If the time on the web agent host machine differs from the Access Manager time, you might occasionally see an incorrect policy decision or an infinite re-direction. The following new property in AMAgent.properties adjusts the clock skew between the web agent and Access Manager machines:
com.sun.am.policy.agents.config.policy_clock_skew
This properties specifies the time in seconds used to adjust the time difference between the policy agent machine and the Access Manager machine, as follows:
Clock skew in seconds = AgentTime - AccessManagerTime
The default is zero (0).
You should also run a time syncing service to keep the time on the agent machine and the Access Manager machine as close as possible.