Limits of Clock‑Skew Tolerance in SAML Assertion Validation

Recommended Clock-Skew Limits

For a typical SAML 2.0 federation, a clock-skew tolerance of 2 to 3 minutes is the recommended safe upper bound. This window effectively absorbs standard NTP drift and synchronization jitter across disparate infrastructure without excessively widening the window for replay attacks.

Implementation Standards

The SAML 2.0 Core specification requires that assertions be valid only between the NotBefore and NotOnOrAfter timestamps. Because the specification does not define a mandatory skew allowance, implementations should adhere to the following logic:

• UTC Enforcement: Validation libraries must use UTC wall-clock time. SAML timestamps use the XML Schema dateTime format (typically denoted by "Z"). Comparing these to a local system clock without UTC conversion creates failures during daylight-saving transitions or across different time zones.
• Leap-Second Handling: No specialized logic is required. Since most operating systems handle leap seconds via smearing or repetition, a one-second discrepancy is naturally absorbed by a 1–5 minute skew tolerance.
• Security Trade-off: Avoid exceeding a 5-minute tolerance. Increasing this limit significantly extends the validity of a stolen assertion, increasing the risk of successful replay attacks.

Verification and Testing

Library defaults vary—for example, OpenSAML often defaults to zero skew, while Shibboleth SP may default to 180 seconds. Use these steps to verify your active configuration:

1. Configuration Audit: Locate the specific skew property in your framework (e.g., clockSkew in Spring SAML or the clockSkew attribute in Shibboleth).
2. Boundary Test: Generate an assertion with a NotOnOrAfter value set to 60 seconds in the past. If the assertion is rejected, your current tolerance is less than one minute.
3. Offset Test: Artificially shift the Service Provider (SP) system clock by 2 minutes and confirm that assertions from the Identity Provider (IdP) are still accepted.

Diagnostic Requirement: To provide a specific configuration key, please specify the SAML library and version in use, as parameters differ significantly between frameworks.