Introduce clock skew for metadata expiration?

[johanib]

New Feature Request

Summary

Origin: #1860 (comment)

Problem:
In the context of metadata expiration, @tvdijen wrote:

I think allowing a little clock-skew would be appropriate here. SAML2INT allows a clock-skew between 3-5 minutes for SAML messages. For SAML metadata (SAML2MDIOP) there is no such requirement, but I think it makes sense to allow some skew. I'm keen to know how SURF looks at this.

[pmeulen]

Metadata expiry is not time critical and it does not have a "valid from" timestamp like a SAML Assetion has. SAML Metadata (i.e. EntityDescriptor / EntitiesDescriptor) normally already includes "slack" in the expiry measured in days to allow the metadata signer to deal with outages. That is very different form a SAML Assertion that typically has a validity of 5 minutes, is signed just in time and has a valid from. The clock skew is especially useful because to help the situation where the clock of the validator runs behind that of the generator of the SAML Assertion to prevent a "not yet valid" error.

Because all this does not apply to SAML metadata, I do not think that it makes sense to include a clocks skew for the metadata expiry validation. I adds complexity and it does not solve a problem.