SAML Integrations Not Working after Signing Key Rotation

Single Sign-OnSessions

Last Updated:

Overview

After rotating signing keys, SAML integrations were not working even though the previous signing key had not yet been revoked. 

 

Symptoms

Logins through SAML connections either with Auth0 as the SP or IdP will fail after signing key rotation even if the previous key has not been revoked.

Applies To

  • SAML
  • Key Rotation

Cause

A tenant uses the same key pair for signing JWTs and SAML requests/responses. Rotating the signing key will affect SAML integrations. Unfortunately, Auth0 doesn’t have automatic support for SAML signing key rotation. For SAML enterprise connections and SAML integrations with Auth0 as the IdP, the old certificate will no longer be valid and a new one will need to be downloaded and sent to the external partner.

Solution

  1. Coordinate a time with your partners to rotate the signing key
  2. Immediately after you rotate the signing key, download the new tenant certificate from:

https://tenant.{us/eu/au}.auth0.com/pem

  1. Provide the certificate to your partners. If your partner is a SAML SP they will use the certificate for verify SAML responses from Auth0, if your partner is a SAML IdP they will use the certificate to verify SAML requests from Auth0.

 

Related References

Recommended content

No recommended content found...
Need more help? Visit the Community
Visit the Auth0 Community