From 0d96b710cb5df118dec672fd0fbbd3f48873a9b0 Mon Sep 17 00:00:00 2001 From: kaiyou Date: Fri, 8 Jan 2021 07:07:08 +0100 Subject: [PATCH] Support clock drift in Omniauth SAML provider (#15511) The setting is not well documented by the provider, but allows for clock skew between SP and IDP, see: https://github.com/omniauth/omniauth-saml/blob/master/spec/omniauth/strategies/saml_spec.rb Co-authored-by: kaiyou --- config/initializers/omniauth.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/config/initializers/omniauth.rb b/config/initializers/omniauth.rb index e8d7697a11..9e037f421f 100644 --- a/config/initializers/omniauth.rb +++ b/config/initializers/omniauth.rb @@ -60,6 +60,7 @@ Devise.setup do |config| saml_options[:attribute_statements][:verified] = [ENV['SAML_ATTRIBUTES_STATEMENTS_VERIFIED']] if ENV['SAML_ATTRIBUTES_STATEMENTS_VERIFIED'] saml_options[:attribute_statements][:verified_email] = [ENV['SAML_ATTRIBUTES_STATEMENTS_VERIFIED_EMAIL']] if ENV['SAML_ATTRIBUTES_STATEMENTS_VERIFIED_EMAIL'] saml_options[:uid_attribute] = ENV['SAML_UID_ATTRIBUTE'] if ENV['SAML_UID_ATTRIBUTE'] + saml_options[:allowed_clock_drift] = ENV['SAML_ALLOWED_CLOCK_DRIFT'] if ENV['SAML_ALLOWED_CLOCK_DRIFT'] config.omniauth :saml, saml_options end end