Richard, We got bit by this when we upgraded from CAS 5.0.x to CAS 5.1.3. It was fixed in CAS v5.1.5. We also couldn't risk an upgrade at the time, but a service provider was down. The SP was capable of integrating using SAML2, though, and we run our Shibboleth IdP and CAS services as separate services (our IdP does delegate authentication to CAS, but the attribute release and SAML response are generated by Shib).
One thought I had which wasn't possible with our deployment was that if you are proxying the service (e.g. behind NGINX or Apache), you could use some kind of content re-writing rule to set the valid window to wide open. Many of our SAML1.0 CAS clients don't check the window anyway, but we did notice a few newer clients that got bit by this bug. Thanks, Carl Waldbieser ITS Identity Management Lafayette College ----- Original Message ----- From: "Richard Frovarp" <[email protected]> To: "cas-user" <[email protected]> Sent: Thursday, October 26, 2017 2:21:58 PM Subject: [cas-user] SAML2 NotOnOrAfter issues We're having problems with a vendor using SAML2. They are rejecting the message because the NotOnOrAfter time has been surpassed. Looking at the full message they sent me, it looks like a bug? <saml2p:Response Consent=\"urn:oasis:names:tc:SAML:2.0:consent:unspecified\" Destination=\"https://ndsu.kanbantool.com/saml/complete\"; ID=\"_3256076461702895080\" InResponseTo=\"_b129e75e-067b-47ea-b3fe-be269af5bd53\" IssueInstant=\"2017-10-23T13:46:58.554Z\" Version=\"2.0\" xmlns:saml2p=\"urn:oasis:names:tc:SAML:2.0:protocol\" xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\";> <saml2:SubjectConfirmationData InResponseTo=\"_b129e75e-067b-47ea-b3fe-be269af5bd53\" NotOnOrAfter=\"2017-10-23T13:46:58.549Z\" Recipient=\"https://example.com/saml/complete\"/> There is a decent chance I don't quite know what I'm looking at. However, the issue instant is after the expiration time. That seems a bit wrong. This is CAS 5.1.1. I don't have any easy method of upgrading and retesting at this instant. I see these two values, and it seems like I may be able to change one of them, but what they mean isn't exactly clear. I haven't changed any of the values off of default. cas.samlCore.skewAllowance=5 cas.samlCore.issueLength=30 Anyone have any ideas? Thanks, Richard -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/e4c55d1b-3314-6ef6-4d05-47ed1bbd1f05%40ndsu.edu. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/157693229.18510959.1509047088570.JavaMail.zimbra%40lafayette.edu.
