Setting up the certificate trust store for SAML signature validation

The IBM® Sametime® Community Server validates the signature in the SAML assertion. While the SAML identity provider (idP) uses a private key for signing the assertion, the Sametime Community Server only needs the corresponding public key for validating the signature. Validation is achieved by adding the public certificate of the idP to the list of signer certificates in the Sametime trust store.

About this task

The trust store can be either a P12 file (PKCS#12), JKS (Java™ Key Store), or KDB (IBM key database). You can use an existing certificate store file, or create a new one. If you are creating a new certificate store, P12 (PKCS#12) is the recommended format. You can use the iKeyMan tool for creating and editing the certificate store, as explained in the topic Using iKeyMan to manage certificates for TLS.

Once you have the trust store, specify the trust store file and password in the Sametime configuration. If you plan to use the same trust store for TLS and SAML, or if you are not using TLS, then only a single trust store file is needed in the Sametime configuration. In this case, it is recommended that you use the TLS configuration settings, in the Integrated Solutions Console. At a minimum, specify the trust store file and password in the "Server application connections" column. For a complete list of available settings, see the topic Setting up TLS configuration. Each setting is described in the topic Setting up TLS configuration. Any value that is set in the "Server application connections" column is used for SAML, unless there is a corresponding "STSAML_" setting that overrides it. For example, if "Trust store file" in the "Server application connections" column is set to tls.p12, and STSAML_TRUST_STORE_FILE is not present in sametime.ini, then SAML signatures are validated against tls.p12. However, if the sametime.ini contains STSAML_TRUST_STORE_FILE=saml.p12, then SAML signatures are validated against saml.p12.

Procedure

To use a different key store for TLS and SAML, specify the key store using the following SAML-specific settings in the [Config] section of the sametime.ini file:

STSAML_TRUST_STORE_FILE=Trust store file
STSAML_TRUST_STORE_TYPE=Trust store type
STSAML_TRUST_STORE_PASSWORD=Trust store password
STSAML_TRUST_STORE_PASSWORD_STASH_FILE=Trust store password stash file