SAML response refused: NotBefore 40 s in the future (Brakeline York)

Project: Engineering
Type: Bug
Status: Done Done
Priority: Medium
Organization: Brakeline
Reporter: Marek Nowak <marek.nowak@acme-hq.example>
Assignee: Piet de Vries <piet.devries@acme-hq.example>
Labels: brakelinesingle-sign-on
Components: identity-serviceinfrastructure
Fix versions: identity-service 2026.03.04
Sprint: Sprint 37
Created: 3 Mar 2026, 10:05 UTC
Updated: 4 Mar 2026, 11:00 UTC
Resolved: 4 Mar 2026, 11:00 UTC

Description

York's test sign-in failed with "assertion not yet valid" (SUP-583). Entra ID's NotBefore was 40 s ahead of the clock on the UK host that took the response, and we allowed no clock difference at all.

Steps to reproduce

Local test IdP (tools/): assertion NotBefore = now + 40 s.
Sign in to a SAML depot.

Expected: signed in. Actual: refused.

Fix

Accept up to two minutes either way, log anything over 30 s, and fix that host's time sync (it had drifted).

Linked issues

relates to SUP-583 Brakeline: York test sign-in refused, response 'not yet valid' Done
relates to SUP-388 Brakeline rollout of single sign-on Done

Comments (1)

Piet de Vries · 4 Mar 2026, 11:00 UTC

Deployed, host clock fixed. York's test sign-in passes.