Which public key (SP or remote IDP) to use while signing SAML request

public-key-encryption saml-2.0 signing
doon picture doon · Dec 23, 2013 · Viewed 11.2k times · Source

I am trying to configure my application (SP) to work with remote IDP. The IDP provided me with a certificate to configure with SP. For SAML request, do I use SP's public key or IDP's? Also, where can I find good resources to study SAML in detail (apart from the oasis formal documents). The tutorials that I find are very simplistic (i.e. they just describe that SP goes to IDP and then it is redirected back but do not go into detail on SAML messages). The oasis documents are confusing. Thanks for any answers

Answer

drox picture drox · Dec 27, 2013

Signing is done using private keys - not public keys.

So, if the SAML request needs to be signed, SP must use its private key for it. Also, a certificate containing SP's public key should be given to the IdP to validate the signature.

The reason for IdP providing you its certificate is for SP to validate the signed SAML responses sent by the IdP.

Related questions

Use RSA private key to generate public key?

I don't really understand this one: according to: http://www.madboa.com/geek/openssl/#key-rsa , You can generate a public key from a private key. openssl genrsa -out mykey.pem 1024 openssl rsa -in mykey.pem -pubout > mykey.pub My …

Read More
RSA Public Key format

Where can i find some documentation on the format of an RSA public key? An RSA public key formatted by OpenSSH: ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQB/nAmOjTmezNUDKYvEeIRf2YnwM9/uUG1d0BYsc8/tRtx+RGi7N2lUbp728MXGwdnL9od4cItzky/zVdLZE2cycOa18…

Read More
Unable to load config info from /usr/local/ssl/openssl.cnf on Windows

While using OpenSSL on Windows: openssl genrsa -out privatekey.pem 1024 --> Created successfully openssl req -new -x509 -key privatekey.pem -out publickey.cer -days 365 ----> Showing error message as unable to load config info from /usr/local/ssl/…

Read More