rohe/pysaml2 — pull request #105 by krgo (2014-04-03 09:03:24+00:00)
Title: Corrected time check on response

The accepted clock skew can be configured in configuration file
parameter “accepted_time_diff”. The 1-day offset was a leftover from
testing.
Additionally, added some error handling code to return a clear message
if constraint is not met.

Another thing that came to my attention is the fact that actually, the time window in which a response is accepted is double the size that was configured in the config. The accepted period has a deviation from "accepted_time_diff" in each direction (earlier and later) when compared to the time on the receiving machine.

Two solutions come to mind: either update the documentation to reflect this or divide the self.timeslack parameter (response.py, line 364 and 366) by two, rounding to the nearest integer.

What is your opinion?

Kind regards,
Kristof Goossens