System time synchronization and claims-based authentication
The system time on the computer running the security token service (STS) must be synchronized with the computer running Microsoft Dynamics CRM. Servers on the same domain are normally synchronized automatically through the Windows Time service. If your STS server and Microsoft Dynamics CRM Server 2011 are on separate domains, you should periodically monitor the system time on the two servers to ensure that the time difference is not greater than 5 minutes.