Clock skew for service provider

[angusshire]

If the IdP and SP times are out of sync, then the SP may end up mistaking a valid SAML assertion as invalid. Therefore, we should be able to specify a clock skew to use for the service provider so that values within clock skew range of the NotBefore, NotOnOrAfter, or SessionNotOnOrAfter constraints are treated as valid.

[konaraya]

PR #71 for this feature. Please let me know your inputs.

[mfridman]

+1 for adding a configurable clock skew up to a limit, say 5 min. At which point should probably fix the cause of the skew instead of extending the skew.

[lpar]

Would also like. Active Directory tends to issue SAML assertions with NotBefore times with millisecond precision and no margin for error or clock drift.