RocketChat/Rocket.Chat · error · Error

NotBefore / NotOnOrAfter assertion failed

Error message

NotBefore / NotOnOrAfter assertion failed

What it means

Error "NotBefore / NotOnOrAfter assertion failed" thrown in RocketChat/Rocket.Chat.

Source

Thrown at apps/meteor/server/lib/saml/lib/parsers/Response.ts:431

				if (err) {
					SAMLUtils.error({ err });
				}
				subject = new xmldom.DOMParser().parseFromString(result, 'text/xml');
			});
		}

		return subject;
	}

	private validateSubjectConditions(subject: XmlParent): void {
		const subjectConfirmation = subject.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'SubjectConfirmation')[0];
		if (subjectConfirmation) {
			const subjectConfirmationData = subjectConfirmation.getElementsByTagNameNS(
				'urn:oasis:names:tc:SAML:2.0:assertion',
				'SubjectConfirmationData',
			)[0];
			if (subjectConfirmationData && !this.validateNotBeforeNotOnOrAfterAssertions(subjectConfirmationData)) {
				throw new Error('NotBefore / NotOnOrAfter assertion failed');
			}
		}
	}

	private validateNotBeforeNotOnOrAfterAssertions(element: Element): boolean {
		const sysnow = new Date();
		const allowedclockdrift = this.serviceProviderOptions.allowedClockDrift || 0;

		const now = new Date(sysnow.getTime() + allowedclockdrift);

		if (element.hasAttribute('NotBefore')) {
			const notBefore: string | null = element.getAttribute('NotBefore');

			if (!notBefore) {
				return false;
			}

			const date = new Date(notBefore);

View on GitHub (pinned to b2c16d5842)

Solutions

1. Synchronize clocks (NTP) between IdP and SP, or increase the allowed clock drift in the SAML settings.

When it happens

Trigger: Thrown when the current time falls outside the SAML assertion's NotBefore/NotOnOrAfter validity window.

Common situations: See trigger scenarios.

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/c8b1f507d77a7fc9. Report an issue: GitHub.