IdP keep changing signing x509

0
votes

I have an issue where SSO link based on SAML is failing due to the fact IdP signing certificates are constantly changing.

I (as SP) have a configuration which is based on IdP's federation metadata, it has two signing certificates (X509). Things are working as expected.

Few weeks later, SSO link is broken due to the fact IdP is returning SAML Response with different signing certificate. I checke it's metadata, yep different signing certificates.

How do I implement my end (as SP) that my SAML Request includes x509 being used by IdP?

As well, is it common practice for IdP to constantly change singing certificates? I never had this issue before and I have a handful year-old SSO integration based on the same strategy: exchange of metadata. Is it possible to configure at IdP so that certificates are not being changed?

1
azure-active-directoryx509certificate

1 Answers

0
votes

The approach you took - configure non-gallery application give you the full control over the SAML integration. With your full control comes also your full responsibility. To your question:

is it common practice for IdP to constantly change singing certificates?

Yes, it is common and good practice. Well, not every two weeks, but at most an year.

Coming back to your changed signing certificate. The link that used in your original question (this one) has an explicit section about certificate. The section is called Review certificate expiration data, status, and email notification. This explains about the certificates. If you continue to read through the same section you will end up seeing another reference: Manage certificates for federated single sign-on in Azure Active Directory, where you will find even more information about certificate management in the IdP side.