In Environments configured to use Single Sign-On (SSO) authentication for Engine users, the following event may be encountered during a login attempt:
Error Status 400 BAD_REQUEST Error Bad Request Message Validation Errors: 1. Issue time is either too old or in the future: <date and timestamp>
This behavior will affect all Admin users, though System Setup will still be accessible for Sysadmin users.
This event will only occur in SSO-enabled Engines (either via explicit SSO configuration or via Delphix Data Control Tower (DCT)).
Engine configurations using local authentication only would not be expected to encounter this behavior.
Applicable Delphix Versions
- Click here to view the versions of the Delphix engine to which this article applies
Major Release All Sub Releases 6.0 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52
184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52, 184.108.40.206, 220.127.116.11, 18.104.22.168, 22.214.171.124, 126.96.36.199, 188.8.131.52
The error is ultimately a result of a time difference between the Engine(s) of concern and the user-configured IdP time. This can occur when an Engine does not use NTP, the IdP and/or Engine NTP server configurations are not correct / functional, or as a result of a system time change on the Engine.
To correct this issue, the Engine time should be compared with the IdP and adjusted accordingly. If NTP is not in use, it is strongly recommended to enable this as a proactive measure to prevent excessive time drift.
Modifications to the Engine time, either by manually changing the system time or by updating the NTP server will temporarily interrupt the GUI and CLI interfaces as the software services are restarted; however, this will not impact running VDBs, and this will be indicated in the GUI when committing the configuration change.
Additionally, it may be considered to increase the allowable time drift / skew in the Engine. The default SSO time drift / skew allowable by the Delphix Engine IdP configuration is 2 minutes. This can be modified in Delphix Engine versions 184.108.40.206 and later in the Authentication configuration interface under System Setup. Under this panel, expanding the Advanced drop-down will expose the following parameters:
Response skew time - maximum allowable time difference between SAML response and Engine current time.
Maximum age of IdP authentication - allowable time in the past to accept authentication to the IdP
The following articles may provide more information or related information to this article:
- Delphix Documentation - Configuring Single Sign-on
- Delphix Knowledge Base - Authentication Statement is Too Old to be Used Error Occurs During SSO Login When Engine Configured in Data Control Tower (formerly Central Management) (KBA6966)