Yes, we can skew both. Please do create an issue. - Misagh
> On Nov 30, 2015, at 6:41 AM, Abhijit Gaikwad <[email protected]> wrote: > > > From: Abhijit Gaikwad > Sent: Tuesday, November 24, 2015 4:39 PM > To: [email protected] <mailto:[email protected]> > Subject: RE: [cas-user] CAS 4.1.1 Google Apps SAML issue > > Hello, > I saw the release of CAS 4.1.2 and tried using the skew allowance but it > still doesn’t work for me. I still get the your credentials have expired. I > noticed two things: > 1. Only one of the two NotOnOrAfter values get skewed. The other one is > still set to the current time. On our production setup CAS 3.5.1 both values > get increased by a year. I suspect that is the issue and may be you guys > could skew both? > <samlp:Status> > <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> > </samlp:Status> > <Assertion ID="<<skdjfskjsdfslkjlksjdlfjskd>>" > IssueInstant="2003-04-17T00:46:02.000Z" Version="2.0"> > <Issuer>https://www.opensaml.org/IDP</Issuer > <https://www.opensaml.org/IDP%3c/Issuer>> > <Subject> > <NameID > Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"><<personDetails>></NameID> > <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> > <SubjectConfirmationData > InResponseTo="<<somerandomstringlksjdlfkjsflksdjflks>>" > NotOnOrAfter="2015-11-24T15:39:00.000Z" > Recipient="https://www.google.com/a/<<mydomain>>/acs > <https://www.google.com/a/%3c%3cmydomain%3e%3e/acs>"/> > </SubjectConfirmation> > </Subject> > <Conditions NotBefore="2003-04-17T00:46:02.000Z" > NotOnOrAfter="2015-11-24T15:41:00.000Z"> > <AudienceRestriction> > <Audience>https://www.google.com/a/<<mydomain>>/acs</Audience > <https://www.google.com/a/%3c%3cmydomain%3e%3e/acs%3c/Audience>> > </AudienceRestriction> > </Conditions> > <AuthnStatement AuthnInstant="2015-11-24T15:39:00.000Z"> > <AuthnContext> > <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef> > </AuthnContext> > </AuthnStatement> > </Assertion> > </samlp:Response> > 2. The skew value is being subtracted from the current time. So instead > of adding say 2 seconds, 2 seconds get subtracted from current time. I am not > sure if that was the intended purpose, I got around that by adding a negative > skep in test (-120) > > Help will be greatly appreciated. > > Thanks, -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/.
