PAM integration with SAML IdP using different certificates for signing and encryption

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)
• CA Threat Analytics for PAM

Issue/Introduction

SAML Identity providers (IdPs), like for instance AD FS, may use different certificates for signing and encrypting the assertions.

PAM can be configured as a SAML Service Provider (SP) for integration with an external SAML IdP. Part of the configuration involves uploading the metadata coming from the IdP on PAM UI page Configuration > Security > SAML > SP Configuration > Configure Remote SAML IdP.

However when viewing the IdP metadata after upload, PAM only shows one certificate.

Does it drop the second certificate, potentially causing problems with SAML authentication, or is this just a limitation of the IdP metadata editor?

Environment

CA Privileged Access Manager (PAM) integrated with a SAML IdP using two certificates.

Resolution

This is just a limitation of the UI page presenting the imported SAML IdP metadata. The PAM server stores the full metadata including both certificates and testing confirmed that the integration works as expected.