Prisma cloud compute: SAML authentication failed 500 internal server error assertion is not yet valid
2736
Created On 07/30/24 18:03 PM - Last Modified 02/06/25 18:36 PM
Symptom
This occurs when Prisma cloud compute pod/node time is >5 minutes time drift with the Load balancer/Kerberos server/SAML server then authentication fails.
output from the console.logs
DEBU 2024-07-30T17:04:28.029 route_handler.go:3256 Authenticating saml user type: otherProvider ERRO 2024-07-30T17:04:28.046 route_handler.go:3308 Failed to authenticate using authentication endpoint, error: failed to check if saml user exists: assertion is not yet valid ERRO 2024-07-30T17:04:28.047 route_handler.go:14504 Operation failed: uri=/api/v1/authenticate; error=failed to check if saml user exists: assertion is not yet valid
Environment
- Prisma cloud SaaS
- Prima cloud compute self-hosted
Cause
When Kerberos server/SAML authentication server time is drift >5 mins with the Prisma cloud compute pod/node then this error occurs
Resolution
- Verify the time difference is >5 mins between Prisma cloud compute pod/node.
- Verify the time on the NTP server/ Kerberos server/SAML authentication server.
- Try to use NTP server for both e.g. Prisma cloud compute and SAML authentication server to resolve the issue.
- Or Adjust the time using ‘date’ command on the prisma cloud compute pod to match it with the SAML authentication server.