{"record":{"id":"c8b1f507d77a7fc9","repo":"RocketChat/Rocket.Chat","slug":"notbefore-notonorafter-assertion-failed","errorCode":null,"errorMessage":"NotBefore / NotOnOrAfter assertion failed","messagePattern":"NotBefore / NotOnOrAfter assertion failed","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"apps/meteor/server/lib/saml/lib/parsers/Response.ts","lineNumber":431,"sourceCode":"\t\t\t\tif (err) {\n\t\t\t\t\tSAMLUtils.error({ err });\n\t\t\t\t}\n\t\t\t\tsubject = new xmldom.DOMParser().parseFromString(result, 'text/xml');\n\t\t\t});\n\t\t}\n\n\t\treturn subject;\n\t}\n\n\tprivate validateSubjectConditions(subject: XmlParent): void {\n\t\tconst subjectConfirmation = subject.getElementsByTagNameNS('urn:oasis:names:tc:SAML:2.0:assertion', 'SubjectConfirmation')[0];\n\t\tif (subjectConfirmation) {\n\t\t\tconst subjectConfirmationData = subjectConfirmation.getElementsByTagNameNS(\n\t\t\t\t'urn:oasis:names:tc:SAML:2.0:assertion',\n\t\t\t\t'SubjectConfirmationData',\n\t\t\t)[0];\n\t\t\tif (subjectConfirmationData && !this.validateNotBeforeNotOnOrAfterAssertions(subjectConfirmationData)) {\n\t\t\t\tthrow new Error('NotBefore / NotOnOrAfter assertion failed');\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate validateNotBeforeNotOnOrAfterAssertions(element: Element): boolean {\n\t\tconst sysnow = new Date();\n\t\tconst allowedclockdrift = this.serviceProviderOptions.allowedClockDrift || 0;\n\n\t\tconst now = new Date(sysnow.getTime() + allowedclockdrift);\n\n\t\tif (element.hasAttribute('NotBefore')) {\n\t\t\tconst notBefore: string | null = element.getAttribute('NotBefore');\n\n\t\t\tif (!notBefore) {\n\t\t\t\treturn false;\n\t\t\t}\n\n\t\t\tconst date = new Date(notBefore);","sourceCodeStart":413,"sourceCodeEnd":449,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0/apps/meteor/server/lib/saml/lib/parsers/Response.ts#L413-L449","documentation":"Error \"NotBefore / NotOnOrAfter assertion failed\" thrown in RocketChat/Rocket.Chat.","triggerScenarios":"Thrown when the current time falls outside the SAML assertion's NotBefore/NotOnOrAfter validity window.","commonSituations":"See trigger scenarios.","solutions":["Synchronize clocks (NTP) between IdP and SP, or increase the allowed clock drift in the SAML settings."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b2c16d5842cbe6b69b59bdf6fc5e5f1afcd1f0b0","analyzedAt":"2026-08-18T15:26:39.429Z","contentChangedAt":"2026-08-18T15:26:39.429Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}