While using Spring 4.x and SAML 2.0 I faced the following issue while integrating from the Identity Provider.
Caused by: org.opensaml.common.SAMLException: Response issue time is either too old or with date in the future, skew 60, time 2016-02-17T12:20:56.000Z.
I dig into the problem and found that it is possible clock of the Identity Provider (System) and Service Provider (System) might be out of synch causing the above error to get generated.
Solution for this is pretty simple you have to add a property responseSkew to WebSSOProfileConsumerImpl bean in the spring configuration, the time which you set is in seconds, so when I put in 60 for responseSkew property my problem got resolved.
<bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl">
<property name="responseSkew" value="60"/>
I hope this will solve your problem too.