Federation Security Services Guide › Manage the Key Database for Signing and Encryption › What Gets Stored in smkeydatabase?

What Gets Stored in smkeydatabase?

These keys and certificates in smkeydatabase can be at the consuming or producing authority.

The following types of keys and certificates are stored in smkeydatabase:

• Signer's private key and the corresponding certificate, which is is the public key that is signed by a certificate authority.

  The key and certificate are used to do the following:

  • Sign SAML responses for single sign-on, AuthnRequests, and single logout requests
  • Decrypt assertions, Name IDs, and attributes.

  The smkeydatabase can store multiple private keys and certificates. If a signing alias is configured, the Assertion Generator uses the key associated with that alias to sign assertions. If no signing alias is configured, the Assertion Generator uses the key with the alias defaultenterpriseprivatekey to sign assertions. If there is no default enterprise private key found, then the Assertion Generator uses the first private key that it finds in the database to sign assertions.

  Important! To store multiple keys in the database, you must define the first key you add with the alias defaultenterpriseprivatekey before you can add subsequent keys.

• Public-key certificates that correspond to the private keys used to:
  • Sign SAML responses from the assertion issuers
  • Certificates to sign AuthnRequests, certificates used for verifying a single sign-on response, single logout response, or encrypting an assertion, Name ID, or attributes.

A given Policy Server may sign and/or verify responses. Keys and certificates for signing and validation can be added to the same key database, depending on what the Policy Server is doing. For single sign-on, if a site is only consuming assertions using SAML POST profile, then that consumer/Service Provider only verifies the response; it never signs it. In the case of single logout, it depends upon which site initiates the single logout that determines which side signs or verifies requests and responses.