Encrypting SAML assertions
Enabling encryption of SAML assertions adds another layer of security. Enable this feature in a mobile app single sign-on setup if the SP supports SAML assertion decryption. The SAML assertions are encrypted such that the assertions can be decrypted only with the private keys held by the service provider.
- Encryption of SAML assertions is disabled by default.
- Responses can be signed while carrying a signed encrypted Assertion, but the Response itself is not encrypted.
- Do not use the signing certificate for encrypting SAML assertions and vice-versa.
- The following service providers (SP) support encryption of SAML assertions:
- Salesforce
- Custom SAML Service Provider
- Custom WS-Federation Service Provider
- A default certificate for encryption is automatically available in your Ivanti Access tenant.
- Enabling SAML assertion encryption, enables additional options for Native Mobile Application Single Sign-On (SSO). These options allow you select the data encryption algorithm and the key transport algorithm for single sign-on.
Before you begin
See Configuring Mobile App Single Sign-on (SSO)for information about setting up single sign-on.
Procedure
| 1. | In the service provider configuration for Salesforce, Custom WS-Federation Service Provider or for Custom SAML Service Provider, go to Encryption Certificate. |
|---|
| 2. | Click the check box for Encrypt SAML assertion. |
|---|
The default encryption certificate is automatically selected.
| 3. | (Optional) To use a different certificate than the default certificate, do one of the following: |
|---|
| - | select a certificate from the drop-down list. |
|---|
| - | click Generate certificate or Add new certificate. |
|---|
Adding a new certificate for SAML assertion encryption
The following provides the steps for adding a new certificate for SAML assertion encryption.
Before you begin
- Ensure that you have a PKCS 12 format file (.PFX or .P12) that contains the certificate and corresponding private key.
Procedure
- In the service provider (SP) configuration, in the Encryption Certificate section, click Add new certificate.
- Enter the following information:
Item | Description |
|---|---|
Certificate Name | Enter an identifying name for the encryption certificate. |
Certificate Password | Enter the password for the encryption certificate. |
Choose File | Click to navigate to the location of the encryption certificate or drag and drop the certificate to this location. |
- Click Add Encryption Certificate to add the new certificate. The certificate is now available to select from the drop-down list. The certificate is also listed in Profile >Access Certificates.
Generating a certificate for SAML assertion encryption
The following provides the steps for generating a certificate for SAML assertion encryption.
Procedure
- In the service provider (SP) configuration, in the Encryption Certificate section, click Generate certificate.
- For Certificate Name, enter a name to identify the certificate.
- Click Generate Encryption Certificate. The certificate is now available to select from the drop-down list. The certificate is also listed in Profile > Access Certificates.
Related topics