EDR: Login Failure, saml2.validate.ToEarly: Can't use response yet

Products

• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

• Login Failure
• EDR Server:  Error in /var/log/cb/coreservices/debug.log
• UV Server:  Error in /var/log/cb/uvservices/debug.log
• Stack trace in debug.log shows:

saml2.validate.ToEarly: Can't use response yet

Environment

• EDR Server:  All Supported Versions
• Unified View:  All Supported Versions
• Saml Identify Provider configured

Cause

Significant time difference between EDR/UV server and IDP server causes SAML connection to fail

Resolution

1. Sync system time between IDP server and EDR/UV server
2. Consider setting up a NTP (network time protocol) sync on Linux OS