Federation Manager Guide › Keys and Certificates for Secure Federated Communication › Certificate and Private Key Usage for Federation › Certificates To Secure the Artifact Back Channel

Certificates To Secure the Artifact Back Channel

To implement single sign-on using the artifact binding, the relying party sends a request for an assertion to Federation Manager at the asserting party. The assertion request goes to the Assertion Retrieval Service (SAML 1.1) or the Artifact Resolution Service (SAML 2.0). The retrieval service takes the artifact supplied by the relying party and uses it to retrieve the assertion. Federation Manager sends the response back to the relying party over a back channel, which is a secured connection between the asserting and relying party. In contrast, web browser communication occurs over the front channel.

You can secure the back channel and the retrieval service from unauthorized access using one of the following authentication methods:

• Basic
• Basic over SSL
• X.509 Client Certificate

For any of these authentication methods, the relying party back channel must be configured so it can communicate with the Assertion Retrieval Service (SAML 1.1) or the Artifact Resolution Service (SAML 2.0) in a secure manner.

The following considerations might be useful when choosing an authentication method for the artifact back channel:

• We recommend that you use an SSL connection for the back channel. The SSL connection should be secured by an SSL server certificate signed by a trusted CA.

  A set of common root and intermediate CA certificates are shipped with the default key database. To use a server certificate signed by a CA that is not already in the key store, you must import the CA certificate into the database as a trusted CA certificate.

• If an X.509 client certificate is required to establish a connection, the relying party must have the key-certificate pair, or client certificate-based authentication will fail. This certificate must also be imported to Federation Manager at the asserting party, since it is compared as part of the authentication. The client certificate serves as the relying party credentials to access the Assertion Retrieval Service or Artifact Resolution Service when the service is protected by client certificate authentication.