SAML certificate rotation

Simo 0

Hi,

We have noticed that recently the discovery endpoint for SAML https://login.microsoftonline.com/[TENANT-ID]/federationmetadata/2007-06/federationmetadata.xml started alternating between two valid keys prior final rotation.

We'd like to know how long does it take usually for a key rotation to complete. Currently we are experiencing a week long key rotation period and this is causing issues with our authentication middleware that does not support multiple keys to be configured at the same time.

Vahid Ghafarpour 17,950 Reputation points

2024-04-06T05:43:17.47+00:00

Thanks for posting your question in the Microsoft Q&A forum.

Key rotation generates a new key version of an existing key with new key material. Target services should use versionless key uri to automatically refresh to latest version of the key. Ensure that your data encryption solution stores versioned key uri with data to point to the same key material for decrypt/unwrap as was used for encrypt/wrap operations to avoid disruption to your services. All Azure services are currently following that pattern for data encryption.

https://learn.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
Givary-MSFT 28,061 Reputation points Microsoft Employee

2024-04-10T06:07:58.49+00:00

@Simo Adding to the above comments, refer to this doc - https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/tutorial-manage-certificates-for-federated-single-sign-on which talks about managing certificates.