Identityserver4: Remove iat from id_token

[Krishna-teja]

Is there any way I can remove "iat" claim from my id_token. Many clients started getting"iat is at a future date" error at callback.html. Is there any way I could turn this off please. I tried setting clockskew to higher number on oidc-client and that did not help.

Could you please help me resolve this issue.

Thanks!

[brockallen]

How far in the future is it? Have you checked that the clocks on the client machines are in sync (within a few mins)?

[Krishna-teja]

Yes, I checked the client machines and it was around 5 - 20 mins between different clients. Once they synced it properly, it was fine. We have customers globally and I was surprised how many of them did not properly keep their clock in sync. So in order to fix this, I added a clockskew manually on callback.html now. But just something to think about in future to make this optional as the specs https://tools.ietf.org/html/rfc7519#section-4.1.6 says that it can be optional.

[brockallen]

The OIDC protocol requires no more than 5m of clock skew between machines (which is the same requirement as kerberos).

[Krishna-teja]

Oh. I did not know that. I set the clockskew for 15 mins which is a problem then. I think, I can just show a message to sync their clock if this issue arises. Thanks for your input.

[ribubrar]

I faced the same error in my project and this thread did help me resolve it by just setting the time on my laptop automatically.

Although it was strange, I haven't changed the time on my laptop for a few months and the project was working fine last week. But now I have just set the time on auto mode.

[lock[bot]]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.