KB485260: Response issue time is either too old or with date in the future, skew 60 prevents users from logging in using SAML authentication in MicroStrategy 10.6 and above

SUMMARY

Users can’t log in to Strategy Web/Library/Mobile using SAML authentication. After authenticating on the IDP provider page, the following error message shows in the interface:

"Error in login"

Please contact your administrator

Reviewing the SAML log, the following error is logged when validating the SAML message:

Error validating SAML message 

org.opensaml.common.SAMLException: Response issue time is either too old or with date in the future, skew 60

ROOT CAUSE

When SAML authentication is done, there is a default response skew allowance of 60 seconds against the client. This error will occur when this allowance is exceeded, usually due to the IDP and SP having different time clocks.
 

SOLUTION

1.    Make a backup of the SpringSAMLConfig.xml located under WEB-INF/classes/resources/SAML
2.    Open the file and locate the following beans:

• 
  <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/>

  
  update it to:

<bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
<property name="maxAuthenticationAge" value="2592000"/> <!-- 30 days --><property name="responseSkew" value="300"/>
</bean>

 
 

• 
  <bean id="logoutprofile" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl"/>

  
  update it to:

<bean id="logoutprofile" class="org.springframework.security.saml.websso.SingleLogoutProfileImpl">
<property name="responseSkew" value="300"/>
</bean>

​​​​​​​