VMware Aria Automation login fails with error code 500 and NotBefore condition is invalid

Products

• VCF Operations

Issue/Introduction

When you attempt to log into VMware Aria Automation, the login fails and the UI displays the following error: "Unusual error happened, if persist reach your admin. Error Code 500"

Message in French.

When reviewing the workspace log on the VMware Identity Manager appliance, you observe SAML validation failures indicating that the NotBefore condition is invalid, as well as a time synchronization offset (décalage de l'heure de synchronisation):

2026-06-23T13:02:29,459 INFO  (Thread-10) [vidm-node;-;<REDACTED_IP>;] com.tricipher.saas.action.api.impl.AuthenticationServiceImpl - Unable to validate response for IDP 'keycloak' with IDP id: 105. Detail: SAML response is not valid: NotBefore condition is invalid. Assertion validation failed.
2026-06-23T13:02:29,460 INFO  (Thread-10) [vidm-node;-;<REDACTED_IP>;] com.vmware.horizon.service.controller.auth.LoginController - Failed to validate incoming SAML:
com.tricipher.saas.exception.MyOneLoginException: Cette erreur est probablement due à un décalage de l'heure de synchronisation entre le connecteur et Application Manager. Demandez à votre administrateur de contrôler l'heure sur le connecteur et sur Application Manager pour vérifier qu'ils sont synchronisés correctement avec un serveur de temps NTP.
2026-06-23T13:02:29,469 INFO  (Thread-10) [vidm-node;-;<REDACTED_IP>;] com.vmware.horizon.components.authentication.monitoring.LoginMetricsPublisher - Login failed.

Message in English.

2026-06-23T13:02:29,460 INFO  (Thread-10) [vidm-node;-;<REDACTED_IP>;] com.vmware.horizon.service.controller.auth.LoginController - Failed to validate incoming SAML:
com.tricipher.saas.exception.MyOneLoginException: This error is likely due to a time synchronization mismatch between the connector and Application Manager. Ask your administrator to check the time on the connector and Application Manager to verify that they are correctly synchronized with an NTP time server.

Environment

• VMware Aria Automation

• VMware Identity Manager 3.3.7

• Third-Party Identity Provider (IDP) (e.g., Keycloak)

Cause

This issue occurs due to a time synchronization offset (clock drift) between the VMware Identity Manager 3.3.7 appliance and the external Identity Provider (IDP).

When the IDP issues a SAML token, it sets a NotBefore timestamp. If the VMware Identity Manager appliance clock is running behind the IDP clock, it rejects the token as it appears to be from the future, causing the authentication flow to drop.

Resolution

To resolve this issue, you must verify and correct the Time Synchronization (NTP) settings on the VMware Identity Manager 3.3.7 appliance to ensure it strictly aligns with the IDP infrastructure.

1. Navigate to the VMware Identity Manager Appliance Configurator interface at https://<FQDN>:8443/cfg/.

2. Authenticate using your local admin or root credentials.

3. In the left sidebar, navigate to Time Synchronization (/cfg/timesync).

4. Select the NTP radio button (if currently set to Host Time).

5. Verify the configured NTP Server FQDN or IP address. Ensure it is reachable and shares the same authoritative time source as your IDP.

6. Click Save to apply the configuration.

7. Initiate a new SSO login test to confirm the SAML assertion payload validates successfully.