IDP Initated SSO: The local identity provider X.509 certificate doesnt have a private key

SAML for ASP.NET
1

Hi,

I am new to SSO
I have implemented the IDP Initiated SSO, and while testing I am getting the following error.

Retrieving the local identity provider certificate for the default configuration and partner service provider “partnerSP******”
Exception: ComponentSpace.SAML2.Exceptions.SAMLConfigurationException: The local identity provider X.509 certificate doesn’t have a private key.

We already have the other SP Initiated and IDP Initiated SSO’s and local IDP Certificate.
So the error related to local IDP certificate is due to settings at SP’s side?

Please help me to understand the problem

Thanks

2
[quote]
udamarla - 4/15/2019
Hi,

I am new to SSO
I have implemented the IDP Initiated SSO, and while testing I am getting the following error.

Retrieving the local identity provider certificate for the default configuration and partner service provider "partnerSP******"
Exception: ComponentSpace.SAML2.Exceptions.SAMLConfigurationException: The local identity provider X.509 certificate doesn't have a private key.

We already have the other SP Initiated and IDP Initiated SSO's and local IDP Certificate.
So the error related to local IDP certificate is due to settings at SP's side?

Please help me to understand the problem

Thanks
[/quote]

Upon further research,

our local Identity provider is not having private key and so upon updating the configurations SignAssertion="false" resolved the issue.

But, our ServiceProvider gave us the PartnerCertificateFile

so my configurations looks like this

https://staging*****"
Description="stage Test"
NameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
SignAssertion="false"
AssertionConsumerServiceUrl="TestURL*****"
PartnerCertificateFile="Certificates\test.pem"
/>
Do I need to add any other setting attributes in configurations apart from this, please guide

Thanks
3

The PartnerCertificateFile is used to verify signatures on SAML messages received from the partner SP.
For example, if the SAML authn request received in an SP-initiated SSO flow is signed, the PartnerCertificateFile is used to verify the signature.
The LocalCertificateFile is used to sign SAML messages and SAML assertions.
If SignAssertion is true, the LocalCertificateFile is used to sign the SAML assertion sent to the SP.
To sign something, you need a private key.
The LocalCertificateFile must be a PFX as this includes the private key.
As the IdP you should sign either the SAML response or SAML assertion.
This means that you need a LocalCertificateFile which is a PFX.
This is your PFX with your private key.
The SP will use the corresponding CER file to verify the signature.
For example, our example IdPs use the idp.pfx to generate signatures and the example SP’s use the idp.cer to verify these signatures.

4

Thanks for the detailed explanation

<spanstyle=‘font-size:11.0pt;font-family:“calibri”,sans-serif;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:calibri;mso-fareast-theme-font:minor-latin;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:“times new=”" roman";mso-bidi-theme-font:minor-bidi;color:#1f497d;mso-ansi-language:en-us;mso-fareast-language:en-us;mso-bidi-language:ar-sa’=“” style=“”>We have a certificate with Certificate.<bstyle=‘mso-bidi-font-weight:normal’ style=“”>crt extension to share with SP

Does this need to be with CER extension only?</bstyle=‘mso-bidi-font-weight:normal’></spanstyle=‘font-size:11.0pt;font-family:“calibri”,sans-serif;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:calibri;mso-fareast-theme-font:minor-latin;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:“times><spanstyle='font-size:11.0pt;font-family:“calibri”,sans-serif;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:calibri;mso-fareast-theme-font:minor-latin;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:“times new=”” roman";mso-bidi-theme-font:minor-bidi;color:#1f497d;mso-ansi-language:en-us;mso-fareast-language:en-us;mso-bidi-language:ar-sa’=“”></spanstyle='font-size:11.0pt;font-family:“calibri”,sans-serif;mso-ascii-theme-font:minor-latin;mso-fareast-font-family:calibri;mso-fareast-theme-font:minor-latin;mso-hansi-theme-font:minor-latin;mso-bidi-font-family:"times>

5

No that should be fine.
We use the .NET X509Certificate2 class to load certificate files.
This means DER (binary) and PEM (base-64) format certificate files are supported.
By common convention CER and CRT files are either DER or PEM format.