SecureAuth API allowed Clock Skew

Version Affected:  All

Description:  

The SecureAuth API has a default maximum clock skew of 60 seconds. 

We generally recommend leaving this default in place and using NTP to ensure that there is no significant clock skew in your environment. 

However, NTP is not possible and correcting the clocks on 3rd parties interacting with the SecureAuth Api is not possible, you can increase the allowed clock skew.

Cause:  

Lack of NTP can cause a clock skew between the SecureAuth IdP and 3rd Parties.

Resolution:  

In the event that you cannot fix the clock skew, you can configure the realm to allow a larger clock skew.

1. Go to the Admin Console and Decrypt the Web.Config for the realm in question

2. Open the Web.Config in a text editor. The path is  D:\SecureAuth\SecureauthX\Web.config

3. Check if you already have the setting by searching for Api.HttpRequestValidityPeriodInMinutes

This should find the line

<add key="Api.HttpRequestValidityPeriodInMinutes" value="1" />

4. If you cannot find the appsetting, you will need to add it

5. Change the value to allow a larger clock skew. 5 minutes is a realistic maximum.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.