PE: Add guidance for implementers on clock skew

    • Hide

      Add text to Core, after line 314:
      "SAML system entities SHOULD allow for reasonable clock skew between systems when interpreting time instants and enforcing security policies based on them. Tolerances of 3-5 minutes are reasonable defaults, but allowing for configurability is a suggested practice in implementations."

      Add text to Core, after line 759:
      "As noted in section 1.3.3, relying parties SHOULD allow for reasonable clock skew in the interpretation of both values."

      Add text to Core, after line 887:
      "As noted in section 1.3.3, relying parties SHOULD allow for reasonable clock skew in the interpretation of both values."

      Add text to Core, at line 2538:
      "As noted in that same section, relying parties SHOULD allow for reasonable clock skew in the interpretation of this value."

      Show
      Add text to Core, after line 314: "SAML system entities SHOULD allow for reasonable clock skew between systems when interpreting time instants and enforcing security policies based on them. Tolerances of 3-5 minutes are reasonable defaults, but allowing for configurability is a suggested practice in implementations." Add text to Core, after line 759: "As noted in section 1.3.3, relying parties SHOULD allow for reasonable clock skew in the interpretation of both values." Add text to Core, after line 887: "As noted in section 1.3.3, relying parties SHOULD allow for reasonable clock skew in the interpretation of both values." Add text to Core, at line 2538: "As noted in that same section, relying parties SHOULD allow for reasonable clock skew in the interpretation of this value."
    • Show
      Accepted as proposed on TC call Nov 29th. http://lists.oasis-open.org/archives/security-services/201111/msg00044.html

      Some implementers are not clear on how to deal with clock skew issues when interpreting security-sensitive time values such as NotBefore or NotOnOrAfter attributes. We've been asked to include suggestions and guidance on this.

            Assignee:
            Scott Cantor (Inactive)
            Reporter:
            Scott Cantor (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved: