Nuances of Certificates in Domain Matching for SAML Based Single Sign On

In the realm of single sign-on (SSO) for web platforms, establishing trust between two websites is crucial. Traditionally, this trust is built using the Simple Assertion Markup Language (SAML) protocol. However, for SSO to work smoothly across modern browsers, additional steps are required.

One key aspect is domain matching. Most websites utilize HTTP cookies for session management, but modern browsers are becoming increasingly restrictive due to security concerns. For instance, if a user moves from www.companyA.com to www.companyB.com using SSO, the SSO will fail in browsers like Safari and Chrome's private browsing mode. This is because these browsers will block the session cookie of companyA, thereby preventing the establishment of SSO with companyB.

To resolve this issue, domain matching techniques are employed. This involves creating a new URL that combines the domains, such as companyB.companyA.com. This new domain requires a specific certificate setup. Essentially, when a user navigates from www.companyA.com to companyB, the browser URL changes to companyB.companyA.com. This requires additional certificate work to ensure seamless SSO across all modern browsers.

There are two certificates involved in this setup. The first certificate is used to establish trust between the two website platforms. CompanyA shares a certificate with companyB, which is then used to validate the SAML assertion that companyA sends to companyB. The SAML assertion is signed with companyA's private key, and companyB uses the shared certificate to verify that the assertion was indeed signed by companyA.

The second certificate is crucial for domain matching. It prevents users from encountering certificate errors in their browsers. CompanyB creates a certificate request file (CSR) and shares it with companyA. CompanyA then uses this CSR to generate a certificate signed by its own certificate authority (CA), which it shares with companyB.

This certificate installation allows the browser to recognize that the webpage served under companyA's domain (as seen in the URL companyB.companyA.com) is HTTPS compliant and issued by a trusted CA.

Understanding these two certificates and their respective roles is vital for developers and network engineers working on implementing SAML-based SSO solutions across different domains.