byword.netlify.app

A private key and certificate are needed when creating an XML signature over a SAML assertion or protocol messages. They may either be loaded from a key store or a PFX file. One of many ways to generate a private key and certificate is to make a request to the Windows certificate server and have it issue a key and certificate. SAML exchanges involve usage of cryptography for signing and encryption of data. All interaction with cryptographic keys is done through interface org.springframework.security.saml.key.KeyManager.The default implementation org.springframework.security.saml.key.JKSKeyManager relies on a single JKS key store which contains all private and public keys. Build SP Metadata. Build the XML metadata of a SAML Service Provider providing some information: EntityID, Endpoints (Attribute Consume Service Endpoint, Single Logout Service Endpoint), its public X.509 cert, NameId Format, Organization info and Contact info. This metadata XML can be signed providing a public X.509 cert and the private key.

• Saml Key File
• Generate Private Key For Ssl Certificate

In order to use any of the SAML security features like signatures and encryption, you would first need a key pair. In consists ofa public part - the certificate, and a private key. Private key is used to sign SAML messages, while public key is used to encryptand message so only you can decrypt it, and to verify your signatures. Certificate is published with your SAML metadata and is freelydistributed to your relying parties. Private key, just as it’s name says, should remain private and for your eyes only. Due to securityissues, certificates expire after some time, and you have to renew them in order to keep SAML signing and encryption working.

You can generate a key pair with OpenSSL. It’s a complex suit with several bundled tools, but the easiestway is

That command line will produce two files saml.crt - the certificate with a public key, and saml.pem - your private key. You needto provide those two files to the LightSAML in order to use SAML security features.

Note: The -sha256 switch tells OpenSSL to generate a certificate using SHA-256 digest algorithm. By default, if you omit thatswitch, you’ll get a SHA-1 digest which is considered week these days, and you should avoid it.

Using key pair with LightSAML

You can load a certificate file using static method fromFile on class X509Certificate:

You can load your private key using KeyHelper class

You can sign a SAML message by setting an instance of SignatureWriter to it’s signature property and serializing it afterwards.

For details about signing look at How to sign a SAML message cookbook article.

Inspecting generated certificate

Once generated certificate can be inspected with following command line

Important things to look for are following

Digest algorithm used

Saml Key File

Issuer

Generate Private Key For Ssl Certificate

And validity dates