SingleLogout privatekey and certificate

Question

I am using Spring security https://docs.spring.io/spring-security/reference/5.7/servlet/saml2/logout.html for implementing SAML single logout. I got my single logout flow to work by providing a dummy set or private and public key since it requires me to sign my logoutrequest but it looks like Azure depends on the metadata for getting the certificate for verifying the loquestrequest. Since signing requires providing a private key how can I get the private key generated by Azure? This https://learn.microsoft.com/en-us/answers/questions/1347153/singlelogout provided some insights as to where it checks for the certificate but not a way to overcome disabling of logoutrequest signing. Thanks

Answer 1

Hi @Lee G

Thank you for posting your query on Q&A.

I understand that you would like to know how you can get the private key generated by Azure.

The private key associated with the certificate used for signing is not generated by Azure and cannot be downloaded from Azure, because the Service Provider (SP) holds its own public-private key pair.

The private key is typically stored in your service provider (SP) application and is used to sign a SAML Request to the Identity Provider (IdP).

The Identity Provider only requires the Service Provider’s public key certificate. This public certificate is used by Azure AD to verify the signatures of the SAML requests it receives. You need to generate and manage the private key on your own and it should be securely stored on your infrastructure.

I hope this information helps! please Feel free to ask any questions you may have.

Reference: https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/howto-saml-token-encryption?tabs=azure-portal

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/certificate-signing-options

https://stackoverflow.com/questions/56938997/saml-certificate-private-key

https://stackoverflow.com/questions/60424527/saml-private-and-public-key-sharing

Thanks,

Akhilesh.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.