I asked Dale if it worked fine for him. Its not clear from his email if he tried it or if he was aware of it.
Switching the logic from the clients accounting to server drift (which in theory is only accounting for the drift of ~ two machines) to the server attempting to account for the potential drift of all clients doesn't really solve the issue. It just means you make the validity range valid before it was issued (which I'm pretty sure you probably shouldn't do) to potentially way after its intended lifetime in order to account for the multitude of clients. Ultimately its the client that is concerned with the validity of the assertion. Any client configuration to loosen restrictions around validation only affects the trust between the client and the server, whereas a change to the server configuration impacts all clients, whether they wanted it or not. On Tue, Jun 15, 2010 at 10:03 AM, Marvin Addison <[email protected]>wrote: > > Tolerance is configurable in the Java client. Is that not working? It > > should be applied to both the begin and after time. > > Works fine. The suggestion on the table is to move tolerance to the > server to avoid having to account for clock drift in each client. > > M > > -- > You are currently subscribed to [email protected] as: > [email protected] > To unsubscribe, change settings or access archives, see > http://www.ja-sig.org/wiki/display/JSG/cas-dev > > -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
