SAML SSO with Keycloak returns HTTP 500 after fixing clock skew

Products Endpoint Protector Discussions & Questions
1

Setup

  • Endpoint Protector virtual appliance on VMware ESXi
  • Keycloak as SAML 2.0 Identity Provider, configured via the Okta profile
  • Internal test environment

What happens

SSO login fails, and the failure mode changes depending on the appliance clock:

  • Appliance clock off by 1h42m: EPP shows the regular SSO error page (“There has been an issue with your Single Sign On Process”).
  • Appliance clock synchronised to the IdP (0 seconds difference): EPP returns “Oops! An Error Occurred - The server returned a 500 Internal Server Error”.

Both reproduced twice, each matching the state of the clock.

What I already checked

  • The clock skew is fixed. The default NTP server (pool.ntp.org) is not reachable from this network segment, so I replaced it with an internal NTP server under Appliance > Server Maintenance > Time Zone. Both clocks now match to the second, verified in UTC on both sides.
  • On the Keycloak side, a client session for the Endpoint Protector service is created on every attempt. So the IdP authenticates the user and issues the assertion - the failure happens inside EPP after the assertion is received.
  • Identity and attribute matching: four different configurations were tested earlier, all failed identically while the clock was still wrong.

Questions

  1. Has anyone seen a 500 on the SSO callback with a correctly synchronised clock?
  2. Where does the appliance log SAML processing errors when SSH access is not available?
2

Hi Fabian!

Thank you for reaching out and welcome to the Netwrix Community!

Please allow me to double check on the scenario you described and I will get back to you on this topic.

3

Super Thanks!!

4

Hi Fabian!

Apologies for the late reply on this.

After checking internally, given that the issue you raised will require further investigation, our advice for you is to open a Support ticket from the Support Portal, so out Support Team can take a closer look at the issue that you described.