SAML: allowed clock/time difference from IdP

changelog.d/8731.misc

@@ -0,0 +1 @@
+SAML: add `accepted_time_diff` example to `saml2_config:` config to allow clock/time difference from IdP.

docs/sample_config.yaml

@@ -1545,6 +1545,9 @@ saml2_config:
     #  remote:
     #    - url: https://our_idp/metadata.xml
 
+    # Allowed clock difference in seconds from IdP.
+    #accepted_time_diff: 3
+
     # By default, the user has to go to our login page first. If you'd like
     # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
     # 'service.sp' section:

synapse/config/saml2_config.py

@@ -256,6 +256,9 @@ def generate_config_section(self, config_dir_path, server_name, **kwargs):
             #  remote:
             #    - url: https://our_idp/metadata.xml
 
+            # Allowed clock difference in seconds from IdP.
+            #accepted_time_diff: 3
+
             # By default, the user has to go to our login page first. If you'd like
             # to allow IdP-initiated login, set 'allow_unsolicited: true' in a
             # 'service.sp' section: