Configuration Guides › Federation Security Services Guide › Configure SOA Security Manager as a SAML 2.0 Service Provider › Access the Artifact Resolution Service with a Client Certificate (optional) › Configuring the Client Certificate Option at the Service Provider

Configuring the Client Certificate Option at the Service Provider

To set-up the client certificate authentication to secure the backchannel to the artifact resolution service,

• Select the client cert option in the authentication scheme configuration
• Add a client certificate to the smkeydatabase

Select the Client Cert Option for Authentication

To present a client certificate as credentials

1. In the Authentication Scheme Properties dialog for SAML 2.0 authentication, click Additional Configuration.
2. Select the SSO tab.
3. Select HTTP-Artifact in the Bindings section.
4. Select Client cert for the Authentication field.

Add a Client Certificate to the SMKeyDatabase

This procedure assumes that you already have a private key/certificate pair from a Certificate Authority.

1. Create an smkeydatabase, if one does not exist. Enter the command:

   smkeytool -createDB smkeydatabase -password <password>
   

2. Add a private key and client certificate to smkeydatabase by entering the following command.

   smkeytool -alias <alias> -addPrivKey - keyfile<file_path_to_key_file>
   -certfile<file_path_to_certificate>
   

   Notes:

   • The value for alias must be same as the value of the Name field specified in the Scheme Setup dialog for the SAML 2.0 authentication scheme with HTTP-artifact binding. The attribute of the subject DN for the Service Provider, represented in the example by the CN value, must also reflect the Name value.

     For example, if you entered CompanyA as the Name, then alias would be Company A, and the attribute could be CN=CompanyA, OU=Development, O=CA, L=Islandia, ST=NY, C=US

   • To refer to the existing entry, subsequent keytool commands must use the same alias.
   • The value for keypass must be same as the value of the Password field specified in the Scheme Setup dialog for the SAML 2.0 authentication scheme.
3. Restart the Policy Server to see the changes to the smkeydatabase immediately.