Certificates and Secrets
SAML 2.0 secrets for hosted SP or IDP entities are managed by the secrets API, which lets you rotate certificates using secret mappings. This only applies to hosted entities; certificates for remote entities are derived from SAML 2.0 metadata provided by the third party.
The following certificates are used in SAML 2.0 flows with the corresponding secret mappings.
| Certificate | AM Role | Third-party Role | AM Use Case | Third-party Use Case | Secret |
|---|---|---|---|---|---|
| Hosted IDP signing certificate | Hosted IDP | Remote SP | Sign outbound SAML assertions | Validate inbound signed SAML assertion |
( |
| Hosted IDP encryption certificate | Hosted IDP | Remote SP | Decrypt inbound encrypted SAML requests | Encrypt outbound SAML requests |
( |
| Hosted SP signing certificate | Hosted SP | Remote IDP | Sign outbound signed SAML requests | Validate inbound signed SAML requests |
( |
| Hosted SP encryption certificate | Hosted SP | Remote IDP | Decrypt inbound SAML assertions | Encrypt outbound SAML assertion |
( |
[a] If defined, this secret is used; otherwise the default (in brackets) is used | |||||