With forms based auth, if browser is more than 20 mins in a future compared to server, correct authentication is successful but ipa_session immediately expires because it's life time is only 20 mins (expiration time is declared by server).

In other words, user can't log in with "your session has expired" error message.

Web UI could detect this time difference by comparing date header of HTTP response[1] with current browser time and then warn the user.

var date = new Date(xhr.getResponseHeader('Date'));
var diff = Date.now() - date.getTime();
var minutes = diff / 1000 / 60;

[1] https://tools.ietf.org/html/rfc2616#section-14.18