IDP initiated SSO. Is it possible to set the DateTime to Pacific instead of Zulu? By default, the SAML response has the date time set to Zulu.
<samlp:Response ID=“_fc4302bf-8145-4310-aa3e-6e3fe577a11b” Version=“2.0” IssueInstant=“2015-10-01T20:49:08.938Z” …>
…<saml:Assertion Version=“2.0” ID=“_016b247e-ecba-40ad-af9c-9240875e7317” IssueInstant=“2015-10-01T20:49:08.941Z” xmlns:saml=“urn:oasis:names:tc:SAML:2.0:assertion”>
…<saml:Conditions NotBefore=“2015-10-01T20:46:08.941Z” NotOnOrAfter=“2015-10-01T20:52:08.941Z”>
…<saml:AuthnStatement AuthnInstant=“2015-10-01T20:49:08.945Z”
The SAML specification requires all dates and times to be UTC rather than time zone specific.
We follow the specification and use UTC. We don’t support any other time format.
If you did use a different time format you would find you would have compatibility issues with other SAML sites.
Why do you want to set the times to Pacific?
We are doing a SAML integration with Salesforce and it’s set to Pacific time in their system causing an error with the Assertion.
We have testing with Salesforce and there shouldn’t be any issues. They use UTC times in their SAML implementation.
Make sure that your server’s clock is synchronized with a time server. The clocks at the identity provider and service provider should be synchronized to within a couple of minutes.
What sort of error are you seeing?
We are seeing a “Failed: Assertion expired” on Salesforce log file.
That sounds like the clocks are out of sync.
Did you synchronize your server’s clock with an NTP time server to ensure it’s correct?