Why is the IdP certificate fingerprint needed when setting up SAML-based SSO

Question

Some time ago I've worked on setting up SSO user authentication in a web application. The specific IdP was an ADFS server, but I don't think that's very important.

When configuring the application's SSO settings, I noticed that the IdP certificate's fingerprint is required, but not the certificate itself. Now, as I understand, the fingerprint is used by the application to validate the IdP's signature on the issued SAML token.

The question is how can the application verify the signature with just the certificate fingerprint? Doesn't it need the certificate's public key, which is part of the certificate itself, but not of it's fingerprint? How does this signature verification process work?

Answer 1

The fingerprint is exchanged out-of-band between the sender and the receiver and is configured on the receiving end. It uniquely identifies a certificate with the public key that the sender uses to sign the SAML messages that it sends.

The certificate itself can then be sent in-band as part of the SAML message itself. The receiver will compare the fingerprint of that certificate against the stored fingerprint to confirm that is dealing with the appropriate sender and associated key before cryptographically verifying the SAML message with that key.

This has the advantage that only a small message needs to be exchanged out-of-band beforehand. This may be useful e.g. when read out over a telephone line but has the downside that the complete certificate needs to be sent with each message (well, in principle at least the first message...) which increases the size of each message.