Municipal SSO logins start failing with token validation errors after app nodes drifted several minutes away from the identity provider's clock. What is the most appropriate fix?
Select an answer to reveal the explanation.
Short Explanation
Auth tokens are picky about time—like tickets that expire if your watch is wrong. When app servers drift from the IdP, sync their clocks with NTP and the handshakes usually calm down.
Full Explanation
Many federation and token protocols reject assertions when skew between the relying party and the identity provider exceeds allowed tolerance. Restoring NTP or cloud time sync on the application nodes corrects the skew without weakening authentication. Disabling MFA, opening all egress, or permanently downgrading to basic auth are insecure and do not address clock drift.