Limits of Clock‑Skew Tolerance in SAML Assertion Validation

Goal

Validate SAML 2.0 assertions in a federation where IdP and SP clocks may drift.

Constraints

The SAML 2.0 Core (2005) mandates that an assertion is invalid if the current time falls outside the NotBefore and NotOnOrAfter window. However, the specification does not prescribe a specific clock‑skew allowance or define the “system time” that validators must use. Libraries often default to zero skew, while production deployments typically configure 1–5 minute tolerances to accommodate NTP drift. Additionally, leap‑second handling and UTC versus local‑time interpretation remain unspecified, leading to interoperability failures when IdP and SP use different time sources.

Unresolved Questions

1. What upper bound for clock‑skew tolerance should be considered safe for a typical SAML federation?
2. Should validation libraries enforce UTC wall‑clock time, or can they rely on local system clocks?
3. How should implementations accommodate leap‑second events without invalidating otherwise valid assertions?