Search code examples
saml-2.0spring-saml

Saml: Is it necessary to trust and verify public key for ssl when the artifact response is signed?

I've made an implementation based on this with a FilesystemMetadataProvider: https://github.com/vdenotaris/spring-boot-security-saml-sample

To make the SSL handshake for the artifact binding work I put the SSL sertificates for the endpoint in the idps metafile(I tried to put both the leaf and CA in the cacerts on the jre and trust store of the server but that didn't work).

I don't want the extra maintenance for generating the certificates and modifing the Idps metafile when the leaf certificate changes.

Is it really necessary to mess with the transport layer? Isn't it enough to check that the SSL certificate is valid and after that check the signature of the Assertion?

Solution

  • I asked the IDP. They say that few choose to trust the SSL certificate and it should be enough to validate the SSL certificate and check the signature in the Assertion.