<div dir="ltr">Thanks, let me try it...</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Sep 17, 2021 at 10:23 AM Adam Pawlowski <<a href="mailto:ajp26@buffalo.edu">ajp26@buffalo.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">





<div lang="EN-US">
<div class="gmail-m_3847034374375568200WordSection1">
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Ask whoever runs the IDP to add a skew or offset to the relationship that you’re using.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">It is not feasible for the things to be exactly in sync to high precision at all times, and this comes up using timing from VMWare, mixed sources etc.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">With ADFS the property is NotBeforeSkew, which you can give a minute or whatever you’re comfortable with, which should alleviate this issue.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Best,<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)">Adam Pawlowski<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(31,73,125)"><u></u> <u></u></span></p>
<div style="border-top:none;border-right:none;border-bottom:none;border-left:1.5pt solid blue;padding:0in 0in 0in 4pt">
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>>
<b>On Behalf Of </b>Jonathan Charles<br>
<b>Sent:</b> Friday, September 17, 2021 9:00 AM<br>
<b>To:</b> Kent Roberts <<a href="mailto:kent@fredf.org" target="_blank">kent@fredf.org</a>><br>
<b>Cc:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b> Re: [cisco-voip] [External] Error Processing SAML Response<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">The error message in the Cisco traces (SSO) is:<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">2021-09-15 16:07:43,791 DEBUG [http-nio-81-exec-22] fappend.SamlLogger - SAML2Utils.checkConditions: <span style="background:yellow">NotOnOrAfter Condition = Wed Sep 15 22:07:44
 UTC 2021</span>   <b><i><u>-  this time is 17:07:44 CDT</u></i></b><u></u><u></u></p>
<p class="MsoNormal">2021-09-15 16:07:43,791 DEBUG [http-nio-81-exec-22] fappend.SamlLogger - SAML2Utils.checkConditions: <span style="background:yellow">NotBefore Condition = Wed Sep 15 21:07:44 UTC
 2021</span>      <b><i><u>-  this time is 16:07:44 CDT</u></i></b><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif">2021-09-15 15:25:10,642 ERROR [http-nio-81-exec-10] authentication.SAMLAuthenticator - Error while processing saml response The time in the Assertion's Condition is invalid.<br>
com.sun.identity.saml2.common.SAML2Exception: The time in the Assertion's Condition is invalid.<u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif">Basically what appears to be occurring is we get a NotBefore of 1 second after our request came in (16:07:43) and it gets killed....<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif">The real question is what they need to do on the ADFS side to fix this... why are they sending us a time in the future? The argument is NTP is off by one second for one of
 the servers (all of them show synched)...<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;font-family:"Segoe UI",sans-serif">Jonathan<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">On Thu, Sep 16, 2021 at 8:29 PM Kent Roberts <<a href="mailto:kent@fredf.org" target="_blank">kent@fredf.org</a>> wrote:<u></u><u></u></p>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">Oh, ok if I mis-understood then, yes a SAML trace would be good, as well as knowing is this new or did it work.   Seems similar to what I have seen in UCCE with the packet stuff not signed or wrong encryption type… course thats UCCE vs
 CUCM,  but usually cucm just works…<u></u><u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><br>
<br>
<u></u><u></u></p>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<p class="MsoNormal">On Sep 16, 2021, at 6:45 PM, Johnson, Tim <<a href="mailto:johns10t@cmich.edu" target="_blank">johns10t@cmich.edu</a>> wrote:<u></u><u></u></p>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Nah, looks like he said logging into CCM Admin pages, with AD accounts, so all areas of the web UI (I believe). The NTP errors that I’ve seen are presented as SAML assertion
 errors.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">I’m curious if this is a new SSO config, or if it was working properly and something’s changed.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<div>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>> <b>On
 Behalf Of </b>Kent Roberts<br>
<b>Sent:</b> Thursday, September 16, 2021 8:37 PM<br>
<b>To:</b> Matthew Loraditch <<a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a>><br>
<b>Cc:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b> [External] Re: [cisco-voip] Error Processing SAML Response<u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Remember he said it also was happening on the CUCM Admin account which has nothing to do with SSO/SAML.   So means its most likely internal to cucm...<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12pt"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
</div>
<blockquote style="margin-top:5pt;margin-bottom:5pt">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">On Sep 16, 2021, at 4:36 PM, Matthew Loraditch <<a href="mailto:MLoraditch@heliontechnologies.com" target="_blank">MLoraditch@heliontechnologies.com</a>> wrote:<u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:9pt;font-family:Helvetica,sans-serif">The logs are pretty clear when its a time difference as the error. I’ve not seen it randomly occur but definitely the error will be it’s time and
 may even show the difference. </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:9pt;font-family:Helvetica,sans-serif"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:9pt;font-family:Helvetica,sans-serif">Its the 4j log file for sso I believe </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
</div>
<div id="gmail-m_3847034374375568200gmail-m_8328105353242076105ms-outlook-mobile-signature">
<div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Helvetica,sans-serif"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Helvetica,sans-serif">Get <a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Faka.ms%2Fo0ukef&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441778209%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=zpq5%2Fs6ztI5P7iDfkQxw4L9aC0M7j2PwPBjL19PE16s%3D&reserved=0" target="_blank">Outlook
 for iOS</a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<table border="0" cellspacing="0" cellpadding="0" width="0" style="width:700.5pt">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:0in 7.5pt 0in 0in">
<div>
<p class="MsoNormal"><span style="font-size:1pt;font-family:Calibri,sans-serif"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
<td style="padding:7.5pt 0in 7.5pt 7.5pt">
<table border="0" cellspacing="0" cellpadding="0" width="0" style="width:365.15pt">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<div>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(243,128,11)">Matthew Loraditch</span></b><b><span style="font-size:1pt;font-family:remialcxesans,serif;color:white">​</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<div>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:gray">Sr. Network Engineer</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in">
<div>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif;color:gray">(He/Him/His)</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:7.5pt 0in 0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(243,128,11)">p:</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:gray"> <a href="tel:443.541.1518" target="_blank"><strong><span style="font-family:Calibri,sans-serif;color:gray;font-weight:normal;text-decoration:none">443.541.1518</span></strong></a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(243,128,11)">w:</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:gray"> <a href="https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heliontechnologies.com%2F&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441788204%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=qL4mHsUJu%2FhP8PN9bOmdi9hVrTDOTg%2FNwzN%2FMWCAmE0%3D&reserved=0" target="_blank"><strong><span style="font-family:Calibri,sans-serif;color:gray;font-weight:normal;text-decoration:none">www.heliontechnologies.com</span></strong></a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
<td valign="top" style="padding:0in">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:gray"> | </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
<td valign="top" style="padding:0in">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif;color:rgb(243,128,11)">e:</span><span style="font-size:11pt;font-family:Calibri,sans-serif;color:gray"> <a href="mailto:MLoraditch@heliontechnologies.com" target="_blank"><strong><span style="font-family:Calibri,sans-serif;color:gray;font-weight:normal;text-decoration:none">MLoraditch@heliontechnologies.com</span></strong></a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="bottom" style="padding:0in">
<div>
<p class="MsoNormal"><span style="font-size:1pt;font-family:Calibri,sans-serif"><a href="https://nam12.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.heliontechnologies.com%2F&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441798200%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=CdLKOTY3ZcCR9womF6wlOY6Im8RHC9Na6NkKQvLKjnk%3D&reserved=0" target="_blank"><span style="text-decoration:none"><image657209.png></span></a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0" width="0" style="width:365.15pt">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:7.5pt 0in">
<table border="0" cellspacing="0" cellpadding="0">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0" width="0" style="width:13.5pt">
<tbody>
<tr>
<td valign="top" style="padding:0in">
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:1pt;font-family:Calibri,sans-serif"><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffacebook.com%2Fheliontech&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441798200%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=fatJj8XLG3VtCaEsjQ1W63TsC3bg%2BqxK0Y%2FoSis459A%3D&reserved=0" target="_blank"><span style="text-decoration:none"><image487691.png></span></a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0" width="0" style="width:15.75pt">
<tbody>
<tr>
<td valign="top" style="padding:0in 2.25pt 0in 0in">
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:1pt;font-family:Calibri,sans-serif"><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Fheliontech&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441808197%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=WkZXjBTTiA6DJ0wsUiPqQ3NEE3Q%2FPnv56rQ4t7UzmX4%3D&reserved=0" target="_blank"><span style="text-decoration:none"><image529913.png></span></a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</td>
</tr>
</tbody>
</table>
</td>
<td valign="top" style="padding:0in">
<table border="0" cellspacing="0" cellpadding="0" width="0" style="width:15.75pt">
<tbody>
<tr>
<td valign="top" style="padding:0in 2.25pt 0in 0in">
<p class="MsoNormal" align="center" style="text-align:center"><span style="font-size:1pt;font-family:Calibri,sans-serif"><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.linkedin.com%2Fcompany%2Fhelion-technologies&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441818192%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=bfoWXKNlvRYyT1LghENvfegHTWdy3e26GZm4H0wW2Bo%3D&reserved=0" target="_blank"><span style="text-decoration:none"><image776611.png></span></a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:11pt;font-family:Calibri,sans-serif">
<hr size="2" width="915" style="width:686.5pt" align="center">
</span></div>
<div id="gmail-m_3847034374375568200gmail-m_8328105353242076105divRplyFwdMsg">
<div>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>>
 on behalf of Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>><br>
<b>Sent:</b> Thursday, September 16, 2021 4:32:12 PM<br>
<b>To:</b> Jonathan Charles <<a href="mailto:jonvoip@gmail.com" target="_blank">jonvoip@gmail.com</a>>; Benjamin Turner <<a href="mailto:benmturner@hotmail.com" target="_blank">benmturner@hotmail.com</a>><br>
<b>Cc:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a> <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> Re: [cisco-voip] Error Processing SAML Response<u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Helvetica,sans-serif"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Helvetica,sans-serif"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
<div style="border:1pt solid rgb(156,101,0);padding:2pt">
<div>
<p class="MsoNormal" style="line-height:12pt;background:rgb(255,235,156)"><span style="font-size:10pt;font-family:Calibri,sans-serif;color:rgb(156,101,0)">[EXTERNAL]</span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Helvetica,sans-serif"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Helvetica,sans-serif"> </span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Have you been able to confirm the time difference?<u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">I’m not trying to take their side of things, but if it’s minutes off, I wouldn’t doubt that’s possible. SSO is highly secure, right? A time difference might be enough to throw
 it off?<u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Here’s  reference:<u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.pingidentity.com%2Fs%2Farticle%2FAccounting-for-Time-Drift-Between-SAML-Endpoints50907&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441818192%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=Y0eG9Ol%2Bk%2FORNNl1SayhCejzMfOSzJqldNLDpathMuI%3D&reserved=0" target="_blank">https://support.pingidentity.com/s/article/Accounting-for-Time-Drift-Between-SAML-Endpoints50907</a><u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>> <b>On
 Behalf Of </b>Jonathan Charles<br>
<b>Sent:</b> Thursday, September 16, 2021 6:23 PM<br>
<b>To:</b> Benjamin Turner <<a href="mailto:benmturner@hotmail.com" target="_blank">benmturner@hotmail.com</a>><br>
<b>Cc:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<b>Subject:</b> Re: [cisco-voip] Error Processing SAML Response<u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div style="border:1pt solid rgb(156,101,0);padding:2pt">
<div>
<div>
<p class="MsoNormal" style="line-height:12pt;background:rgb(255,235,156)"><b><span style="font-size:10pt;font-family:Calibri,sans-serif">CAUTION:</span></b><span style="font-size:10pt;font-family:Calibri,sans-serif"> This email originated from outside of the
 University of Guelph. Do not click links or open attachments unless you recognize the sender and know the content is safe. If in doubt, forward suspicious emails to <a href="mailto:IThelp@uoguelph.ca" target="_blank">IThelp@uoguelph.ca</a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">No... TBH, I have never heard of it...<u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">TAC is hyper-asserting that the issue is time mismatch between CUCM/CUC and ADFS... <u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Jonathan<u></u><u></u></span></p>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">On Thu, Sep 16, 2021 at 4:08 PM Benjamin Turner <<a href="mailto:benmturner@hotmail.com" target="_blank">benmturner@hotmail.com</a>> wrote:<u></u><u></u></span></p>
</div>
</div>
</div>
<blockquote style="border-top:none;border-right:none;border-bottom:none;border-left:1pt solid rgb(204,204,204);padding:0in 0in 0in 6pt;margin:5pt 0in 5pt 4.8pt">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Have you tried to run a SAML Tracer? <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div id="gmail-m_3847034374375568200gmail-m_8328105353242076105x_gmail-m_6287419307271280829ms-outlook-mobile-signature">
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Sincerely,<br>
Benjamin M. Turner<u></u><u></u></span></p>
</div>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:11pt;font-family:Calibri,sans-serif">
<hr size="2" width="98%" align="center">
</span></div>
<div id="gmail-m_3847034374375568200gmail-m_8328105353242076105x_gmail-m_6287419307271280829divRplyFwdMsg">
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> cisco-voip <<a href="mailto:cisco-voip-bounces@puck.nether.net" target="_blank">cisco-voip-bounces@puck.nether.net</a>>
 on behalf of Jonathan Charles <<a href="mailto:jonvoip@gmail.com" target="_blank">jonvoip@gmail.com</a>><br>
<b>Sent:</b> Thursday, September 16, 2021 4:56:48 PM<br>
<b>To:</b> <a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a> <<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a>><br>
<b>Subject:</b> [cisco-voip] Error Processing SAML Response<u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">So, users are randomly getting the above error when logging into CUCM UCMUser or CUC Inbox... we are also getting it using AD credentials into admin pages for CUCM/CUC/etc.<u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">For a user, it will work find repeatedly, then you will get the error, close your browser, and reopen, still get the error for a few minutes. Then later it will work. When
 a user is affected, other users work fine.<u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">TAC is saying it is an NTP issue, however, NTP between CUCM 12.5 and IdP (ADFS 2.0) is fine.<u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Pings are around 1ms between servers.<u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Any ideas?<u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">Jonathan<u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"> <u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9pt;font-family:Helvetica,sans-serif">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441828188%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=Fuo8Su5KRFqH66Rs6dvG3sr9oMn9WfO22Zea71mBssc%3D&reserved=0" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a></span><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u><u></u></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net" target="_blank">cisco-voip@puck.nether.net</a><br>
<a href="https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fpuck.nether.net%2Fmailman%2Flistinfo%2Fcisco-voip&data=04%7C01%7Cajp26%40buffalo.edu%7C1963a460d0994b71bb6f08d979db7c94%7C96464a8af8ed40b199e25f6b50a20250%7C0%7C0%7C637674806441838182%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C2000&sdata=mco%2B8WqxUFyYE0I2abCKnh2WJL8iT7QV29j4%2Bg0Doos%3D&reserved=0" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><u></u><u></u></p>
</blockquote>
</div>
</div>
</div>
</div>

</blockquote></div>