Re: [security-services] Following up on dateTime

[Stephen Farrell <stephen.farrell@baltimore.ie>]

Hal,

> Hal Lockhart wrote:
> 
> 
> > a) Allow any legal lexical form, with the additional wording that
[...]> 
> I don't like this as it allows other time zones and daylight savings times.

I agree.

> 
> > b) Derive a saml:dateTime (or perhaps name it something else) using a
> > pattern restriction that calls out exactly what syntax is
> > permitted as a
> > subset of the lexical forms allowed by xsd:dateTime, probably
> > requiring
> > that a Z appear on the end.
> 
> I don't think requiring Z is a problem if that is easier technically. 

Me too. I'd argue that not including "Z" means non-conformance.

> All things being equal I would allow either Z or nothing.

I don't understand how we can reliably process assertions that
include local times and no timezone. Are you saying that the relying
party for the assertion MUST assume that the time value is actually
UTC even though the "Z" is omitted? That sounds very dangerous to 
me. 

Maybe I'm confused though?

Stephen.

-- 
____________________________________________________________
Stephen Farrell         				   
Baltimore Technologies,   tel: (direct line) +353 1 881 6716
39 Parkgate Street,                     fax: +353 1 881 7000
Dublin 8.                mailto:stephen.farrell@baltimore.ie
Ireland                             http://www.baltimore.com