Certificate Rollover
The Saml certificate shared with SaaS applications will expire after a certain amount of months, depending on the duration that was chosen while activating the feature. Once the certificate has expired, it will not be possible to connect to any SaaS application, possibly administrators included, so it is extremely important to renew it in time.
UserLock SSO automatically renews this certificate one month before its expiration but there are some administration tasks to perform before it is effective as explained below. It is advised to perform these operations when users are less likely to logon to the SaaS applications as the federation may be briefly deactivated while renewing the certificate on the SaaS application side.
Prerequisites:
- A primary UserLock SSO server must already be configured.
- Recommended: Email notifications are configured in UserLock.
Installation :
- This feature is accessible from UserLock 11.1
- UserLock SSO functionality is not part of the standard installation process, you must choose Custom installation and select the UserLockSSO function.
Description:
During the month preceding the expiration of the Saml certificate, an alert is visible in Single sign-on (SSO) -> Settings section of the UserLock console.
Exactly one month before the expiration, a new certificate is generated automatically and a notification is sent to the administrator (email notifications must be configured in UserLock)
Configuration:
Please note! The following two operations must be carried out within a short timeframe, because once the certificate has been updated, no user (including administrators) on the federated domain will be able to connect to any SaaS application. For this reason, it's best to start this procedure when users are less likely to be using these applications.
- Open the administration console for each SaaS application (or launch the Microsoft 365 configuration tool and skip the authentication step): this is necessary once the certificate has been updated in step 2, as indicated in the warning above.
- Apply the new UserLock SSO Saml certificate: to do this, an administrator must click on the Use new certificate button, then restart the UserLock SSO service from the UserLock console.
- Update the Saml certificate for each SaaS application
Note:
Some SaaS providers allow administrators to connect without using federation. This avoids any problems with the certificate and is therefore less risky. Nevertheless, please follow the above procedure with care to avoid any problems.