Federation Manager Guide › Key and Certificate Management to Secure Federation Messages › Certificate and Private Key Usage by Federation Manager › Certificates to Secure the Artifact Back Channel

Certificates to Secure the Artifact Back Channel

To implement single sign-on using the artifact binding, the relying party sends a request for an assertion to Federation Manager at the asserting party. The assertion request goes to the Assertion Retrieval Service (SAML 1.1) or the Artifact Resolution Service (SAML 2.0). The retrieval service takes the artifact supplied by the relying party and uses it to retrieve the assertion. Federation Manager sends the response back to the relying party over a back channel. The back channel is a secured connection between the asserting and relying party. In contrast, web browser communication occurs over the front channel.

Secure the back channel and the retrieval service from unauthorized access using one of the following authentication methods:

• Basic
• Basic over SSL
• X.509 Client Certificate

  If you use X.509 client certificate as the authentication method, the relying party must provide a client certificate as its credential. This credential lets the replying party gain access to the service at the asserting party that retrieves the assertion.

Consider the following items when choosing an authentication method:

• Consider using an SSL connection for the back channel. Secure the SSL connection with an SSL server certificate signed by a trusted CA.

  A default set of common root and intermediate CA certificates are shipped with the certificate data store. To use another server certificate signed by a CA, import the CA certificate into the store as a trusted CA certificate.

  Federation uses an SSL-client when processing back channel requests. You can configure the web server at the asserting party to use SSL versions TLSV1_1 and TSLV1_2 with the following ciphers:

  • RSA_With_AES_128_CBC_SHA256
  • RSA_With_AES_256_CBC_SHA256

  These ciphers are supported in both FIPS and non-FIPS mode. The determination whether to use SHA256 is made on the SP server side. Federation has no configuration for selecting the algorithm. Administrators must verify that the server at the asserting party is configured appropriately.

• If an X.509 client certificate is required to establish a connection, the relying party must have the key/certificate pair or client certificate authentication fails. Verify that the client certificate exists in the certificate data store at the asserting party. When the relying party sends the request for the assertion, the client certificate serves as the relying party credentials to access the retrieval service.