Troubleshooting: Clock Skew of Message Is Outside Threshold During API Call

Version Affected: All
 
 

Overview

This article explains how to resolve a 401 error that occurs when calling the SecureAuth API:

Response Mainpart: {"status":"invalid","message":"Clock skew of message is outside threshold."}

For a related but distinct clock-skew issue that shows up as an OIDC application rejecting a token rather than a direct API call failing, see Troubleshooting: OIDC Application Logs Show "No Token Present. Request Is Not Authorized."

Cause

A time drift exists between the server initiating the API call and the Identity Provider (IdP) server. The SecureAuth API rejects the call if that time difference is larger than the allowed clock skew.

Resolution:

To resolve this:

1. Sync the clock on the server initiating the API call with the IdP server, using Network Time Protocol (NTP), so the time difference falls within the allowed clock skew.
2. If NTP is not possible and the clocks cannot otherwise be corrected, the allowed clock skew can be increased instead — see How To: Increase the Allowed Clock Skew for API Calls.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.