Trying to accept VPP Invitation - Error: Session Timed Out

[mhayden]

Hello - I have a few users who have been unable to accept the VPP enrollment invitations. Right now I have two users, a separate invitation and purchasing account for each. When they try to accept the VPP invitation, they are presented with the Terms screen, and tap "Accept". Then it only says "Your session has timed out. Try again."

I've tried all the solutions I found on the Apple support forums. On the iPads I tried moving the date ahead, moving the date back, signing out/in to iTunes and iCloud, and tapping "Send by email" on the terms screen (which results in "unable to send email"). Then I sent the invitation via email and tried to redeem it on the computer. I signed out of iTunes and clicked the link in the email and.... same error in the iTunes desktop app.) During this same time period I have had other users be able to accept the VPP invitation.

Edit: the account CAN download apps directly from the App Store without issue. It's only erroring on the VPP invitation Terms.

[gskibum]

I've seen firewalls and ad blockers have strange effects with the Apple Store. Perhaps look into ad blockers or move the devices outside the network?

[mhayden]

It seems more tied to the user than the devices themselves. Other users can accept the invitation ok, but these accounts cannot accept, on multiple devices. It's weird.

[brushj]

Just started seeing this as well. It didn't start until Apple's services were down the other day. We are also having issues with unlocking iPads that need to use the activation lock bypass code.

[jmahlman]

Has anyone had luck today? I'm getting this problem on an iPad now with a student ID.

[fslabaugh]

I am experiencing the same problem. Would love to know what we need to do to resolve the issue.

[jmahlman]

I was able to get one iPad added..but I'm still having more issues.

[galionschools]

I experienced the same issue on Friday with a student iPad and after some persistence was able to get it enrolled in VPP. I haven't had any issues since that one occurrence though.

[mhayden]

I was able to get mine enrolled by bringing them to my house. Which is so weird because it's not happening consistently to all users.

[brushj]

We have had similar issues since Apple's services went down last week. It seems to be only kids that were created last week according to the reports from my guys. I don't know that they have had anyone else new since then.

We were able to hook them up to a mifi and get them to enroll, our ISP is Brighthouse and the mifi provider is AT&T.

I was thinking about grabbing one that we have been using for testing home to see if it activates as I have the same ISP that we use at work.

We have ruled out the firewall and our web filter, iBoss, by adding the proxy manually to the iPad as we are still on 9.62. Anyone else on a similar version?

[btaitt]

Just want to bump this up and say that we are encountering the same issue and have been since last week. Our DEP was also temporarily down but eventually game back after rebooting our JSS. However we get "session timed out" when attempting to send out VPP invites.

[brushj]

We are still seeing the same issues with students and newly created teacher Apple ID's. Not sure what else to really check.

[sparedes]

Just logged in to say I have the same issue. Anyone found a solution?

[btaitt]

@sparedes I would talk to your Apple rep if you continue to have this issue.

Our Apple SE and our JAMF rep both had multiple customers with this problem and, as of yesterday morning, everyone who reported it say it is back to working. Our VPP is back to normal now. It's possible it could take a restart of your JSS, but it didn't for us.

[Simmo]

Just chiming in, also experiencing this issue, a restart of the JSS did not fix it.

[Simmo]

Just tried connecting via my phone as a hotspot and it seems to work, but instantly times out on the local network..

[Nazareth]

Same issue here and have been trying to sort the issue with the aid of Jamf, Apple and our local supplier.
VPP token has been updated/refreshed
Self service invites fail and time out
Email invites open itunes (added to firewall, running as administrator) but time out after accepting terms and conditions.
itunes diagnostics and the apple push diagnostics tools all pass without any errors.

I have been able to get 35 out of 300 working but there is no guarenteed method, all of a sudden Ill be able to register 10-15 devices ina short window then they'll all time out again.

One thing I have noticed:- When logging into itunes with the correct username and password it always fails the first time no matter how careful I am with typing that password in. The second attempt succeeds and passes me through to the terms and conditions.

On all the attempts that succeeded the authentication worked first time.

[mtward]

Just chiming in that I'm experiencing the exact issues as @Nazareth described. Haven't gotten the one VPP invite I'm trying to set up to accept though. Done thousands in the past months..

[mtward]

Set up a hotspot from My iPhone and joined the iPad to that. (Outward facing JSS) VPP invite accepted immediately with no issue. Hm.

We are completely exempted for any filtering on 17.0.0.0/8

[ShaneW]

Quick update to my above post.
I found that internet filters were causing the issue. This didnt make sense since it would accept 5-10 invitations every 24 hrs but then suddenly block them.
I investigated traffic coming from the IP of one of the ipads rather than from the user is was connected as. There are several attempts to connect to the apple servers as soon as the device boots up.

NTP (time protocol) - all this traffic gets denied by out filters due to a NTP vulnerability. We changed local DNS records to point NTP traffic to local servers (4 records) but the devices ignore this and connect via IP to these servers so they remained denied.

icloud-base and itunes-base IPs
Server connections here were getting blocked. Im assuming this is for device registration with apple. Once we passed all traffic through the filter for these 2 destinations the VPP invites started to work again with no time outs. (sometimes this required a hard reset of the device and clear all queues in Casper)

We now have 300+ devices working and have accepted invitations.

Few other things to be wary of:
Once the VPP invite is accepted there can be a delay before the assigned apps show up in "purchased" up to 3-4 hrs although this only occurred in about 10% of devices.
Some invites need to be resent for it to show up
Self Service invites required Self Service to be updated to the latest version

[mahughe]

just some info on what we've seen here experiencing the timeout upon accepting the VPP invitation..
We have opened a ticket w/ Apple on this issue. I have sent them logs from an iPad/Apple ID that is timing out on acceptance. They couldn't determine which end was causing the issue. I'm pretty confident that
our network is allowing all of the required traffic it should be for this process to work. It worked when we started our 1:1 iPad deployment back in Oct 2014, it failed sometime in March. As noted in this thread it worked for a short time after April 6th and now it is back to failing again.

In the talks I've had w/ Apple about this, it seems that engineering is aware of this but are unable to determine the root cause of the issue. They have requested Apple ID's to setup logging against those accounts on their end to see if they can capture any new data that might lead to a fix for this issue.

I would suggest that you open a ticket w/ Apple and see if you can get something like this going from your environment as well. The more data they can collect, the quicker the resolution comes hopefully.

[Simmo]

Just going to bump this up to see if anyone has resolved this issue as of yet?

[mahughe]

Oddly enough soon after I posted about this on 5/6 it started working. All I did was a reboot based on others in the thread mentioning it. I hadn't rebooted the JSS server in some time so I did just for grins, and for some reason students were able to accept and authenticate their VPP tokens and to date it is still functioning as it should. We've not heard anything back from Apple on this yet, but when I do I will pass that along. I was also contacted by our Apple SE this week informing me that he heard it was working again.

For the moment that's what I got on it...

[Simmo]

Strange.
I am fairly sure I have restarted the server since the issue started occurring, but I may have to give it a go.

[mahughe]

@Simmo...I'm not sure if that had anything to do with it or not, but what's it hurt to reboot was my thought. I had checked all of the resources on our end ie web filter, firewall, etc...

[ccoleman]

Same issue here.

Hotspot to a phone makes it work. Local filtering all ok. Nothing blocked.

Any ideas?