HowTo: Generate certificates for authentication using SAML 2.0 GAM Authentication

The SAML 2.0 Authentication type requires several configuration steps related to certificate creation and, in some cases, servlets server setup (when using the Java generator). This document explains in detail the steps that must be considered.

This information is useful for completing the Credentials tab of the SAML 2.0 Authentication type configuration.

For testing purposes, a valid CA certificate is not required. A self-signed certificate is enough.

Below are examples of how certificates can be generated for some of the most commonly used Identity Providers. In some cases, the generation process is described separately by environment (Java or .Net Framework). However, the resulting certificate extensions .jks for Java and .pkcs12, .p12 or .pfx for .Net Framework are independent of the Identity Provider and directly related to the environment.

Agesic

How to generate a key pair using OpenSSL

Use the following command to generate a key pair:

openssl req -newkey rsa:2048 -keyout key.pem -x509 -days 365 -out certificate.pem

As a result, key.pem contains the private key, and certificate.pem contains the public key.

For Agesic, you must change the format of the file containing the public key and convert it to a .crt file (the certificate to be sent to Agesic):

openssl x509 -outform der -in certificate.pem -out certificate.crt

The certificate used to sign the request (from the Service Provider to the Identity Provider) must have the following characteristics:

• RSA

• 2048 key length

• SHA256 algorithm

• No flags

Request Credentials

You must change the format of the file containing the private key and convert it to a .pfx file in order to have it referenced in the Key Store Path property of the Request Credentials section of SAML 2.0 Authentication type configuration. Use the same password used to define the certificate in the previous step.

openssl pkcs12 -export -in certificate.pem -inkey key.pem -out certificate.pkcs12

Then rename the certificate.pkcs12 to certificate.pfx.

In Java, the .pfx certificate must be referenced within a key store. To create one, follow these steps:

$>cd C:\Program Files\Java\jdk-11\bin

$>keytool -genkeypair -alias gamrequest -keyalg RSA -keystore keystorerequest.jks -keysize 2048 -validity 365 -storepass changeit

After running these commands, the keystorerequest.jks file will be created in /bin where you will add your .pfx certificate.

To add this certificate.pfx to the key store you've just created, use the following command:

$> keytool -importkeystore -srckeystore certificate.pfx -srcstoretype PKCS12 -destkeystore keystorerequest.jks -deststoretype JKS

After this command is executed, certificate.pfx is referenced inside keystorerequest.jks with alias 1.

Response Credentials

For configuring the Response Credentials section of the SAML 2.0 Authentication type, you must create a key store using the Agesic-Coesys-Testing.cer file provided by Agesic.

cd c:\Program Files\Java\jdk1.8.0_20\jre\bin
keytool -importcert -trustcacerts -file Agesic-Coesys-Testing.cer -alias gamagesic -keystore agesicResponse.jks

As a result, you will obtain a .cer file that must be referenced under the Trust Store Path property of the Response Credentials configuration.

After completing all these steps, the Credentials tab of the SAML 20 Authentication type for Agesic should look like this:

SAP

You can use OpenSSL to generate a key pair, as explained above.

To request credentials, refer to the Request Credentials section in this document, as it applies to both SAP and Agesic.

Response Credentials

You must convert the certificate provided by SAP to read the response in X509 format. To this end, you may use samlTool.

Then, save the result to a .pem file.

After that, execute the following:

cd C:\Program Files\Java\jdk1.8.0_162\bin
keytool -import -file C:\cert\sapkey.pem -keystore C:\cert\sapkeystore.jks

You can generate a new alias by executing:

-alias newAlias

OKTA

Request Credentials

First, generate a key store.

In a command line, go to the folder where the keytool app is located.

cd C:\Program Files\Java\jdk-11\bin

When you are there, execute the following:

keytool -genkeypair -alias myalias -keyalg RSA -keystore keystorerequestokta.jks -keysize 2048 -validity 365 -storepass mypassword

The generated key will be stored in the keystore.jks file. Be sure to replace myalias, keystore.jks, mypassword and other values according to your needs.

You can use a keytool to generate a keyresponse.jks as explained above. Download Java JDK from here.

Response Credentials

First, download the certificate provided by OKTA and then convert it to a keyresponse.jks.

In a command line, go to the folder where the keytool app is located.

cd C:\Program Files\Java\jdk-11\bin

When you are there, execute the following:

keytool -importcert -trustcacerts -file C:\...\okta.cert -alias alias -keystore keystoreresponse.jks 

After that, a .jks file will be created in the current directory.

Considerations

In .NET, you cannot use a Java key store.

Azure

Java

You can use a keytool to generate a keyresponse.jks as explained earlier. Download the Java JDK from here.

Request Credentials

First, you have to generate a Key Store.

In a command line, go to the folder where the keytool app is located.

cd C:\Program Files\Java\jdk-11\bin

When you are there, execute the following:

keytool -genkeypair -alias myalias -keyalg RSA -keystore keystore.jks -keysize 2048 -validity 365 -storepass mypassword -keypass mypassword //Command that generates a key

The generated key will be stored in the keystore.jks file. Be sure to replace myalias, keystore.jks, mypassword and other values according to your needs.

Response Credentials

First, download the certificate provided by Azure and then convert it to a keyresponse.jks.

keytool -importcert -trustcacerts -file C:\...\Azure.cert -alias alias -keystore keystoreresponse.jks 

After that, a .jks file will be created in the current directory.

.NET & Net Framework

When working with .NET and Net Framework, you cannot use a Java Trust Store.

Request Credentials

In a command line, go to the folder where the keytool app is located.

cd C:\Program Files\Java\jdk-18.0.2.1\bin

When you are there, execute the following:

keytool -genkey -alias alias -keystore keystore.p12 -storetype PKCS12  -keyalg RSA  -storepass yourpass -validity 730  -keysize 4096

This command will generate a keystore.p12 file.

Response Credentials

Download the certificate provided by Azure.

After that, specify the path in the Response Credentials configuration in the GAM Backoffice.

Additional Information

Certificates and encodings