WSO2IS 5.3.0 - Federated SAML & Enable Authentication Request Signing

user_1344831 0
Viewed 50

I am trying to set up a federated SAML connection in WSO2IS 5.3.0 with Authentication Request Signing enabled. Per the doc https://is.docs.wso2.com/en/latest/learn/configuring-saml-2.0-web-sso/

"Selecting this checkbox enables you to sign the authentication request. If this is enabled, you must sign the request using the private key of the identity provider."

I do have a certificate that I've shared with the federated IDP. However, I am not sure where I need to add the private key that is being referred to on the WSO2 side. I have added it to the global keystore (in <WSO2IS_HOME>/repository/security/wso2carbon.jks ), but that does not seem to be working.

If there is other documentation I'm not finding, or if I could be pointed to the code that does the signing, that'd be helpful. Thanks in advance

wso2-identity-server wso2
1 Answers

Based on this code DefaultSAML2SSOManager.java I was able to determine the steps I needed to take:

If you require the private key to be associated with just a single tenant (which was my case), it needs to be added to the tenant's keystore. This means that the default tenant keystore needs to be replaced with a keystore with this private key (with the same name based on this code X509CredentialImpl.java ). I followed the steps here to do this http://xacmlinfo.org/2014/11/05/how-to-changing-the-primary-keystore-of-a-tenant-in-carbon-products/

If the private key can be global, the application-authenticator.xml file in <WSO2IS_HOME>/repository/conf/identity needs to be updated to have the "SignAuth2SAMLUsingSuperTenant" attribute be true (I did not need this so I did not test it, so take this with a grain of salt).

user_13448310
Related