Encrypting SAML assertions

3 min

Enabling encryption of SAML assertions adds another layer of security. Enable this feature in a mobile app single sign-on setup if the SP supports SAML assertion decryption. The SAML assertions are encrypted such that the assertions can be decrypted only with the private keys held by the service provider.

Encryption of SAML assertions is disabled by default.

Responses can be signed while carrying a signed encrypted Assertion, but the Response itself is not encrypted.

Do not use the signing certificate for encrypting SAML assertions and vice-versa.

The following service providers (SP) support encryption of SAML assertions:

Salesforce

Custom SAML Service Provider

Custom WS-Federation Service Provider

A default certificate for encryption is automatically available in your Ivanti Access tenant.

Enabling SAML assertion encryption, enables additional options for Native Mobile Application Single Sign-On (SSO). These options allow you select the data encryption algorithm and the key transport algorithm for single sign-on.

Prerequisite

See Configuring Mobile App Single Sign-on (SSO)for information about setting up single sign-on.

Procedure

In the service provider configuration for Salesforce, Custom WS-Federation Service Provider or for Custom SAML Service Provider, go to Encryption Certificate.

Click the check box for Encrypt SAML assertion.

The default encryption certificate is automatically selected.

(Optional) To use a different certificate than the default certificate, do one of the following:

Select a certificate from the drop-down list.

Click Generate certificate or Add new certificate.

Adding a new certificate for SAML assertion encryption

The following provides the steps for adding a new certificate for SAML assertion encryption.

Prerequisite

Ensure that you have a PKCS 12 format file (.PFX or .P12) that contains the certificate and corresponding private key.

Procedure

In the service provider (SP) configuration, in the Encryption Certificate section, click Add new certificate.

Enter the following information:

Item	Description
Certificate Name	Enter an identifying name for the encryption certificate.
Certificate Password	Enter the password for the encryption certificate.
Choose File	Click to navigate to the location of the encryption certificate or drag and drop the certificate to this location.

Click Add Encryption Certificate to add the new certificate. The certificate is now available to select from the drop-down list. The certificate is also listed in Profile >Access Certificates.

Generating a certificate for SAML assertion encryption

The following provides the steps for generating a certificate for SAML assertion encryption.

Procedure

In the service provider (SP) configuration, in the Encryption Certificate section, click Generate certificate.

For Certificate Name, enter a name to identify the certificate.

Click Generate Encryption Certificate. The certificate is now available to select from the drop-down list. The certificate is also listed in Profile > Access Certificates.