Adjust Clock Skew for SAML Enterprise Connections

Knowledge Articles
1

Overview

This article provides steps on how to reduce the clock skew tolerance related to expired SAML assertion from 3 to 2 minutes when Auth0 is acting as a Service Provider (SP) using SAML.

Applies To

  • SAML enterprise connections

Solution

Auth0 allows < 3min expired assertions due to our (configurable) clock skew. To reduce the allowed clockSkew, for example, to 2 minutes, insert options.clockSkew:2 with the following steps:

  1. Call the GET /api/v2/connections/{id} endpoint by passing the connection_id of the SAML connection.
  1. Copy everything in options section in the response.
  2. Insert "clockSkew":2 inside of the block of options.
  3. Call the PATCH /API/v2/connections/{id} endpoint again by passing the connection_id of the SAML connection. The payload should only include the options section.