package org.apereo.cas.support.saml.web.idp.profile.builders;

import org.apereo.cas.support.saml.services.SamlRegisteredService;
import org.apereo.cas.support.saml.services.idp.metadata.SamlRegisteredServiceServiceProviderMetadataFacade;
import org.apereo.cas.support.saml.util.AbstractSaml20ObjectBuilder;
import org.apereo.cas.util.DateTimeUtils;
import org.jasig.cas.client.validation.Assertion;
import org.apereo.cas.support.saml.SamlException;
import org.opensaml.saml.saml2.core.AuthnRequest;
import org.opensaml.saml.saml2.core.NameID;
import org.opensaml.saml.saml2.core.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.cloud.context.config.annotation.RefreshScope;
import org.springframework.stereotype.Component;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * This is {@link SamlProfileSamlSubjectBuilder}.
 *
 * @author Misagh Moayyed
 * @since 5.0.0
 */
@RefreshScope
@Component("samlProfileSamlSubjectBuilder")
public class SamlProfileSamlSubjectBuilder extends AbstractSaml20ObjectBuilder implements SamlProfileObjectBuilder<Subject> {
    private static final long serialVersionUID = 4782621942035583007L;

    @Autowired
    @Qualifier("samlProfileSamlNameIdBuilder")
    private SamlProfileSamlNameIdBuilder ssoPostProfileSamlNameIdBuilder;

    @Override
    public Subject build(final AuthnRequest authnRequest, final HttpServletRequest request, final HttpServletResponse response,
                               final Assertion assertion, final SamlRegisteredService service,
                               final SamlRegisteredServiceServiceProviderMetadataFacade adaptor)
            throws SamlException {
        return buildSubject(request, response, authnRequest, assertion, service, adaptor);
    }

    private Subject buildSubject(final HttpServletRequest request,
                                 final HttpServletResponse response,
                                 final AuthnRequest authnRequest, final Assertion assertion,
                                 final SamlRegisteredService service,
                                 final SamlRegisteredServiceServiceProviderMetadataFacade adaptor) throws SamlException {
        final NameID nameID = this.ssoPostProfileSamlNameIdBuilder.build(authnRequest, request, response, assertion, service, adaptor);
        final Subject subject = newSubject(nameID.getFormat(), nameID.getValue(),
                authnRequest.getAssertionConsumerServiceURL(),
                DateTimeUtils.zonedDateTimeOf(assertion.getValidFromDate()),
                authnRequest.getID());
        subject.setNameID(nameID);
        return subject;
    }
}

@@ -305,50 +305,8 @@
 er;%0A
-import org.apereo.cas.util.DateTimeUtils;%0A
 impo
@@ -347,24 +347,24 @@
 .Assertion;%0A
+
 import org.a
@@ -662,24 +662,83 @@
 .Qualifier;%0A
+import org.springframework.beans.factory.annotation.Value;%0A
 import org.s
@@ -848,16 +848,78 @@
 onent;%0A%0A
+import java.time.ZoneOffset;%0Aimport java.time.ZonedDateTime;%0A%0A
 import j
@@ -1500,16 +1500,106 @@
 ilder;%0A%0A
+    @Value(%22$%7Bcas.samlidp.response.skewAllowance:0%7D%22)%0A    private int skewAllowance;%0A    %0A
     @Ove
@@ -2610,24 +2610,151 @@
 , adaptor);%0A
+        final ZonedDateTime validFromDate = ZonedDateTime.ofInstant(assertion.getValidFromDate().toInstant(), ZoneOffset.UTC);%0A
         fina
@@ -2906,66 +2906,52 @@
     
-DateTimeUtils.zonedDateTimeOf(assertion.getValidFromDate()
+validFromDate.plusSeconds(this.skewAllowance
 ),%0A 

Fix for issue #1829 (#1830)