1

I want to create a metadata with multiple Service Providers certificates(signing and encryption) for OneLogin SAML. But I don't know what settings parameters have to be set for that.

I am using ruby-saml gem. And my current settings is as follows

signing_pem = File.read 'signing.pem'
encryption_pem = File.read 'encryption.pem'

settings = OneLogin::RubySaml::Settings.new
settings.single_logout_service_url = "https://sp.com/slo"
settings.assertion_consumer_service_url = "https://sp.com/callback"
settings.issuer = "myissuer"
settings.idp_sso_target_url = 'https://idp.com/redirect/sso'
settings.idp_slo_target_url = 'https://idp.com/redirect/sls'
settings.idp_cert_multi = { signing: [signing_pem], encryption: [encryption_pem] }
settings.security[:authn_requests_signed]   = true
settings.security[:logout_requests_signed]  = true
settings.security[:logout_responses_signed] = true
settings.security[:want_assertions_signed]  = true
settings.security[:metadata_signed]         = true
settings.security[:want_assertions_encrypted] = true

Following code is used to generate metadata

OneLogin::RubySaml::Metadata.new.generate settings

I am getting Metadata without any certificates

"<?xml version='1.0' encoding='UTF-8'?><md:EntityDescriptor 
ID='_eda16671-6d18-4273-b295-3cdd94f9886c' entityID='myissuer' 
xmlns:md='urn:oasis:names:tc:SAML:2.0:metadata'><md:SPSSODescriptor 
AuthnRequestsSigned='true' WantAssertionsSigned='true' 
protocolSupportEnumeration='urn:oasis:names:tc:SAML:2.0:protocol'> 
<md:SingleLogoutService 
Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect' 
Location='https://sp.com/auth/slo' 
ResponseLocation='https://sp.com/auth/slo'/> 
<md:AssertionConsumerService 
Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' 
Location='https://sp.com/auth/callback' index='0' isDefault='true'/> 
</md:SPSSODescriptor></md:EntityDescriptor>"

Also, I have tried to create metadata directly from SAMLTool website. And there is no option available to enter different certificates for signing and encryption

Bapta Arjun
  • 33
  • 5

1 Answers1

2

Service provider settings attributes are:

settings.certificate = "public cert" # used for encripting SAML response

settings.private_key = "private cert" # used for decripting SAML response

settings.certificate_new = "public cert" # used for certificate rollover, appears as secondary certificate in metadata file so that Idp systems could pick it up

I don't think there is a feature for multiple SP certificates, at least I'm not aware of it

Richardlonesteen
  • 584
  • 5
  • 18
  • Yes, these statements are correct but to go further when the settings.certificate is used in conjunction with "want_assertions_encrypted] = true" the SP certificate appears twice in the metadata. One labelled signing and the other labelled encryption. In the original example the certificates are imported as IDP certificates and so do not display in the SP metadata. Ruby Saml does not support separate encryption and signing SP certificates as in the majority of cases these are the same. – Tom Clive Nov 03 '20 at 22:00