Clock Drift and NotBefore

We are frequently seeing SAML response validation errors when the SP clock becomes out of sync with the IdP. Many other libraries have exposed some sort of acceptedClockSkew field in order to handle this case.

Are there any plans to update the library to handle clock skew (it should be a fairly small change) / are there any ways to disable validation, so we can perform it manually?

Example:

• notBefore_skew in saml2-js

See similar issues:

• https://github.com/onelogin/ruby-saml/issues/17

[tngan]

@keerthivasan-r Usually the expiration time for saml response is around 5 minutes to 10 minutes, the clock skew for notAfter is actually useless in this case, because the notBefore check is relatively close to the issued time of response.

UPDATE: this feature will be implemented and included in the next patch release

notBeforeSkew would be a number instead of a boolean

[fas3r]

Hello @tngan ,

Im sorry to ask here but as it’s related I can open a new issue if you want.

I dont know if you remember but I wrote the okta article and at that time I was still using the 2.5 and I just migrated to 2.7.1.

However now I’m getting the warning You intend to have time validation however the document doesn't include the valid range

I checked in the okta application and I dont see how to set NotBefore and notAfter. Is it something that I need to create on my own with the template & attribute ?

I’m using the import * as validator from '@authenio/samlify-xsd-schema-validator'; by default.

Thanks