I am not able to log in my Jenkins instance using SAML as Security Authentication. The following stack trace can be seen after trying to log in:
Current assertion validation failed, continue with the next one org.pac4j.saml.exceptions.SamlException: Authentication issue instant is too old or in the future
CloudBees Jenkins Enterprise (CJE)
CloudBees Operations Center (CJOC)
This type of message can be related to:
System clocks on the computer running Jenkins Server and the computer running the Identity Provider (IdP) are out of sync.
User token gets expired.
Maximum authentication time defined in the SAML client does not cover SAML IdPs. Maximum authentication time is the number of seconds since user was authenticated in IdP while his authentication is considering as active.
To validate if servers are sync,
ssh each of the servers and validate result of execute
date in their respective terminals. Timezone is not relevant here (it is recommended to be in UTC tough), but timedate value, meaning that if they are in different timezones and after applying conversion factor the should have the same timedate values.
If they are not sync, use the Network Time Protocol daemon (NTPD) is a service that performs time synchronization of networked servers to Coordinated Universal Time (UTC). Using NTP helps mitigate the effects of network latency by synchronizing your network with accurate time servers.
How to install it NTPD
Install NTPD in each of the machines is running services to integrate: IdP Provider as well as Jenkins in this case.
If you install the NTP service after IdP Provider/Jenkins has already been installed in your network, you should restart the IdP Provider/Jenkin service after NTP has been successfully installed.
CentOS or RHEL servers
1. Install it by
sudo yum install -y ntp
2. Check that the service is up and running by:
sudo service ntpd status
Maximum authentication time
Different SAML IdPs retains users logins for different period of times.
SAML plugin default value is set to 1 day (24 h x 60 min x 60 sec = 86400 sec). At the moment of writing this article (SAML version 0.13), the maximun value allowed is 24 days (24 days x 24 h x 60 min x 60 sec = 2073600). To update it, go to Jenkins Configure Global Security > Security Realm > SAML Identity Provider Settings > set Maximum Authentication Lifetime.
The next release of SAML plugin will tackle it by configuring the forceAuth parameter or the session timeout, see JENKINS-38971.
In the meantime for SAML IdPs that retains users logins for more than 24 days, like Azure AD which its default is 90 days (see JENKINS-37289), there are two possible workarounds:
On the IdP side, decrease the time users are being retained to a value less than 24 days.
Delete browser cookies and login again.