How the certificate use from SP keystore spring saml

4
votes

I am currently Implementing Spring SAMl to configure my SP. I have received a metadata XML from IDP which I put it in the metadata folder. 1. Now while starting I got Exception is No IDP is configured,so find out that it is due to the certificate is not valid. Now I just import the certificates to samlKeystore.jks and put metadataTrustCheck = false in ExtendedMetadataDelegate bean and this helped me to start the SP without any error and I am getiing a redirection form IDP to SP and I can achieve what I need.
2. Now I just removed the Certificates that been provided by IDP which I had kept in samlKeystore.jks and restart the application then also there is no issue with the communication between IDP and SP.

I have now some of query which I need help to understand. The certificate provided to me From IDP which I have imported to my samlKeystore.jks, is there any use for these as the response come with signature and certificate from IDP. For validation the response we should use the certificate and signature in the response.

Do I expect to do metadataTrustCheck = true and correct the IDP metadata if yes how to correct it as I have certificate chain.

1
spring-saml

1 Answers

7
votes

The metadata document you receive from IDP contains certificates which will be used by IDP to digitally sign SAML messages it will be sending towards your SP. There is no need to import these to samlKeystore.jks, as they are already present in the metadata.

The metadata document itself may also be digitally signed (to make sure nobody modified it before it reaches you). Now when metadataTrustCheck = true Spring SAML will try to verify that this signature is valid and in order to do that it needs to know whether to trust certificate which was used to create the signature.

So you need to communicate to Spring SAML which certificates do you trust for signing of metadata documents - and you do so by importing them to the samlKeystore.jks.

If you trust that the metadata document you have is correct, simply disable the metadataTrustCheck and do not import any public certificates to the samlKeystore - just rely on what's in the metadata document itself.