Admins: Shibboleth error “Message rejected, was issued in the future”

If you receive a shibboleth error that ends with “Message rejected, was issued in the future”, it is most likely that the clocks on your various systems need to be synchronized.  The Shibboleth Single Sign On (SSO) system needs the clocks to be within a certain tolerance of each other, or sign-ons do not work.

Upgrading Java on your IdP can be one solution.  The U.S. changed the dates that daylight savings time; newer versions of Java include this change.  See http://java.sun.com/javase/timezones/