Restriction on "NotBefore" in your assertion seems to be too severe. The value may be set to SAML assertion's created time. As long as the same NTP server is not referenced, there often are some time synchronization deviations between the servers. Our server got your SAML assertion about 20 secons before "NotBefore" in the assertion. Could you mind relaxing the restriction on "NotBefore" a little? Thanks.