Clock skew too great Authentication Origin: Application & API Last updated 13 Oct 2026

Kerberos: Clock skew too great (KRB_AP_ERR_SKEW)

The client’s clock differs from the domain controller’s by more than 5 minutes, so Kerberos tickets are rejected.

Exact message you may see Clock skew too greatkrb5_get_init_creds: Clock skew too great
Explore the map of this error Full error map →
Seen on: REST API

Meaning

Kerberos timestamps protect against replay. VMs resumed from suspend, containers with drifted clocks, or machines not syncing with the domain’s time source fail authentication (SSO, SMB, SQL Server, Hadoop).

Common causes

  • System clock drift (VMs, dual boot, containers)
  • Time zone misconfiguration
  • NTP not syncing with the domain hierarchy

⚡ Quick fix

  1. Sync time with the domain (w32tm /resync or NTP)
  2. Fix time zone settings
  3. Ensure VMs use host/NTP time sync

Detailed fix by platform

Windows

  1. powershell
    w32tm /query /status
w32tm /resync /force

Linux

  1. bash
    timedatectl
sudo chronyc tracking

How to diagnose

  1. Clocks — Client vs DC time
  2. Source — NTP configured?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

Illegal arguments: undefined, string — bcrypt error: Illegal arguments: undefined, string / data and salt arguments required / data and hash arguments required (Authentication)Illegal arguments: un…invalid two-factor code — Two-factor (TOTP) code invalid / Invalid verification code (authenticator app time drift) (Authentication)invalid two-factor co…jwt not active — NotBeforeError: jwt not active (nbf claim in the future) (Authentication)jwt not activeLDAP error code 49 — LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e (Authentication)LDAP error code 49NotAuthorizedException — AWS Cognito: NotAuthorizedException: Incorrect username or password (Authentication)NotAuthorizedExceptionSAML response invalid — SAML: Invalid SAML response — signature validation failed / audience mismatch / response expired (NotOnOrAfter) (Authentication)SAML response invalidUnable to verify secret hash for client — AWS Cognito: NotAuthorizedException: Unable to verify secret hash for client x (Authentication)Unable to verify secr…UserNotConfirmedException — AWS Cognito: UserNotConfirmedException: User is not confirmed. (Authentication)UserNotConfirmedExcep…Clock ske…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.