Intermittent Error "The sign-in was unsuccessful" Or "Authentication statement is too old to be used with value" Logging in to Tableau Online with SAML

Issue

When attempting to log in to Tableau Online using SAML the log in request redirects to the log in screen or the following error might occur:

"The sign-in was unsuccessful. Try again."

Additionally, the following error will be seen in the authentication.log file:

"Authentication statement is too old to be used with value."

Environment

Tableau Online
SAML

Resolution

Option 1

Configure the token maximum age on the IdP to be 24 days or less (2073600 seconds).

Option 2

Clear your browser cache and then attempt to log in again from Tableau Online.

Option 3

Sign out of the Identity Provider (IdP)
Clear your browser cache.
Then attempt to log in again from Tableau Online.

Cause

If the IdP or AD has the setting for the maximum age of tokens set to a greater length of time than the maximum age setting on Tableau Online (2073600 seconds), then Tableau Online does not recognize the token as valid (even though the IdP sees the token as valid.)

Additional Information

See Intermittent Error "Unable to Sign In" with SAML SSO on Tableau Server in the Tableau Knowledge Base for more information about such tokens. 18858
If using Azure Active Directory, set the MaxAgeSessionSingleFactor to 24 days / 576 hours. See Configurable token lifetimes in Azure Active Directory (Preview) for more information.

Discuss this article... Feedback Forum