Note:
Contact support@whatfix.com to enable SAML Request signing.
Overview of SAML request signing
Whenever you log in to your Whatfix account or dashboard using SSO, Whatfix interacts with your Identity Provider (IdP) and trusts the information provided by the IdP to facilitate your login. To enhance the security and integrity of the SSO authentication process, Whatfix uses SAML request signing.
Info:
SAML stands for Security Assertion Markup Language. It is an XML-based open-standard for transferring identity data between two parties: an identity provider (IdP) and a service provider (SP).
Identity Provider: Performs authentication and passes the user's identity and authorization level to the service provider.
Service Provider: Trusts the identity provider and authorizes the given user to access the requested resource.
Examples of IdP are Okta, PingFederate, and more. It verifies your authentication information to help you log in to the Whatfix dashboard. The SP is Whatfix, which trusts the information provided by the IdP to help you gain access to the dashboard.
When you try to log in, Whatfix sends a login request with encrypted text to your IdP. This text explicitly states that Whatfix has shared the request, and not another source. To sign the request, Whatfix uses a Private Key.
When the request arrives at your IdP, it uses a corresponding Public Certificate to decrypt the text. The IdP verifies the signature on the message, confirms that Whatfix sent the request, and then facilitates your login to the Whatfix dashboard.
Types of SAML signing supported
The following are the types of SAML signing supported by Whatfix:
Self Signed certificate
Customer provided certificate
Self Signed certificate:
In this scenario, Whatfix generates a private key to sign the SAML request. Your IdP then uses a public certificate, also generated by Whatfix, to validate or decrypt it. Whatfix shares the public certificate with the IdP in advance for it to verify the private key and facilitate the login.
Customer-provided certificate:
In this scenario, you generate a private key to sign the SAML request. The IdP then uses a public certificate, which you also provide, for validation or decryption. You must share both the private key and public certificate with Whatfix.
Info:
Choose any of the above-mentioned types of signing as per your requirement.