中文
devexamples
← Recipes

阅读中文版本

Refresh SAML Metadata Automatically

Store the identity provider metadata, rotate signing certificates before they expire, and validate assertion signatures against the current and next keys.

~45 minsamlauthenticationsecurity

Task

Automate SAML metadata rotation so certificate expiry does not break single sign-on.

When to use this

The IdP rotates its signing certificate, the service provider still trusts the old key, and every login fails at once.

Prerequisites

  • A SAML service provider library
  • A scheduler for metadata refresh

Steps

1. Fetch and store the IdP metadata, including its signing certificates.

Expected output: The SP knows the trusted keys.

2. Refresh metadata on a schedule and before certificate expiry.

Expected output: Rotation happens without waiting for an outage.

3. Trust both the current and the next certificate during the overlap window.

Expected output: Logins work across the rotation.

4. Validate every assertion signature and reject unsigned or invalid ones.

curl -s https://idp.example.com/metadata | grep -o '<X509Certificate>[^<]*' | head

Expected output: Unsigned assertions never create a session.

Troubleshooting

Problem

Metadata fetch fails at rotation time

Solution

Cache the last known good metadata and retry; never fail closed to a state with no trusted keys.

Problem

Assertion without signature accepted

Solution

Require signatures on assertions or responses and validate against metadata keys.

Limitations

  • Metadata refresh depends on the IdP exposing a stable, signed metadata endpoint.
  • During the overlap window both keys are trusted, which briefly widens the set of valid signers by design.

Context

Automate SAML metadata rotation so certificate expiry does not break single sign-on. The IdP rotates its signing certificate, the service provider still trusts the old key, and every login fails at once.

Steps

  1. Fetch and store the IdP metadata, including its signing certificates. Expected: The SP knows the trusted keys.
  2. Refresh metadata on a schedule and before certificate expiry. Expected: Rotation happens without waiting for an outage.
  3. Trust both the current and the next certificate during the overlap window. Expected: Logins work across the rotation.
  4. Validate every assertion signature and reject unsigned or invalid ones. Expected: Unsigned assertions never create a session.
xmllint --xpath '//*[local-name()="X509Certificate"]/text()' idp-metadata.xml
# trust current + next cert during the overlap window

Verify

  • The SP knows the trusted keys.
  • Rotation happens without waiting for an outage.
  • Logins work across the rotation.
  • Unsigned assertions never create a session.

Limits

  • Metadata refresh depends on the IdP exposing a stable, signed metadata endpoint.
  • During the overlap window both keys are trusted, which briefly widens the set of valid signers by design.