SAML authentication fails due to the maximum clock skew
35119
Created On 05/30/19 17:26 PM - Last Modified 01/14/25 08:16 AM
Symptom
- SAML Authentication fails
- From the CLI, the debug authd log is recording the following logs: (to set the authd debug level, run the command of debug authentication on debug)
2019-05-30 08:34:37.904 -0700 SAML message from IdP "https://accounts.google.com/o/saml2?idpid =C01si5jpr" (server profile "G-Suite") was created in the future (not_before "2019-05-30T15:56:03.467Z" - max_clock_skew 60 > now Thu May 30 08:34:37 2019 2019-05-30 08:34:37.904 -0700 Error: _parse_sso_response(pan_authd_saml.c:1006): Extract assertion from SAML message from IdP "https://accounts.google.com/o/saml2?idpid=C01si5jpr" 2019-05-30 08:34:37.904 -0700 Error: _handle_request(pan_authd_saml.c:1661): occurs in _parse_sso_response() 2019-05-30 08:34:37.905 -0700 SAML SSO authentication failed for user ''. Reason: SAML web single-sign-on failed. auth profile 'Google-Cloud-Identity', vsys 'vsys1', server profile 'G-Sui
Note: the Maximum Clock Skew is the allowed difference in seconds between the system times of the IdP and the firewall at the moment when the firewall validates IdP messages (default is 60; range is 1 to 900). If the difference exceeds this value, authentication fails.
Environment
- NGFW
- Supported PAN-OS
- SAML Authentication
Cause
The system clock time in the firewall must be in sync with the time of the SAML IdP server.
Resolution
Enable NTP server in Firewall