Index: lams_common/conf/hibernate/mappings/org/lamsfoundation/lams/integration/ExtServerOrgMap.hbm.xml
===================================================================
diff -u -rd5a281b774f24a41894aac08200627f18e2b25e2 -rbe79bf267f7182acbdec7adfcb800dc2118973b8
--- lams_common/conf/hibernate/mappings/org/lamsfoundation/lams/integration/ExtServerOrgMap.hbm.xml	(.../ExtServerOrgMap.hbm.xml)	(revision d5a281b774f24a41894aac08200627f18e2b25e2)
+++ lams_common/conf/hibernate/mappings/org/lamsfoundation/lams/integration/ExtServerOrgMap.hbm.xml	(.../ExtServerOrgMap.hbm.xml)	(revision be79bf267f7182acbdec7adfcb800dc2118973b8)
@@ -125,6 +125,14 @@
             length="1"
             not-null="true"
         />
+        
+		<property
+            name="timeToLiveLoginRequest"
+            type="int"
+            update="true"
+            insert="true"
+            column="time_to_live_login_request"
+        />
 
         <many-to-one
             name="organisation"
Index: lams_common/src/java/org/lamsfoundation/lams/dbupdates/patch02040034.sql
===================================================================
diff -u
--- lams_common/src/java/org/lamsfoundation/lams/dbupdates/patch02040034.sql	(revision 0)
+++ lams_common/src/java/org/lamsfoundation/lams/dbupdates/patch02040034.sql	(revision be79bf267f7182acbdec7adfcb800dc2118973b8)
@@ -0,0 +1,9 @@
+SET AUTOCOMMIT = 0;
+SET FOREIGN_KEY_CHECKS = 0;
+
+--  LDEV-3382: Add datetime parameter check to LoginRequest
+ALTER TABLE lams_ext_server_org_map ADD COLUMN time_to_live_login_request integer DEFAULT 80;
+
+COMMIT;
+SET AUTOCOMMIT = 1;
+SET FOREIGN_KEY_CHECKS = 1;
\ No newline at end of file
Index: lams_common/src/java/org/lamsfoundation/lams/integration/ExtServerOrgMap.java
===================================================================
diff -u -ree6a40ada6ae3bea48ecdedc5cad0ce3e7a3f3d8 -rbe79bf267f7182acbdec7adfcb800dc2118973b8
--- lams_common/src/java/org/lamsfoundation/lams/integration/ExtServerOrgMap.java	(.../ExtServerOrgMap.java)	(revision ee6a40ada6ae3bea48ecdedc5cad0ce3e7a3f3d8)
+++ lams_common/src/java/org/lamsfoundation/lams/integration/ExtServerOrgMap.java	(.../ExtServerOrgMap.java)	(revision be79bf267f7182acbdec7adfcb800dc2118973b8)
@@ -41,6 +41,9 @@
 
     /** persistent field */
     private Boolean disabled;
+    
+    /** persistent field */
+    private int timeToLiveLoginRequest;
 
     /** persistent field */
     private Organisation organisation;
@@ -51,44 +54,11 @@
     /** persistent field */
     private Set extUserUseridMaps;
 
-    /** full constructor */
-    public ExtServerOrgMap(String serverid, String serverkey, String servername, String serverdesc, String prefix,
-	    String userinfoUrl, String serverUrl, String timeoutUrl, Boolean disabled, Organisation organisation, Set extCourseClassMaps,
-	    Set extUserUseridMaps) {
-	this.serverid = serverid;
-	this.serverkey = serverkey;
-	this.servername = servername;
-	this.serverdesc = serverdesc;
-	this.prefix = prefix;
-	this.userinfoUrl = userinfoUrl;
-	this.serverUrl = serverUrl;
-	this.timeoutUrl = timeoutUrl;
-	this.disabled = disabled;
-	this.organisation = organisation;
-	this.extCourseClassMaps = extCourseClassMaps;
-	this.extUserUseridMaps = extUserUseridMaps;
-    }
-
     /** default constructor */
     public ExtServerOrgMap() {
+	timeToLiveLoginRequest = 80;
     }
 
-    /** minimal constructor */
-    public ExtServerOrgMap(String serverid, String serverkey, String servername, String prefix, String userinfoUrl,
-	    String timeoutUrl, Boolean disabled, Organisation organisation, Set extCourseClassMaps,
-	    Set extUserUseridMaps) {
-	this.serverid = serverid;
-	this.serverkey = serverkey;
-	this.servername = servername;
-	this.prefix = prefix;
-	this.userinfoUrl = userinfoUrl;
-	this.timeoutUrl = timeoutUrl;
-	this.disabled = disabled;
-	this.organisation = organisation;
-	this.extCourseClassMaps = extCourseClassMaps;
-	this.extUserUseridMaps = extUserUseridMaps;
-    }
-
     public Integer getSid() {
 	return this.sid;
     }
@@ -176,7 +146,20 @@
     public void setDisabled(Boolean disabled) {
 	this.disabled = disabled;
     }
+    
+    /**
+     * Measured in minutes.
+     * 
+     * @return
+     */
+    public int getTimeToLiveLoginRequest() {
+	return this.timeToLiveLoginRequest;
+    }
 
+    public void setTimeToLiveLoginRequest(int timeToLiveLoginRequest) {
+	this.timeToLiveLoginRequest = timeToLiveLoginRequest;
+    }
+
     public Organisation getOrganisation() {
 	return this.organisation;
     }
Index: lams_common/src/java/org/lamsfoundation/lams/integration/security/Authenticator.java
===================================================================
diff -u -rc6867c1780952042c1c587da64b3002b60b31c85 -rbe79bf267f7182acbdec7adfcb800dc2118973b8
--- lams_common/src/java/org/lamsfoundation/lams/integration/security/Authenticator.java	(.../Authenticator.java)	(revision c6867c1780952042c1c587da64b3002b60b31c85)
+++ lams_common/src/java/org/lamsfoundation/lams/integration/security/Authenticator.java	(.../Authenticator.java)	(revision be79bf267f7182acbdec7adfcb800dc2118973b8)
@@ -23,6 +23,8 @@
 
 package org.lamsfoundation.lams.integration.security;
 
+import java.util.Date;
+
 import org.lamsfoundation.lams.integration.ExtServerOrgMap;
 import org.lamsfoundation.lams.util.HashUtil;
 
@@ -47,6 +49,7 @@
      */
     public static void authenticate(ExtServerOrgMap map, String datetime, String username, String method,
 	    String hashValue) throws AuthenticationException {
+	
 	if (map == null) {
 	    throw new AuthenticationException("The third party server is not configured on LAMS server");
 	}
@@ -60,29 +63,53 @@
     }
 
     /**
-     * Checks hash. Differs from the method above (the one without lsid parameter) in a way that hash is expected to also
-     * contain lsidx: [ts + uid + method + lsid + serverID + serverKey]
+     * Checks hash for LoginRequest calls. Differs from the method above in a way that datetime is expected to contain
+     * real value and it must be quite recent one.
      * 
      * @param map
      * @param datetime
      * @param username
      * @param method
      * @param lsid
+     *            this parameter provided only if coming from learnerStrictAuth
      * @param hashValue
      * @throws AuthenticationException
      */
-    public static void authenticate(ExtServerOrgMap map, String datetime, String username, String method, String lsid,
-	    String hashValue) throws AuthenticationException {
+    public static void authenticateLoginRequest(ExtServerOrgMap map, String datetime, String username, String method,
+	    String lsid, String hashValue) throws AuthenticationException {
+
 	if (map == null) {
 	    throw new AuthenticationException("The third party server is not configured on LAMS server");
 	}
 	if (map.getDisabled()) {
 	    throw new AuthenticationException("The third party server is disabled");
 	}
 
-	String plaintext = datetime.toLowerCase().trim() + username.toLowerCase().trim() + method.toLowerCase().trim()
-		+ lsid.toLowerCase().trim() + map.getServerid().toLowerCase().trim()
-		+ map.getServerkey().toLowerCase().trim();
+	// check if datetime parameter is not too old
+	long datetimeParam;
+	try {
+	    datetimeParam = Long.parseLong(datetime);
+	} catch (NumberFormatException e) {
+	    throw new AuthenticationException("The third party server provided wrong format of datetime, datetime = "
+		    + datetime, e);
+	}
+
+	int timeToLiveLoginRequest = map.getTimeToLiveLoginRequest();
+	//sum up request time and maximum allowed request's time to live
+	Date requestTimePlusTimeToLive = new Date(datetimeParam + timeToLiveLoginRequest * 60 * 1000);
+	Date now = new Date();
+	if (requestTimePlusTimeToLive.before(now)) {
+	    throw new AuthenticationException("Login Request can't be older than " + timeToLiveLoginRequest
+		    + "minutes. Request time is: " + new Date(datetimeParam));
+	}
+
+	//learnerStrictAuth hash [ts + uid + method + lsid + serverID + serverKey]
+	//otherwise [ts + uid + method + serverID + serverKey]
+	String plaintext = (lsid == null) ? datetime.toLowerCase().trim() + username.toLowerCase().trim()
+		+ method.toLowerCase().trim() + map.getServerid().toLowerCase().trim()
+		+ map.getServerkey().toLowerCase().trim() : datetime.toLowerCase().trim()
+		+ username.toLowerCase().trim() + method.toLowerCase().trim() + lsid.toLowerCase().trim()
+		+ map.getServerid().toLowerCase().trim() + map.getServerkey().toLowerCase().trim();
 	checkHash(plaintext, hashValue);
     }