Federation Security Services Guide › Signing and Encrypting Messages to Secure Federated Transactions › Certificate and Private Key Usage for Federation › Certificates To Secure the Artifact Back Channel

Certificates To Secure the Artifact Back Channel

To implement single sign-on using the artifact binding, the relying party sends a request for an assertion to SiteMinder at the asserting party. The assertion request goes to the Assertion Retrieval Service (SAML 1.1) or the Artifact Resolution Service (SAML 2.0). The retrieval service takes the artifact supplied by the relying party and uses it to retrieve the assertion. SiteMinder sends the response back to the relying party over a back channel, which is a secured connection between the asserting and relying party. In contrast, web browser communication occurs over the front channel.

You can secure the back channel and the retrieval service from unauthorized access using one of the following authentication methods:

• Basic
• Basic over SSL
• X.509 Client Certificate

For any of these authentication methods, the relying party back channel must be configured so it can communicate with the Assertion Retrieval Service (SAML 1.1) or the Artifact Resolution Service (SAML 2.0) in a secure manner.

The following considerations might be useful when choosing an authentication method for the artifact back channel:

• We recommend that you use an SSL connection for the back channel. The SSL connection should be secured by an SSL server certificate signed by a trusted CA.

  A set of common root and intermediate CA certificates are shipped with the default key database. To use a server certificate signed by a CA that is not already in the key store, you must import the CA certificate into the database as a trusted CA certificate.

  Federation uses an SSL-client when processing back channel requests. You can configure the IdP Web server to use SSL versions TLSV1_1 and TSLV1_2 with the following ciphers:

  • RSA_With_AES_128_CBC_SHA256
  • RSA_With_AES_256_CBC_SHA256

  These ciphers are supported in both FIPS and non-FIPS mode. The determination whether to use SHA256 is made on the SP server side. Federation has no configuration for selecting the alogorithm. Administrators must verify that the IdP server is configured appropriately.

• If an X.509 client certificate is required to establish a connection, the relying party must have the key-certificate pair, or client certificate-based authentication will fail. This certificate must also be imported to smkeydatabase at the asserting party, since it is compared as part of the authentication. The client certificate serves as the relying party credentials to access the Assertion Retrieval Service or Artifact Resolution Service when the service is protected by client certificate authentication.