We're having problems with a vendor using SAML2. They are rejecting the
message because the NotOnOrAfter time has been surpassed. Looking at the
full message they sent me, it looks like a bug?
<saml2p:Response
Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\"
Destination=\"https://ndsu.kanbantool.com/saml/complete\";
ID=\"_3256076461702895080\"
InResponseTo=\"_b129e75e-067b-47ea-b3fe-be269af5bd53\"
IssueInstant=\"2017-10-23T13:46:58.554Z\" Version=\"2.0\"
xmlns:saml2p=\"urn:oasis:names:tc:SAML:2.0:protocol\"
xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\";>
<saml2:SubjectConfirmationData
InResponseTo=\"_b129e75e-067b-47ea-b3fe-be269af5bd53\"
NotOnOrAfter=\"2017-10-23T13:46:58.549Z\"
Recipient=\"https://example.com/saml/complete\"/>
There is a decent chance I don't quite know what I'm looking at.
However, the issue instant is after the expiration time. That seems a
bit wrong.
This is CAS 5.1.1. I don't have any easy method of upgrading and
retesting at this instant.
I see these two values, and it seems like I may be able to change one of
them, but what they mean isn't exactly clear. I haven't changed any of
the values off of default.
cas.samlCore.skewAllowance=5
cas.samlCore.issueLength=30
Anyone have any ideas?
Thanks,
Richard
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/e4c55d1b-3314-6ef6-4d05-47ed1bbd1f05%40ndsu.edu.
