top" style="width:1.7in;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
</td>
<td width="216" valign="top" style="width:2.25in;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
</td>
</tr>
<tr>
<td width="163" valign="top" style="width:1.7in;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="color:#1F497D"><img border="0" width="146" height="159" id="Picture_x0020_1" src="cid:image001.png@01D0B3EC.FE757A30" alt="cid:image001.png@01D01537.F005A230"><o:p></o:p></span></p>
</td>
<td width="216" valign="top" style="width:2.25in;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal"><span style="color:#1F497D"><br>
</span><b><span style="font-size:12.0pt;color:#1F497D">James W. Anderson<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="color:#1F497D">Cloud Infrastructure Architect<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The Coca-Cola Company<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">404.676.4914 Office<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">770.653.1033 Mobile<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">404.598.4914 Fax<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><a href="mailto:jamesanderson@coca-cola.com"><span style="color:blue">jamesanderson@coca-cola.com</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
CONFIDENTIALITY NOTICE<br>
NOTICE: This message is intended for the use of the individual or entity to which it is addressed and may contain information that is confidential, privileged and exempt from disclosure under applicable law. If the reader of this message is not the intended
recipient, you are hereby notified that any printing, copying, dissemination, distribution, disclosure or forwarding of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and delete
it from your system. Thank You.<br>
</font><br>
<hr>
<font face="Arial" color="Black" size="2"><br>
</font>
</body>
</html>