SSO Logins Stop Working. Error "Response issue time is either too old or with date in the future"

Products

• Data Loss Prevention Core Package

Issue/Introduction

SSO Logins to the DLP console stop working. There were no apparent changes in configuration.

Upon inspection of the Localhost logs we see this error: 

Source: org.springframework.security.saml.log.SAMLDefaultLogger
Message: AuthNResponse;FAILURE;<ip>;https://server.example.com/ProtectManager/saml/metadata;https://sts.windows.net/<guid>/;;;org.opensaml.common.SAMLException: Response issue time is either too old or with date in the future, skew 60, time 2025-03-18T14:53:39.551Z

 

Cause

The DLP Enforce server time skew with the IDP is greater than 60 seconds causing the login to be invalidated.

Resolution

Check the NTP server that the DLP is using with the following command: "w32tm /query /source"

If the server is not using time.windows.com change it so it is or have the admins of the existing NTP resync the time server to internet time.