We are using Keycloak as our SAML iDP. An issue we keep running into is the iDP server stays synced on time, however some of the clients drift enough to be caught outside the SAML NotBefore condition. We have yet to find a way to apply a clock skew to the individual SAML clients. Currently on V13 (I know we need to update and that’s in the pipeline) running wildfly standalone. Any help would be appreciated!
It’s NTP on the servers not having time sync. Not a Keycloak event per se.
I understand that. Unfortunately we don’t have the means to enforce NTP on some of the clients servers. I’m hoping there’s a way we can modify the NotBefore and NotAfter in the SAML response to compensate for this.