Eliminating Certificate Requirements for Application Configuration in IDSP (VIP Authentication Hub)

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

When configuring a new application in the IDSP Admin Console, the system currently requires a certificate to be imported for the access gateway/client type. You have requested a way to create applications without mandatory certificate binding to simplify the onboarding process.

Environment

• Product: Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)
• Versions: 3.x, 4.x

Cause

Siteminder integration with IDSP requires "Trusted" client types, which enforce certificate-based authentication (Client Assertion) for secure token exchanges.

Resolution

The requirement to use a certificate is governed by the Client Type and Authentication Method selected during application creation.

1. For Public/Unsecured Clients: If the application does not require a client secret or certificate (e.g., a single-page app or mobile app using PKCE), set the Client Type to Public. This eliminates the certificate requirement but should only be used where appropriate for the security model.
2. For Enhancement Requests: If the business requirement necessitates a "Trusted" client type without a certificate (e.g., using a Client Secret instead), this currently requires an engineering enhancement.

Note: The request to eliminate the cert configuration for trusted clients is currently tracked as an enhancement request and will be reviewed for some future release.