If you are unable to configure your SAML provider you may configure the appliance to accept a larger time skew.
SAML has strict settings for time skews that can result in errors when a user attempts to log in. This will occur if the Resilient Appliance’s time is out of sync with the Identity Provider’s time. This scenario can result in login failure. To prevent such errors, you can either adjust the Identity Provider’s skew value or set an allowable skew using the co3util tool. For example:
- To see current configuration, if any:
sudo resutil configget -key saml.allowed_clock_skew_millis
- To set it to 30 second timeout:
sudo resutil configset -key saml.allowed_clock_skew_millis -ivalue 30000
- To backout, remove, the SAML timeout configuration:
resutil configset -key saml.allowed_clock_skew_millis -delete