Error:
'Response doesn't have any valid assertion which would pass subject validation caused by Authentication statement is too old to be used with value {date/time would be specified here}'
This error happens because the Identity Provider (IDP) is re-using information that the user has authenticated earlier. This is indicated by the Authentication Instant in the SAML response.
These steps are designed for someone who understands your Mosaic installation, you may need to pass these to your local IT team.
As a work around, change the validity time period in seconds for Authentication received by Mosaic so it exceeds the period used by ADFS. The default in Mosaic SAML if this property is not set is 7200 seconds. The default in ADFS is 28800 seconds.
Locate the saml.properties file on the Mosaic application server. The path to the file will be in the Server Start arguments for the Mosaic managed server in Weblogic. For example:
--Djava.security.auth.saml.config=/u01/apps/oracle/wls12/wls_domains/mosaic_domain/saml.properties
Edit the file saml.properties and increase the value of mosaicSamlMaxAuthenticationAge to be equal to or greater than the assertion validity time of the IDP. For example, this has the age set to 30000.
#Be careful to avoid any trailing whitespace!
mosaicSamlEntityBaseUrl=https://mosaic.corelogiccloud.co.uk/mosprod
mosaicSamlNameIDFormat=EMAIL
mosaicSamlMappingAttribute=nameid
mosaicSamlRequestSigned=false
mosaicSamlIdPMetadataLocation=/u01/apps/oracle/wls12/wls_domains/mosaic_domain/security/idp-adfs.xml
mosaicSamlKeyStoreLocation=/u01/apps/oracle/wls12/wls_domains/mosaic_domain/security/samlKeystore.jks
mosaicSamlKeystorePassword=mykeystorepassword
mosaicSamlKeystoreCertificateAlias=mycertificate
mosaicSamlKeystoreCertificatePassword=mycertificatepassword
mosaicSamlContextProviderLBScheme=https
mosaicSamlContextProviderLBServerName=mosaic.corelogiccloud.co.uk
mosaicSamlContextProviderLBServerPort=443
mosaicSamlContextProviderLBIncludeServerPortInRequestURL=true
mosaicSamlContextProviderLBContextPath=/mosprod
mosaicSamlMaxAuthenticationAge=30000
mosaicSamlInResponseToChecks=falseRestart the manager server in Weblogic.