SAML Login invalid ticket Current time is earlier than NotBefore condition

[phil]

Infos:

Hi can anybody help me with our SAML login?

• Used Zammad version: 3.4
• Used Zammad installation source: unknown
• Operating system: Ubuntu 18.04.5
• Browser + version: Firefox 80, Microsoft Edge, Internet Explorer

Expected behavior:

Successfull SAML Login

Actual behavior:

SAML Login sporadically fails with “Message from saml : invalid_ticket”

Log Message:
I, [2020-09-02T08:24:51.463669 #1067-47005627954400] INFO – : Started POST “/auth/saml” for 192.168.101.58 at 2020-09-02 08:24:51 +0200
I, [2020-09-02T08:24:51.466753 #1067-47005627954400] INFO – : (saml) Request phase initiated.
I, [2020-09-02T08:24:51.621092 #1067-47005627663400] INFO – : Started POST “/auth/saml/callback” for 192.168.101.58 at 2020-09-02 08:24:51 +0200
I, [2020-09-02T08:24:51.623605 #1067-47005627663400] INFO – : (saml) Callback phase initiated.
E, [2020-09-02T08:24:51.636983 #1067-47005627663400] ERROR – : (saml) Authentication failure! invalid_ticket: OneLogin:
:RubySaml::ValidationError, Current time is earlier than NotBefore condition (2020-09-02 06:24:51 UTC < 2020-09-02 06:24:51 UTC)
I, [2020-09-02T08:24:51.649244 #1067-47005627955120] INFO – : Started GET “/auth/failure?message=invalid_ticket&origin=https%3A%2F%2Fzammad.suedramol.de%2F&strategy=saml” for 192.168.101.58 at 2020-09-02 08:24:51 +0200
I, [2020-09-02T08:24:51.652155 #1067-47005627955120] INFO – : Processing by SessionsController#failure_omniauth as HTML
I, [2020-09-02T08:24:51.652203 #1067-47005627955120] INFO – : Parameters: {“message”=>“invalid_ticket”, “origin”=>“https://zammad.suedramol.de/”, “strategy”=>“saml”}

Steps to reproduce the behavior:

Happens every Morning, after reboot of zammad server the login works.

System Time of Microsoft ADFS Server is correct.
System Time of Zammad Server is correct.
Time Settings in Zammad settings is correct.
System Time of client is correct.

[MrGeneration]

@phil

Happens every Morning, after reboot of zammad server the login works.

This part kinda catches me.
What is different after rebooting your system in contrast to before?

This sounds like time drifts to be honest.

---

@phil

Current time is earlier than NotBefore condition (2020-09-02 06:24:51 UTC < 2020-09-02 06:24:51 UTC)

Sounds like omniauth-saml does check via < and not =< which would mean it requires your request to be answered a second later than actually happening. To be honest, I have no idea on how to help you. I guess that this is a third party problem with the gem possibly.

The problem is that I couldn’t find anything containing NotBefore within omniauth- and Zammad-repos - except for tests. Sorry that this doesn’t help at all.