Cloudera Docs

SAML Authentication Request signing key rotation

Here are the steps you should follow to avoid any down time during the key and certificate rotation:

Follow the steps below to avoid any down time during the key and certificate rotation:
  1. Generate a new Private Key for signing and a corresponding verification certificate.
  2. Upload this new verification certificate as the Next certificate for signature verification in the Cloudera Management Console.
  3. Click Update Authentication Settings.
  4. Get the latest SAML Service Provider Metadata from the Cloudera Management Console. The latest service provider metadata must now have the both “current” and “next” certificates as the "signing" cert.
  5. Upload this service provider metadata to your actual Identity Provider, so that Identity Provider now has both the old and new verification certificates. Including both certificates in the SP metadata allows a smooth key rotation without downtime, ensuring that authentication requests signed with either the current or new key can be validated during the transition period.
  6. In Cloudera Management Console:
    1. Upload the new Private key as the Private key for signing SAML AuthnRequest field.
    2. Upload the new verification certificate as the Current certificate for signature verification
    3. Remove the Next certificate for signature verification certificate by clicking the Remove button or by entering an empty string.
  7. Click Update Authentication Settings.
  8. Get the latest SAML Service Provider Metadata from Cloudera Management Console. This metadata should now have only one “signing” certificate with the latest value.
  9. Upload this updated service provider metadata to your Identity Provider to complete the key rotation process.