AutomaticKey Management SAML

[rondelward-pf]

Hey Duende team,

We're investigating v8 and looking at the SAML offering but had some questions around how managing key material (signing/verification certificates is handled for SAML).

• Does the Automatic Key rotation extend to SAML certificates?
  • If so, how are the notifications of the change in certificates communicated
• Can Automatic Key rotation be enabled for OIDC while SAML keys are maintained separately
• Is it possible to monitor certificate expiry of SAML based dynamic providers in some way?
  • Would this be a custom extensibility point we implement in our own solution?

Thanks!

[maartenba]

Good question! And sorry for the late response. @khalidabuhakmeh and @bhazen have taken the time to provide you the answer in the form of a blog post: https://duende.link/7qiusr2

For "Is it possible to monitor certificate expiry of SAML based dynamic providers in some way?", you may want to consume the metadata for these in a separate process, and keep track of whether expiration has happened or a new certificate was made available.

[rondelward-pf]

Thanks @maartenba! This sounds great.

In a practical sense, it sounds like we could have customers probe the metadata endpoint 14 days out to get the new certificate material if they are statically configured (which may be most of our clients). I think that makes sense and hopefully I'll get a chance to test this behavior soon.

For the initial "roll out" of key wrapping: Is it best to follow a similar pattern as though we are migrating from static to automatic keys? https://docs.duendesoftware.com/identityserver/fundamentals/key-management/#migrating-from-static-keys-to-automatic-key-management? So we could keep the unwrapped key as a "validation" key to avoid breaking any clients still using the old keys? I'd like to avoid downtime if possible.

[maartenba]

That's a good approach indeed. May be worth testing this out in staging to make sure clients all behave as expected.