SingleLogout privatekey and certificate

Lee G 0 Reputation points
2024-02-19T21:53:49.3266667+00:00

I am using Spring security https://docs.spring.io/spring-security/reference/5.7/servlet/saml2/logout.html for implementing SAML single logout. I got my single logout flow to work by providing a dummy set or private and public key since it requires me to sign my logoutrequest but it looks like Azure depends on the metadata for getting the certificate for verifying the loquestrequest. Since signing requires providing a private key how can I get the private key generated by Azure? This https://video2.skills-academy.com/en-us/answers/questions/1347153/singlelogout provided some insights as to where it checks for the certificate but not a way to overcome disabling of logoutrequest signing. Thanks

Active Directory Federation Services
Active Directory Federation Services
An Active Directory technology that provides single-sign-on functionality by securely sharing digital identity and entitlement rights across security and enterprise boundaries.
1,219 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,315 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Akhilesh 6,825 Reputation points Microsoft Vendor
    2024-02-20T13:58:21.01+00:00

    Hi @Lee G

    Thank you for posting your query on Q&A.

    I understand that you would like to know how you can get the private key generated by Azure.

    The private key associated with the certificate used for signing is not generated by Azure and cannot be downloaded from Azure, because the Service Provider (SP) holds its own public-private key pair.

    The private key is typically stored in your service provider (SP) application and is used to sign a SAML Request to the Identity Provider (IdP).

    The Identity Provider only requires the Service Provider’s public key certificate. This public certificate is used by Azure AD to verify the signatures of the SAML requests it receives. You need to generate and manage the private key on your own and it should be securely stored on your infrastructure.

    I hope this information helps! please Feel free to ask any questions you may have.

    Reference: https://video2.skills-academy.com/en-us/entra/identity/enterprise-apps/howto-saml-token-encryption?tabs=azure-portal

    https://video2.skills-academy.com/en-us/entra/identity/enterprise-apps/certificate-signing-options

    https://stackoverflow.com/questions/56938997/saml-certificate-private-key

    https://stackoverflow.com/questions/60424527/saml-private-and-public-key-sharing

    Thanks,

    Akhilesh.

    Please "Accept the answer" if the information helped you. This will help us and others in the community as well.