Single Sign-On - Updating SAML IdP Metadata and Certificates (Sysadmin)
TABLE OF CONTENTS
- 1 Overview
- 2 What Is SAML and What Do Certificates Do
- 3 What to Do When a Certificate Update Is Approaching
- 4 How to Retrieve the SAML IdP Metadata URL
1 Overview
Most SAML-based Identity Providers (IdPs) rotate their signing certificates on a regular schedule. To ensure your organisation's Single Sign-On (SSO) continues to work without interruptions, itslearning must always have the correct and current IdP metadata, including the public signing certificate.
Note: Whenever possible, itslearning strongly recommends providing a metadata URL rather than manually sending certificate files. A metadata URL allows itslearning to automatically retrieve updates, preventing outages caused by expired or replaced certificates.
2 What Is SAML and What Do Certificates Do
SAML, or Security Assertion Markup Language, is a system that enables websites to exchange user information securely for Single Sign-On authentication. This process involves transmitting authentication details in a specific format between two parties: an identity provider (IdP) and a web application. An IdP is a system that creates, stores and manages digital identities. The IdP can either directly authenticate the user, or provide authentication services to third-party service providers, such as apps, websites or other digital services.
When a user logs in to itslearning, they are sent to an identity provider to enter their credentials. If successful, user information is returned to itslearning to authorise the login. This two-way exchange of information relies on the SAML protocol. To verify the authenticity of the response, itslearning must have the correct and valid certificate contained within the IdP metadata file, which itslearning securely maintains for its customers.
3 What to Do When a Certificate Update Is Approaching
If you are unsure whether itslearning already has the URL, your itslearning support representative can raise a ticket to have it checked.
Note: If it is not possible to retrieve the metadata over a public URL, share the entire metadata file instead.
4 How to Retrieve the SAML IdP Metadata URL
Whenever your IdP supports it, send itslearning the full federation metadata URL, including any required parameters, such as the appid query parameter for Microsoft Entra ID.
Below is how to retrieve the URL for some known systems. For other IdP solutions, consult the IdP vendor's documentation.
4.1 ADFS
You can normally access the metadata with a URL in this format:
https://<adfs-domain>/FederationMetadata/2007-06/FederationMetadata.xml
<adfs-domain> needs to be replaced with the correct domain. Confirm the URL works, then share it with itslearning.
4.2 Microsoft Entra ID (formerly Azure AD)
- Sign in to the Microsoft Entra admin centre.
- Go to Identity → Applications → Enterprise applications.
- Select the Entra application used for itslearning SSO.
- Open Single sign-on → SAML.
- In the SAML Certificates or Metadata URLs section, copy the entire App Federation Metadata URL.
The App Federation Metadata URL typically looks like this: