SAML Certificates Installation

Question

Hi All,

We have an ArcGIS Enterprise installation on AWS Ec2 machines. We are currently configuring SAML based single sign-on and IDP has provided a pubic and private key. I want to know the process of setting up Private+Public keys for SAML in ArcGIS.

There are videos available for SSL certificates configuration but they don't talk about keys configuration for SAML especially how to import the private keys (.pfx) files.

RiceAdam · Answer

@ChristopherPawlyszyn @mdonnelly Following up on this... What are the recommended steps for updating an existing SAML cert?

Our current SAML is expiring - do I delete the existing 'samlcert' and import the new one under the existing alias? If so, this would break our SAML login until we export the Service Provider metadata to the iDp and they provision it.

Is there a way to update the SAML cert without losing the existing SAML login? Do I actually have to delete 'samlcert', upload the new one + Portal restart, download metadata, then revert back to the old cert until the iDp provisions the new cert, and finally repeat the process again?

HarryPlendl · Answer

We have changed the Idp for our SAML configuration. The samlcert is present in the portaladmin site under SSLCertificates and shows it is valid from a date (a year ago when we first configured SAML)  well before this SAML change.

The SAML log in is working for people internal to our organization's network, but not external. Could this be due to our SAMLcert not being updated?

Do I need to delete the SAMLcert and re-create it?

If so, which certificate is supposed to be imported?

Any insight is appreciated.

ChristopherPawlyszyn · Answer

Portal for ArcGIS uses the alias 'samlcert' to define which keypair is used for encryption/decryption of the assertion or signing of the SAML request. The steps are listed in the documentation, but essentially you delete the 'samlcert' certificate that was shipped with the product, then import a new certificate using the same alias. In a high availability Portal for ArcGIS site, you'll need to use the same certificate for both machines.

"The Encrypt Assertion and Enable signed request settings use the certificate samlcert in the portal keystore. To use a new certificate, delete the samlcert certificate, create a certificate with the same alias (samlcert) following the steps in Import a certificate into the portal, and restart the portal."
From https://enterprise.arcgis.com/en/portal/latest/administer/windows/configure-adfs.htm