45 lines
2.4 KiB
Text
45 lines
2.4 KiB
Text
[[_sp-idp-keys]]
|
|
|
|
===== IDP Keys sub element
|
|
|
|
The Keys sub element of IDP is only used to define the certificate or public key to use to verify documents signed by the IDP.
|
|
It is defined in the same way as the <<fake/../../../../saml/java/general-config/sp-keys.adoc#_saml-sp-keys,SP's Keys element>>.
|
|
But again, you only have to define one certificate or public key reference. Note that, if both IDP and SP are realized by
|
|
{{book.project.name}} server and adapter, respectively, there is no need to specify the keys for signature validation, see below.
|
|
|
|
[[_sp-idp-keys-automatic]]
|
|
It is possible to configure SP to obtain public keys for IDP signature validation
|
|
from published certificates automatically, provided both SP and IDP are
|
|
implemented by {{book.project.name}}.
|
|
This is done by removing all declarations of signature validation keys in Keys
|
|
sub element. If the Keys sub element would then remain empty, it can be omitted
|
|
completely. The keys are then automatically obtained by SP from SAML descriptor,
|
|
location of which is derived from SAML endpoint URL specified in the
|
|
<<fake/../../../../saml/java/general-config/idp_singlesignonservice_subelement.adoc#_sp-idp-singlesignonservice,IDP SingleSignOnService sub element>>.
|
|
Settings of the HTTP client that is used for SAML descriptor retrieval usually
|
|
needs no additional configuration, however it can be configured in the
|
|
<<fake/../../../../saml/java/general-config/idp_httpclient_subelement.adoc#_sp-idp-httpclient,IDP HttpClient sub element>>.
|
|
|
|
It is also possible to specify multiple keys for signature verification. This is done by declaring multiple Key elements
|
|
within Keys sub element that have `signing` attribute set to `true`.
|
|
This is useful for example in situation when the IDP signing keys are rotated: There is
|
|
usually a transition period when new SAML protocol messages and assertions are signed
|
|
with the new key but those signed by previous key should still be accepted.
|
|
|
|
It is not possible to configure {{book.project.name}} to both obtain the keys
|
|
for signature verification automatically and define additional static signature
|
|
verification keys.
|
|
|
|
[source,xml]
|
|
----
|
|
<IDP entityID="idp">
|
|
...
|
|
<Keys>
|
|
<Key signing="true">
|
|
<KeyStore resource="/WEB-INF/keystore.jks" password="store123">
|
|
<Certificate alias="demo"/>
|
|
</KeyStore>
|
|
</Key>
|
|
</Keys>
|
|
</IDP>
|
|
----
|