1

An external application (B) requires a SAML token to allow users who log into my application (A) to access it directly without having to log in again. This access is not built yet. My organization has an existing SSL certificate and certified domain which is used to access data from another external application (C). Is it possible/ok to use the SSL certificate used for C to generate a token for users who want to access B? Thank you

Improve this question

1 Answer 1

Reset to default
0

Yes, it's possible. As far as I know, the SAML standard has no restrictions on type of certificate to be used, and in practice you often have self-signed certificates with the public key communicated out of band rather than depending on chain of trusted certificate authority.

Regarding whether it's OK/advisable, some things to think about:

  1. Deploying it this way will require your application to have access to the private key of the certificate, where I assume it did not need this permission before (since that would typically be handled at the web server or load balancer level). More things with permission to your SSL cert broadens the risk of compromise.
  2. You've now complicated your SSL cert rollover procedures and potentially need to involve the external application's staff in the timing of this.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .