I’m curious to know what the use case would be where one would want to subtract a skew value. I’ll go ahead and create an issue for update the other NotOnOrAfter value.
Thanks, --- Abhijit Gaikwad Applications Programmer | [email protected]<mailto:[email protected]> From: [email protected] [mailto:[email protected]] On Behalf Of Misagh Moayyed Sent: Monday, November 30, 2015 10:08 AM To: [email protected] Subject: Re: [cas-user] CAS 4.1.1 Google Apps SAML issue Yes, we can skew both. Please do create an issue. - Misagh On Nov 30, 2015, at 6:41 AM, Abhijit Gaikwad <[email protected]<mailto:[email protected]>> wrote: From: Abhijit Gaikwad Sent: Tuesday, November 24, 2015 4:39 PM To: [email protected]<mailto:[email protected]> Subject: RE: [cas-user] CAS 4.1.1 Google Apps SAML issue Hello, I saw the release of CAS 4.1.2 and tried using the skew allowance but it still doesn’t work for me. I still get the your credentials have expired. I noticed two things: 1. Only one of the two NotOnOrAfter values get skewed. The other one is still set to the current time. On our production setup CAS 3.5.1 both values get increased by a year. I suspect that is the issue and may be you guys could skew both? <samlp:Status> <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> </samlp:Status> <Assertion ID="<<skdjfskjsdfslkjlksjdlfjskd>>" IssueInstant="2003-04-17T00:46:02.000Z" Version="2.0"> <Issuer>https://www.opensaml.org/IDP</Issuer<https://www.opensaml.org/IDP%3c/Issuer>> <Subject> <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"><<personDetails>></NameID> <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <SubjectConfirmationData InResponseTo="<<somerandomstringlksjdlfkjsflksdjflks>>" NotOnOrAfter="2015-11-24T15:39:00.000Z" Recipient="https://www.google.com/a/<<mydomain>>/acs<https://www.google.com/a/%3c%3cmydomain%3e%3e/acs>"/> </SubjectConfirmation> </Subject> <Conditions NotBefore="2003-04-17T00:46:02.000Z" NotOnOrAfter="2015-11-24T15:41:00.000Z"> <AudienceRestriction> <Audience>https://www.google.com/a/<<mydomain>>/acs</Audience<https://www.google.com/a/%3c%3cmydomain%3e%3e/acs%3c/Audience>> </AudienceRestriction> </Conditions> <AuthnStatement AuthnInstant="2015-11-24T15:39:00.000Z"> <AuthnContext> <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef> </AuthnContext> </AuthnStatement> </Assertion> </samlp:Response> 2. The skew value is being subtracted from the current time. So instead of adding say 2 seconds, 2 seconds get subtracted from current time. I am not sure if that was the intended purpose, I got around that by adding a negative skep in test (-120) Help will be greatly appreciated. Thanks, -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]<mailto:[email protected]>. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/. -- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. Visit this group at http://groups.google.com/a/apereo.org/group/cas-user/.
