SAML SSO: Unable to import certificate via Java Keystore file (JKS)

Question

I need to configure Single Sign On based on SAML 2.0 including encryption. Life would be easy if salesforce would allow import of the Identity Provider meta information XML that includes certificates for both the signing and the encryption. Unfortunately the encryption certificate must be uploaded either based on a Certificate Signing Request (CSR) or a Java Keystore. As I received the certificate from the Identity Provider I wanted to import it into a JKS and upload this one into salesforce. That seems to work at first glance but the certificate included in the JKS file does not show up as an active certificate. Worst thing about it is that no error message is being shown, the certificate is just not imported. Has anyone experienced the same behaviour? Any guesses what the problem with the JKS could be?

Answer 1

How a mainstream encryption scenario works in SAML: identity provider encrypts some elements of the SAML response with service provider's public key. (I am assuming an asymmetric cipher which is how most implementations incl. Salesforce do this). The service provider decrypts using the private key that corresponds to the public key used to encrypt. In other words, the service provider needs to own a keypair - private key and public key - for this use case to work.

The identity provider's metadata could also contain a KeyDescriptor element with use="encryption". This has nothing to do with the encryption scenario described above.

A JKS keystore can contain different types of entries. You can import a public key into the keystore. If you use Java keytool to list the entries in your keystore (keytool -list -keystore), a public key-only entry will show up as a trustedCertEntry type. Another type of entry is one that contains a keypair (private and public key). This type of entry will be listed as 'PrivateKeyEntry'.

When importing a JKS keystore under Certificate and Key Management section, Salesforce appears to only read entries of PrivateKeyEntry type. In the encryption scenario above, that's the only entry that could be used to import a keypair. If you stick your identity provider's private key and cert into the keystore as a PrivateKeyEntry, you will be able to import it . The public key (cert portion) of the entry will then show up on the list when you're creating a SAML service provider under Single Sign-On Settings.