Federation : SAMLResponse X509Data and Signature relationship
Article ID: 226117
Updated On:
Products
Issue/Introduction
When running Federation Services, what is the usage of SignatureValue and X509Certificate from a SAMLResponse ?
Resolution
At first glance, these are to sign and validate the signature the xml document which forms the SAMLResponse.
This preserves the integrity of the SAMLResponse XML document.
The X509Certificate is the IdP certificate that the SP site has in its configuration.
It will be used to verify the SignatureValue to insure that the SAMLResponse XML document comes from the IdP and thus the
document can be trusted and that the SAMLResponse XML document hasn't been modified since it has been signed.
The SP side will use the Certificate public key it has stored in its metadata to validate the X509Certificate value and the SignatureValue as described in the documentation (1).
Further description of signature (2), the X509Data (3), and the relationship between the X509Data element and the signature (4) (5).
Additional Information
(1)
Signing and Verification Operations
The Policy Server uses a private key/certificate pair for signing and verification tasks. The private key/certificate pair signs the assertion, the assertion response, or authentication request. The specific message that is signed depends on the transaction taking place and the federation profile in use.
Before any signing transaction, the partner signing the assertion sends the certificate (public key) associated with the private key/certificate pair to the partner. This exchange is done as part of an out-of-band communication. The partner uses the certificate to verify the signature.
When a transaction occurs, the asserting party includes the certificate in the assertion, by default. During the verification process, however, the partner uses the certificate that it stores at its site to validate the signature.
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/single-sign-on/12-8.html
(2)
4.3 The SignatureValue Element
The SignatureValue element contains the actual value of the digital signature; it is always encoded using base64 [RFC2045].
https://www.w3.org/TR/xmldsig-core/#sec-SignatureValue
(3)
4.5.4 The X509Data Element
The X509Certificate element, which contains a base64-encoded [X509V3] certificate
https://www.w3.org/TR/xmldsig-core/#sec-SignatureValue
(4)
SAML 2.0 x509 Certificate and Signature value?
The SignatureValue should be the real calculated digital signature value, base 64 encoded. X509Certificate is also the base 64 encoded signing certificate.
https://stackoverflow.com/questions/6814462/saml-2-0-x509-certificate-and-signature-value
(5)
Purpose of the x509 certificate in metadata files on the IdP side (SSO structure)
When the SP gets a SAML response from the IdP via the browser, it must verify that the signature it gets comes from an IdP it knows and what signed using the IdP's private key; this signature can be verified against the IdP's public key in the certificate configured in the metadata.
https://serverfault.com/questions/382966/purpose-of-the-x509-certificate-in-metadata-files-on-the-idp-side-sso-structure
Feedback
