8000
Support an alternative certificate for signature validation in SAML clients (SP key rotation scenario) · keycloak keycloak · Discussion #50219 · GitHub
You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Support an alternative certificate for signature validation in SAML clients (SP key rotation scenario)
#50219
In Keycloak 26.4.0, "Automatic certificate management for SAML clients" feature has been added.
It is very useful to operate key rotation without service interruption or synchronization between IDP and SP providers.
Unfortunatelly, some SP providers do not publish their SAML metadata. It would be very useful to be able to set a second certificate among the allowed signatue certificates to operate key rotation in a smooth way.
Description
In the "Keys" tab of SAML clients, we would add next to the other an additional input area to setup an "alternative" signature certificate.
Our proposal would only handle two signature certificates to avoid to create too complex UI.
Thanks to #17028, we expect changes to be quite limited as the logic to support multiple certificates is already present.
Discussion
We would like to add this possibility to have an additional signature certificate in a SAML client. Before working on the implementation, we want to cross-check that it fits the product strategy. What do you think about this extension?
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Context & Motivation
In Keycloak 26.4.0, "Automatic certificate management for SAML clients" feature has been added.
It is very useful to operate key rotation without service interruption or synchronization between IDP and SP providers.
Unfortunatelly, some SP providers do not publish their SAML metadata. It would be very useful to be able to set a second certificate among the allowed signatue certificates to operate key rotation in a smooth way.
Description
In the "Keys" tab of SAML clients, we would add next to the other an additional input area to setup an "alternative" signature certificate.
Our proposal would only handle two signature certificates to avoid to create too complex UI.
Thanks to #17028, we expect changes to be quite limited as the logic to support multiple certificates is already present.
Discussion
We would like to add this possibility to have an additional signature certificate in a SAML client. Before working on the implementation, we want to cross-check that it fits the product strategy. What do you think about this extension?
All reactions