SAML: Document allowing a clock/time difference from IdP (#8731)

Updates the sample configuration with the pysaml2 configuration for accepting clock skew/drift between the homeserver and IdP.
matrix-org · Nov 18, 2020 · d356588 · d356588
1 parent b690542
commit d356588
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 0 deletions.
diff --git a/changelog.d/8731.misc b/changelog.d/8731.misc
@@ -0,0 +1 @@
+Add an example and documentation for clock skew to the SAML2 sample configuration to allow for clock/time difference between the homserver and IdP. Contributed by @localguru.
diff --git a/docs/sample_config.yaml b/docs/sample_config.yaml
@@ -1546,6 +1546,12 @@ saml2_config:
     #  remote:
     #    - url: https://our_idp/metadata.xml
 
+    # Allowed clock difference in seconds between the homeserver and IdP.
+    #
+    # Uncomment the below to increase the accepted time difference from 0 to 3 seconds.
+    #
+    #accepted_time_diff: 3
+
     # By default, the user has to go to our login page first. If you'd like
     # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
     # 'service.sp' section:

diff --git a/synapse/config/saml2_config.py b/synapse/config/saml2_config.py
@@ -256,6 +256,12 @@ def generate_config_section(self, config_dir_path, server_name, **kwargs):
             #  remote:
             #    - url: https://our_idp/metadata.xml
 
+            # Allowed clock difference in seconds between the homeserver and IdP.
+            #
+            # Uncomment the below to increase the accepted time difference from 0 to 3 seconds.
+            #
+            #accepted_time_diff: 3
+
             # By default, the user has to go to our login page first. If you'd like
             # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
             # 'service.sp' section: