From b52424e67be3e60e44f079f83718ea1649d05165 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adam=20Gabry=C5=9B?= Date: Thu, 18 May 2023 19:08:11 +0200 Subject: [PATCH] Describe SAML supported private key format and encryption algorithm (#1855) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OpenSearch allows signing requests by using a private key in the PKCS#8 format. If a user wants to use an encrypted key, the key must be encrypted with a PKCS#12-compatible algorithm. The `SAML -> Request signing` documentation is extended with the requirements. It should save time of the customers who use wrong key formats or a good key format, but encrypted with an unsupported algorithm (e.g. PKCS#5 2.0 compatible algorithm). Signed-off-by: Adam Gabryś --- _security/authentication-backends/saml.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/_security/authentication-backends/saml.md b/_security/authentication-backends/saml.md index e3406a0c..234e406f 100755 --- a/_security/authentication-backends/saml.md +++ b/_security/authentication-backends/saml.md @@ -176,6 +176,8 @@ Name | Description `sp.signature_private_key_filepath` | Path to the private key. The file must be placed under the OpenSearch `config` directory, and the path must be specified relative to that same directory. `sp.signature_algorithm` | The algorithm used to sign the requests. See the next table for possible values. +The private key must be in PKCS#8 format. If you want to use an encrypted key, it must be encrypted with a PKCS#12-compatible algorithm (3DES). + The Security plugin supports the following signature algorithms. Algorithm | Value