
YadvainderaS.37287 (Customer) asked a question.
I am trying to consume a SAML assertion sent by OKTA. The XML has the following Conditions node
<saml2:Conditions xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"
NotBefore="2021-08-02T22:49:52.995Z"
NotOnOrAfter="2021-08-02T22:59:52.995Z"
>
and the following IssueInstant on the response node
IssueInstant="2021-08-02T22:54:52.995Z"
This was generated at 18:54:52 according to my server time.
How can the discrepancy between IdP time and SP server time be tackled? I am trying to enforce an expiration for the SAML assertion but this puts the assertion 4 hours in the future which is an unnecessarily long time for the assertion to live. Also, I cannot enforce NotBefore with this setup.
These were generated at

I realized after posting this issue that this was a non issue to begin with. OKTA is already sending a timestamp with a TimeZone identifier (the Z at the end of the timestamp indicates UTC). On our end the C# method DateTime.Parse("2021-08-02T22:54:52.995Z") correctly identifies this as a UTC timestamp. When I do a date comparison similar to the below code, C# automatically provides local time for comparison which is in the correct time range.
```
var notOnOrAfter = DateTime.Parse("2021-08-02T22:49:52.995Z");
bool isValid = DateTime.Now < notOnOrAfter;
```
There is no action needed here. Thanks for your response.