Potentially a time synchronization / clock drift issue. SAML tokens have a validity window as a security measure to prevent token replay (and other such) attacks. If the client's time is ahead of the server, the server could send a token that the client thinks is already expired. There are various flavors of this. But start by checking for any time differences between any of the machines involved in the SAML handshake, and then check those against authoritative NIST NTP time.