Where does the SSO signing certificate originate from for multi-tenant SAML apps ?

Question

Where does the SSO signing certificate originate from for multi-tenant SAML apps ?

Howard Smith 0

I have a working App Registration and Service Provider for SAML authentication, in Azure.

Note: This application is not ( yet ) federated or joined with ADFS.

App Registrattion ( Tenant A )

        -> Service Provider ( Tenant A )  
                 Signed Certificate - on Azure SAML page  

        -> Service Provider ( Tenant B )   - auto created with Consent  
                  No place to edit Certificate ?

When I switch the App Registration from single to multi tenant, the handshake continues to work, in Tenant A ( home Tenant ). However I receive a different Signed certificate ( SAML XML ) when logging into a secondary tenant ( Tenant B ).

Since the SP ( Service Provider ) for Tenant B, uses Tenant A's app registration, there is no obvious place to change or modify, the external Tenant's certificate.

So the questions are:

 - Where does the Signed Cert on the request come from, when accessing Tenant B ?  
 - How can I change this to use the same Certificate used to sign the Tenant A request ?

Sincere thanks !

Howard

1 answer

Your answer

Answer 1

Sandeep G-MSFT 20,896 Microsoft Employee Moderator

@Howard Smith Thank you for posting this in Microsoft Q&A. For every application that you register in Azure AD, there is a service principal that gets created under enterprise applications. For multi-tenant applications, the application is registered in only one tenant. There is a service principal that get's created in all other tenant, whoever is provisioning this application. There is no application that get's registered in other tenants. Now, the token signing certificate is different for different tenants. Usually, token signing certificate is used for signing the token which is sent by Azure AD to the application post authentication. Before accessing the token, application will validate the signature of the certificate. This certificate is different for different tenants. Yes, you can download the certificate from Application registered tenant and upload it to other tenant where service principal is created.

Let me know if you have any further questions on this. Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Howard Smith 0 Reputation points

2023-04-11T13:53:21.8266667+00:00

Thank you Sandeep - your description is complete and accurate from everything I've reviewed.
The primary question is where can the signing certificate be modified ( uploaded ) in the secondary ( external ) tenant's service principal. Tenant B in the original description.
Best regards

Howard
Sandeep G-MSFT 20,896 Reputation points Microsoft Employee Moderator

2023-04-12T03:30:49.65+00:00

@Howard Smith You can login to Azure portal (external tenant). When you try to use the multi tenant application, there is a service principal that gets created in external tenant. You can browse to enterprise applications in Azure AD portal. Open the service principal (application) for which you want to modify the signing certificate. Click on Single sign-on blade on the left pane and look for SAML certificates. Click on Edit option and now you can import new certificate.

You can refer below article to know more about the type of certificates that can be used, https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/application-management-certs-faq#what-type-of-certificate-can-i-use-for-configuring-the-saml-certificate-for-single-sign-on

Do let me know if you have any further questions. Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Howard Smith 0 Reputation points

2023-04-13T15:38:12.4233333+00:00

Thanks Sandeep - yes that page is there, but only exists for the SP on the primary tenant.
For the external tenant SP ( created via Consent ) I only see:

Because the SP is owned by another Tenant ( Tenant A ).

And there is no "SAML Config" left bar menu item ( only "Single Sign on" exists )
Any advice?
Thank you Howard

Share via

Where does the SSO signing certificate originate from for multi-tenant SAML apps ?

1 answer

Your answer