In ADFS, serveral certificates are used. This is explained (very clearly) on this page: http://blogs.technet.com/b/adfs/archive/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-certs.aspx
Now, I have configured the following:
- ADFS Communications certificate
- ADFS Token decrypting certificate (for tokens that are received from another FS)
- ADFS Token signing certificate (to sign the tokens that are sent to the relying parties)
And on relying party level I have configured the following:
- RP Token encryption certificate
Now, what I don't understand is how to configure the request verification certificate. In ADFS, you can find it in a tab next to 'Encryption', and the explanation is the following: "Specify the signature verification certificates for requests from this relying party."
I assume I have to add a clientCertificate or something in the web config of my Relying Party, but I don't want ALL requests to be signed, only the requests that are travelling to ADFS should be signed. I want to do this because I do not want other, random apps to be able to contact my ADFS and consume resources.
Does anyone know how to set the request verification certificate?