Error:
An unexpected error occurred. Please click Reload to try again.
Error:
An unexpected error occurred. Please click Reload to try again.
SAML authentication fails due to the maximum clock skew - Knowledge Base - Palo Alto Networks

SAML authentication fails due to the maximum clock skew

35119
Created On 05/30/19 17:26 PM - Last Modified 01/14/25 08:16 AM


Symptom


  • SAML Authentication fails
  • From the CLI, the debug authd log is recording the following logs: (to set the authd debug level, run the command of debug authentication on debug)
2019-05-30 08:34:37.904 -0700 SAML message from IdP "https://accounts.google.com/o/saml2?idpid =C01si5jpr" (server profile "G-Suite") 
was created in the future (not_before "2019-05-30T15:56:03.467Z" - max_clock_skew 60 > now Thu May 30 08:34:37 2019

2019-05-30 08:34:37.904 -0700 Error:  _parse_sso_response(pan_authd_saml.c:1006): Extract assertion from SAML message from IdP 
"https://accounts.google.com/o/saml2?idpid=C01si5jpr"

2019-05-30 08:34:37.904 -0700 Error:  _handle_request(pan_authd_saml.c:1661): occurs in _parse_sso_response()

2019-05-30 08:34:37.905 -0700 SAML SSO authentication failed for user ''.  Reason: SAML web single-sign-on failed. 
auth profile 'Google-Cloud-Identity', vsys 'vsys1', server profile 'G-Sui

 

Note: the Maximum Clock Skew is the allowed difference in seconds between the system times of the IdP and the firewall at the moment when the firewall validates IdP messages (default is 60; range is 1 to 900). If the difference exceeds this value, authentication fails.



Environment


  • NGFW
  • Supported PAN-OS
  • SAML Authentication


Cause


The system clock time in the firewall must be in sync with the time of the SAML IdP server.



Resolution


Enable NTP server in Firewall

User-added image


Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM4rCAG&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language