Auto-Rotating Certificate from IdP

[cb-acustaf]

Is there any information on configuring mod_auth_mellon to use an auto-rotating certificate provided by the IdP?

From what I can tell, mellon can use custom certs, but they need to be in a flat file and both the CRT and KEY are needed.
This requirement would seem incompatible with an IdP provided cert, auto-rotating or not.

[cb-acustaf]

OK. I've learned that I need to extract the cert from the IdP metadata. It's the <ds:X509Certificate> tag.
I've also learned that I need to use the MellonIdPCAFile directive in the apache config to point to the extracted cert.

In the past, I've used the combination of:

• MellonSPMetadataFile
• MellonSPPrivateKeyFile
• MellonSPCertFile
• MellonIdPMetadataFile
  to specify all the necessary vital information to make the SAML communication work.

Now, since I have to use the IdP's cert, I have:

• MellonIdPMetadataFile
• MellonIdPCAFile
  Just those 2 directives are not working. I'm still getting the error:

[APLOG_ERR auth_mellon_handler.c:2984] Error creating login request. Lasso error: [-106] Failed to load private key.

The auto created mellon metadata with these settings does not have anything for <KeyDescriptor>.
Do I need something? What would I put there when I'm using the IdP's public cert?

Do I need to put another directive in my apache config?

How do I get mellon to complete the SAML communication when using the IdP's cert?

[cb-acustaf]

OK.
The MellonIdPCAFile directive is a red herring.
If the IdP metadata has the <ds:X509Certificate> tag, then the config can remain:

• MellonSPMetadataFile
• MellonSPPrivateKeyFile
• MellonSPCertFile
• MellonIdPMetadataFile

The MellonSPPrivateKeyFile/MellonSPCertFile pair can be anything, including a self-signed cert. This cert is not used, it's only needed as a place holder so mellon can initialize without complaining there's an error with the key file.

When you do use a public cert from the IdP metadata, your application must successfully authenticate, or else lasso incorrectly throws error -201, which is saying that the IdP EntityID is bad.
So, make sure whichever attributes your apache config pulls out of the SAML token and forwards to your application are correct and enough to allow the user to authenticate. If not, you'll get errors that have nothing to do with user authentication.