opensaml::SecurityPolicyException: Message expired, was issued too long ago.

[James W. Anderson]

We have three application environments, all running RHEL 6, Apache 2.4 and Shibboleth 2.5.4. Two of them work correctly, but In one of our environments we're getting this exception when the IDP POSTs the assertion:

opensaml::SecurityPolicyException
The system encountered an error at Wed Jul 1 15:23:19 2015
To report this problem, please contact the site administrator at xxxxxxxx at xxxxxxxxxx.com<mailto:xxxxxxxx at xxxxxxxxxx.com>
Please include the following message in any email:
opensaml::SecurityPolicyException at (https://xxxxxxxxxx.com/Shibboleth.sso/SAML2/POST)
Message expired, was issued too long ago.

The hosting provider insists the clocks on all servers are synched using NTP.

In the shibd.log file we see this:

2015-07-01 14:42:53 ERROR OpenSAML.SecurityPolicyRule.MessageFlow [1]: rejected expired message, timestamp (1435761510), oldest allowed (1435761533)

When we convert the epoch values, our assertion timestamp is "Wed, 01 Jul 2015 14:38:30 GMT" and the oldest allowed is "Wed, 01 Jul 2015 14:38:53 GMT."

We temporarily worked around this by changing the clockSkew setting in shibboleth2.xml to 7200 seconds, but I'd like to understand what is causing this, because it looks the time values are well within the default skew setting of 180 seconds.

Any thoughts?





[cid:image001.png at 01D01537.F005A230]


James W. Anderson
Cloud Infrastructure Architect
The Coca-Cola Company
404.676.4914 Office
770.653.1033 Mobile
404.598.4914 Fax
jamesanderson at coca-cola.com<mailto:jamesanderson at coca-cola.com>





________________________________

CONFIDENTIALITY NOTICE
NOTICE: This message is intended for the use of the individual or entity to which it is addressed and may contain information that is confidential, privileged and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are hereby notified that any printing, copying, dissemination, distribution, disclosure or forwarding of this communication is strictly prohibited. If you have received this communication in error, please contact the sender immediately and delete it from your system. Thank You.

________________________________

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150701/622ed195/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 12779 bytes
Desc: image001.png
URL: <http://shibboleth.net/pipermail/users/attachments/20150701/622ed195/attachment-0001.png>