<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Peter</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Fair point in that regard.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The IdP is SAML proxying to 365 (instead of using LDAP previously) - usually a lookup from IdP to 365 only takes place when a new browser session has been opened (e.g. restarting Edge after an update).</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If there is a setting that can make these SAML proxy lookups more frequent, that would be great to try.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We are running IdP v5.2.3 in case that makes a difference.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Dave</div>
<div id="Signature" class="elementToProof">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
_________________________________________________</div>
<table style="box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="padding: 0cm 5.4pt; vertical-align: top; width: 303.75pt; height: 96.45pt;">
<p class="elementToProof" style="line-height: 120%; margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Arial, sans-serif; font-size: 10pt;"><b>Dave Perry</b></span><span style="font-family: "Times New Roman", serif; font-size: 12pt;"><br>
</span><span style="font-family: Arial, sans-serif; font-size: 9pt;">Application Analyst
<b>| </b>Innovation & Technology Services<br>
<br>
York St John University </span></p>
<p class="elementToProof" style="line-height: 120%; margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Arial, sans-serif; font-size: 9pt;">Lord Mayor’s Walk, York, YO31 7EX<br>
T: +44(0)1904 876 0000<br>
</span><a href="mailto:d.perry1@yorksj.ac.uk" id="OWAd897a794-a813-500a-9712-4ec92cab14ee" class="OWAAutoLink" title="mailto:d.perry1@yorksj.ac.uk" style="margin-top: 0px; margin-bottom: 0px;">d.perry1@yorksj.ac.uk</a><span style="font-family: Arial, sans-serif; font-size: 9pt;">
<b>| </b><a href="http://www.yorksj.ac.uk/" id="OWA0b480e2c-00f6-18d2-aded-ecdd64fb868a" class="OWAAutoLink" style="margin-top: 0px; margin-bottom: 0px;">www.yorksj.ac.uk</a> </span></p>
</td>
</tr>
<tr>
<td style="padding: 0cm 5.4pt; vertical-align: top; width: 303.75pt; height: 74.7pt;">
<p class="elementToProof" style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;">
<span style="font-family: Arial, sans-serif; font-size: 12pt;"><b><img style="max-width: 100%; margin-top: 0px; margin-bottom: 0px;" size="12155" data-outlook-trace="F:1|T:1" src="cid:208e165d-3eb7-4560-ac78-6bdfb0082c0e"> </b></span></p>
</td>
</tr>
</tbody>
</table>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Peter Schober via users <users@shibboleth.net><br>
<b>Sent:</b> Thursday, September 17, 2026 10:01 AM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Cc:</b> Peter Schober <peter.schober@univie.ac.at><br>
<b>Subject:</b> Re: IdP > SP TImestamps older than 30 days</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.<br>
<br>
<br>
Dave Perry via users <users@shibboleth.net> [2026-09-17 10:38 CEST]:<br>
> > We've identified the cause of the access issue. Your identity<br>
> > provider (IdP) is sending authentication timestamps that are too<br>
> > old; for security reasons, our system only accepts timestamps no<br>
> > older than 30 days.<br>
><br>
> How on earth is this a thing? No other provider is complaining about<br>
> a timestamp difference, and our internal server team have confirmed<br>
> that our VMs have been time locked to our Domain Controllers (which<br>
> in turn are locked to JISC NTP sources).<br>
<br>
I read "authentication timestamps" as relating to the point in time<br>
when the subject initially authenticated (and then continuing to enjoy<br>
SSO without explicit authentication), not your IDP's clock.<br>
<br>
If so, I don't think it's unreasonable to reject assertions with an<br>
authentication event a month in the past. Are your SSO sessions really<br>
that long? Or could this be a misconfiguration of your IDP?<br>
<br>
-peter<br>
--<br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Cd.perry1%40yorksj.ac.uk%7Cc8ca0d0966024aa0f68708df149a4e9f%7C5c8ae38ef85b4309b7ec862815a37aee%7C0%7C0%7C639252325145182873%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=hyAYXYGRi83q8xp97OQswVy14NQ47chGSiCdhme5rJY%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>