{"record":{"id":"bd784b278bfc8ff2","repo":"theonedev/onedev","slug":"invalid-issue-date-of-id-token","errorCode":null,"errorMessage":"Invalid issue date of ID token","messagePattern":"Invalid issue date of ID token","errorType":"exception","errorClass":"AuthenticationException","httpStatus":null,"severity":"error","filePath":"server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java","lineNumber":225,"sourceCode":"\t\t\telse\n\t\t\t\treturn null;\n\t\t} else {\n\t\t\treturn null;\n\t\t}\n\t}\n\t\n\tprotected SsoAuthenticated processTokenResponse(OIDCTokenResponse tokenResponse) {\n\t\ttry {\n\t\t\tJWT idToken = tokenResponse.getOIDCTokens().getIDToken();\n\t\t\tJWTClaimsSet claims = idToken.getJWTClaimsSet();\n\t\t\t\n\t\t\tif (!claims.getIssuer().equals(getCachedProviderMetadata().getIssuer()))\n\t\t\t\tthrow new AuthenticationException(_T(\"Inconsistent issuer in provider metadata and ID token\"));\n\t\t\t\n\t\t\tDateTime now = new DateTime();\n\t\t\t\n\t\t\tif (claims.getIssueTime() != null && claims.getIssueTime().after(now.plusSeconds(10).toDate()))\n\t\t\t\tthrow new AuthenticationException(_T(\"Invalid issue date of ID token\"));\n\t\t\t\n\t\t\tif (claims.getExpirationTime() != null && now.toDate().after(claims.getExpirationTime()))\n\t\t\t\tthrow new AuthenticationException(_T(\"ID token was expired\"));\n\n\t\t\tSession.get().setAttribute(SESSION_ATTR_ID_TOKEN, idToken.serialize());\n\n\t\t\tString subject = claims.getSubject();\n\t\t\tString email = StringUtils.trimToNull(claims.getStringClaim(\"email\"));\n\n\t\t\tBoolean emailVerified = claims.getBooleanClaim(\"email_verified\");\n\t\t\tif (emailVerified == null)\n\t\t\t\temailVerified = claims.getBooleanClaim(\"emailVerified\");\n\t\t\tif (emailVerified != null && !emailVerified)\n\t\t\t\temail = null;\n\n\t\t\tString userName = StringUtils.trimToNull(claims.getStringClaim(\"preferred_username\"));\n\t\t\tString fullName = StringUtils.trimToNull(claims.getStringClaim(\"name\"));\n\t\t\tList<String> groups;","sourceCodeStart":207,"sourceCodeEnd":243,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-sso-openid/src/main/java/io/onedev/server/plugin/sso/openid/OpenIdConnector.java#L207-L243","documentation":"Thrown by OpenIdConnector.processTokenResponse when the ID token's iat (issue time) claim is in the future by more than a 10-second tolerance (now.plusSeconds(10)). The connector rejects tokens apparently issued in the future, which indicates clock skew or a forged/manipulated token.","triggerScenarios":"claims.getIssueTime() is after server time plus 10 seconds when the token response is processed — the identity provider's clock is ahead of the OneDev server clock, or a misbehaving proxy returned a cached/pre-issued token with a future iat.","commonSituations":"NTP not running or drifting on either the OneDev server or the identity provider host; containers with wrong timezone/clock settings; VM resumed from snapshot with skewed clock.","solutions":["Synchronize clocks with NTP on the OneDev server (e.g. systemd-timesyncd/chrony) and on the identity provider host.","Restart the SSO login to get a freshly issued token after fixing clock skew.","Check container/VM time settings (host clock passthrough, no paused/snapshotted clocks).","If skew is small and unavoidable, note the 10-second tolerance and reduce skew below it."],"exampleFix":"# before: clock skewed\n# after\nsudo chronyc makestep   # or configure NTP on the OneDev host","handlingStrategy":"retry","validationCode":"long skewMinutes = Math.abs(DateTime.now().getMillis() - System.currentTimeMillis());\n// verify host clock via NTP before SSO rollout: chronyc tracking / ntpq -p","typeGuard":null,"tryCatchPattern":"try {\n    auth = connector.handleAuthResponse(...);\n} catch (AuthenticationException e) {\n    if (e.getMessage().contains(\"Invalid issue date\")) {\n        // resync clocks (NTP) and retry login\n    }\n}","preventionTips":["Run NTP/chrony on the OneDev server and the identity provider.","Watch for VM snapshot/resume clock drift.","Keep container clocks synced with the host.","Alert on clock skew between SSO components."],"tags":["oidc","sso","clock-skew","token-validation"],"backgroundTag":"jwt-token-clock-skew","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}