<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">It is optional in the SAML standard (NotBefore), and in fact, I pushed for a way to "turn it off" (and helped get it added) to Shib 2.4, because we were having a problem with a vendor who similarly was not allowing any skew factor. Even adjusting the standard time source we were syncing to to the same they were synced to did not ensure the problem would not occur. Because all it takes is one millisecond off and it didn't work.<div class=""><br class=""></div><div class="">So no, you are not really "losing" security. There are still plenty of timestamps to assess and constrain things in the assertions, so as long as they are doing other things correctly, you are ok.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Dec 14, 2017, at 12:40 PM, d.alvarez2 <<a href="mailto:d.alvarez2@miami.edu" class="">d.alvarez2@miami.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi,<br class=""><br class="">I have a question regarding the NotBefore in the Assertion.<br class="">One of our appliations is not working because the application does require<br class="">the NotBefore and the servers (SP and IdP) are not in synch. We have tried<br class="">to set a synch between our servers but nothing works.<br class=""><br class="">now, the vendor is advising we turn off option 'includeConditionsNotBefore'<br class="">(set it to false) in order to be able to authenticate and get rid of the<br class="">clock skew error that presently is happening. THey will not work on the fix<br class="">(to allow a time window for the clock skew until 6 months from now) until<br class="">months from now. <br class="">However, they suggest for the time being, we could turn it off and them not<br class="">require it. <br class="">However, what are the repercussions of doing this? We could temporarily turn<br class="">it off and not send the NotBefore in the assertion, but is that something<br class="">we, as the IdP, should be concern about if we do this? <br class=""><br class="">Thank you,<br class=""><br class="">Dyana<br class=""><br class=""><br class=""><br class="">--<br class="">Sent from: <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html" class="">http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html</a><br class="">-- <br class="">For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">users-unsubscribe@shibboleth.net</a><br class=""><br class="">----------<br class=""><br class="">This email has been scanned for spam and viruses by Proofpoint Essentials. Visit the following link to report this email as spam:<br class=""><a href="https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1513276872-UxQEv1gTvrBJ&r_address=mgrady%40unicon.net&report=1" class="">https://us2.proofpointessentials.com/index01.php?mod_id=11&mod_option=logitem&mail_id=1513276872-UxQEv1gTvrBJ&r_address=mgrady%40unicon.net&report=1</a><br class=""></div></div></blockquote></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>