When running Shibboleth as SP Federation Service in combination with
SiteMinder IDP, one might see the Shibboleth reports error :
opensaml::SecurityPolicyException: Message expired, was issued too long ago
The error shows that the issue is on SP side as all IdP
machines are time synced. All machines, including both sides IdP and
SP should be time sync as Sibboleth documentation reports it (1).
From Shibboleth logs, We see that for all those lines, there's a
difference of 8 minutes and 47 seconds.
2021-03-27 09:17:36 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [14]: rejected not-yet-valid message, timestamp (1616833763), newest allowed (1616833236)
1616833763 : Sat, 27 Mar 2021 08:29:23 GMT
1616833236 : Sat, 27 Mar 2021 08:20:36 GMT
diff = 8 m 47
2021-03-27 09:18:43 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [14]: rejected not-yet-valid message, timestamp (1616833830), newest allowed (1616833303)
1616833830 : Sat, 27 Mar 2021 08:30:30 GMT
1616833303 : Sat, 27 Mar 2021 08:21:43 GMT
diff = 8 m 47
2021-03-27 09:20:59 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [5]: rejected not-yet-valid message, timestamp (1616833966), newest allowed (1616833439)
1616833966 : Sat, 27 Mar 2021 08:32:46 GMT
1616833439 : Sat, 27 Mar 2021 08:23:59 GMT
diff = 8 m 47
2021-03-27 10:20:59 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [14]: rejected not-yet-valid message, timestamp (1616837566), newest allowed (1616837039)
1616837566 : Sat, 27 Mar 2021 09:32:46 GMT
1616837039 : Sat, 27 Mar 2021 09:23:59 GMT
diff = 8 m 47
Those lines are reported from Sibboleth source code (2).
Make sure that Shibboleth SP side machines are in sync for date, time
and time format as per IdP Siteminder side;
(1)
CommonErrors
opensaml::SecurityPolicyException: Message expired, was issued too
long ago. Barring an actual replay attack, your SP's clock isn't
synchronized with the clock of the IdP that issued the message. All
servers using SAML MUST maintain accurate time. Refer to your OS
documentation for information on how to synchronize with a reliable
time source.
https://wiki.shibboleth.net/confluence/display/SP3/CommonErrors#CommonErrors-opensaml::SecurityPolicyException:Messageexpired,wasissuedtoolongago.
(2)
gitprojects / shibboleth / opensaml2.git / commitdiff
- if (issueInstant > now + skew) {
- log.errorStream() << "rejected not-yet-valid message, timestamp (" << issueInstant <<
- "), newest allowed (" << now + skew << ")" << CategoryStream::ENDLINE;
- throw BindingException("Message rejected, was issued in the future.");
In the last log line :
2021-03-27 10:20:59 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [14]: rejected not-yet-valid message, timestamp (1616837566), newest allowed (1616837039)
- if (issueInstant > 10:20:59 + 3) {
- log.errorStream() << "rejected not-yet-valid message, timestamp (" << 09:32:46 <<
- "), newest allowed (" << 09:23:59 << ")" << CategoryStream::ENDLINE;
- throw BindingException("Message rejected, was issued in the future.");
http://www.project-moonshot.org/gitweb/?p=shibboleth/opensaml2.git;a=commitdiff;h=78df12835bde49799a945c6e7a23a95aaec1ab02