signing_and_certificates.md

SIGNING AND CERTIFICATES

The LightSaml relies on the xmlseclibs regarding signing and certificates functionality. LightSaml has helper methods and was tested using xmlseclibs with PEM format only.

Creating self signed certificates

Run the following command to generate pem certificate and key

$ openssl req -new -x509 -days 3652 -nodes -out saml.crt -keyout saml.pem

Loading certificate from file and creating public key

$certificate = new X509Certificate();
$certificate->loadFromFile($crtFilename);

$publicKey = KeyHelper::createPublicKey($certificate);

Creating private key

$privateKey = KeyHelper::createPrivateKey($filename, $pass);

Signing SAML messages

You would require private key for signing SAML messages.

$message->sign($certificate, $privateKey);

Exposing certificate in metadata

If your SP supports signing you would need to expose your certificate in your SP's metadata entity descriptor

$ed = new EntityDescriptor();
$sp = new SpSsoDescriptor();
$sp->addKeyDescriptor(new KeyDescriptor('signing', $certificate));
$ed->->addItem($sp);