Compensate clock skew

Allows for a 3-minutes clock skew between systems in notBefore and notAfter attributes.

Errata E92
SAML Version 2.0 Errata 05. 01 May 2012. OASIS Approved Errata. http://docs.oasisopen.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.html

Author: mfprimo

src/OneLogin/Saml/XmlSec.php

@@ -5,6 +5,12 @@
  */
 class OneLogin_Saml_XmlSec
 {
+    /**
+     * Acceptable skew between SP and IdP clocks.
+     * See SAML Version 2.0 Errata 05, Errata E92 
+     */
+    const CLOCK_SKEW_SECONDS = 180; // 3 minutes
+    
     /**
      * A SamlResponse class provided to the constructor.
      * @var OneLogin_Saml_Settings
@@ -54,10 +60,10 @@ public function validateTimestamps()
         for ($i = 0; $i < $timestampNodes->length; $i++) {
             $nbAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotBefore");
             $naAttribute = $timestampNodes->item($i)->attributes->getNamedItem("NotOnOrAfter");
-            if ($nbAttribute && strtotime($nbAttribute->textContent) > time()) {
+            if ($nbAttribute && strtotime($nbAttribute->textContent) > time() + self::CLOCK_SKEW_SECONDS) {
                 return false;
             }
-            if ($naAttribute && strtotime($naAttribute->textContent) <= time()) {
+            if ($naAttribute && strtotime($naAttribute->textContent) <= time() - self::CLOCK_SKEW_SECONDS) {
                 return false;
             }
         }
@@ -106,4 +112,4 @@ public function isValid()
 
         return ($objXMLSecDSig->verify($objKey) === 1);
     }
-}
+}