Troubleshooting

Expired / not yet valid assertion (NotBefore, NotOnOrAfter)

The clocks of the application server and the IdP are not synchronised, or the validity period is very short.

"Assertion expired" / "not yet valid" (NotBefore, NotOnOrAfter)NotBefore, NotOnOrAfter

Probable cause. The application server and IdP clocks are not synchronised, or the validity period is very short.

What to do? Synchronise the servers (NTP). Allow a tolerance of 2 to 5 minutes on the application side. Only lengthen the validity on the IdP side as a last resort.

To see exactly which check fails, paste the response into theanalyseur, or paste the message into the diagnostic.

Related errors

All SAML and OpenID Connect errors

Want to see it for real? ID-Kit plays the role you are missing and shows you each step.

Open my spaceDecode a SAML response