diff --git a/config-templates/config.php b/config-templates/config.php
index ac9b800f230c7a435735e9c37a183370dbe9bef4..d06fc81b258eeca93258d78c6f618e39c501891e 100644
--- a/config-templates/config.php
+++ b/config-templates/config.php
@@ -176,6 +176,15 @@ $config = [
      */
     'enable.http_post' => false,
 
+    /*
+     * Set the allowed time difference between encrypting/decrypting assertions
+     *
+     * If you have an server that is constantly out of sync, this option
+     * allows you to adjust the allowed time-frame.
+     *
+     * Defaults to 60.
+     */
+    'assertion.allowed_offset' => 60,
 
 
     /************************
diff --git a/modules/saml/lib/Message.php b/modules/saml/lib/Message.php
index 1af7164e83deb500bace45ee125e7fb1349324c2..cda90f17627905a0e82736151b1316eb546b5c98 100644
--- a/modules/saml/lib/Message.php
+++ b/modules/saml/lib/Message.php
@@ -656,20 +656,22 @@ class Message
         $currentURL = \SimpleSAML\Utils\HTTP::getSelfURLNoQuery();
 
         // check various properties of the assertion
+        $config = \SimpleSAML\Configuration::getInstance();
+        $allowed_assertion_offset = $config->getInteger('assertion.allowed_offset', 60);
         $notBefore = $assertion->getNotBefore();
-        if ($notBefore !== null && $notBefore > time() + 60) {
+        if ($notBefore !== null && $notBefore > time() + $allowed_assertion_offset) {
             throw new \SimpleSAML\Error\Exception(
                 'Received an assertion that is valid in the future. Check clock synchronization on IdP and SP.'
             );
         }
         $notOnOrAfter = $assertion->getNotOnOrAfter();
-        if ($notOnOrAfter !== null && $notOnOrAfter <= time() - 60) {
+        if ($notOnOrAfter !== null && $notOnOrAfter <= time() - $allowed_assertion_offset) {
             throw new \SimpleSAML\Error\Exception(
                 'Received an assertion that has expired. Check clock synchronization on IdP and SP.'
             );
         }
         $sessionNotOnOrAfter = $assertion->getSessionNotOnOrAfter();
-        if ($sessionNotOnOrAfter !== null && $sessionNotOnOrAfter <= time() - 60) {
+        if ($sessionNotOnOrAfter !== null && $sessionNotOnOrAfter <= time() - $allowed_assertion_offset) {
             throw new \SimpleSAML\Error\Exception(
                 'Received an assertion with a session that has expired. Check clock synchronization on IdP and SP.'
             );