V-286594

Discussion

The UAG supports Security Assertion Markup Language (SAML) authentication, which relies on the validation of time-based conditions contained within SAML assertions. These conditions include fields such as "NotBefore" and "NotOnOrAfter", which define the period during which an assertion is considered valid. To account for minor differences between the system clocks of the Identity Provider (IdP) and the UAG, the appliance provides a configurable "Clock Skew Tolerance" setting. This value specifies the maximum allowable time difference, in seconds, that will be accepted during SAML assertion validation. If the Clock Skew Tolerance value is configured excessively high, expired or not-yet-valid assertions may be accepted beyond the intended validity period, increasing the window of opportunity for replay attacks or unauthorized use of authentication assertions. Limiting the Clock Skew Tolerance to no more than 300 seconds (five minutes) ensures sufficient tolerance for normal clock synchronization variances while minimizing the risk of accepting stale or premature SAML assertions. Failure to properly configure this setting may weaken the effectiveness of SAML assertion validation and increase the risk of unauthorized access to system resources.

Check Content

Log in to the UAG administrative interface as an administrator.

Select "Configure Manually".

Navigate to Advanced Settings >> System Configuration.

Click the gear icon to verify the settings.

If the "Clock Skew Tolerance" value is greater than "300" (five minutes), this is a finding.