Skip to main content

Create certificate profiles for SAML IdP authentication

To create a certificate profile for SAML IdP authentication in DigiCert​​®​​ Trust Lifecycle Manager:

  1. Open DigiCert​​®​​ Trust Lifecycle Manager.

  2. Go to Policies > Base templates and select the Generic User, Generic Server, or Generic Device template.

    In this example, we use the Generic User Certificate template and the DigiCert Desktop Client enrollment method.

  3. On the Primary options page:

    1. Select the appropriate business unit and issuing CA.

    2. Enter a profile name.

    3. Select an enrollment method. In this example, we use DigiCert Desktop Client.

    4. Select SAML IdP as the authentication method.

  4. Select Next to configure the required certificate fields (Subject DN) for the Private CA, and select a source of either SAML Assertion, Entered by User or Fixed Value.

    Note

    The SAML Assertion value must match the Claims value in Azure.

  5. Select Next.

  6. On the Certificate options page:

    1. Under Certificate fields, select the validity period of the certificate, required key size, and algorithm.

    2. Under Flow options, enable Allow duplicate certificates if you want to allow duplicate certificates with the same Subject DN to be issued.

    3. Under Renewal options, select when requests to renew certificates can be submitted.

    4. Under Subject DN and SAN fields, select the required certificate fields, and then specify the source of each of those fields.

  7. Select Next.

  8. On the Extensions page, configure the required certificate extensions:

    1. Key Usage

    2. Extended Key Usage (EKU)

  9. Select Next.

  10. On the Additional options page:

    1. Under Certificate delivery format, select the format in which certificates should be sent.

    2. Under Email configuration & notifications, enable and configure email templates for automatic notification of certain events.

    3. Under Administrative contact, enter the contact information for the profile you are configuring, which end-users can use if they have SAML enrollment issues.

    4. Under LDAP search, specify whether certificates can be found with the DigiCert​​®​​ Trust Lifecycle Manager LDAP service.

  11. Select Next.

  12. On the Advanced settings page:

    1. Under Seat ID Mapping, select a field to bind to your seat ID. This is used to uniquely identify the user, device, or server that the seat is for, e.g. Subject DN: CN, Email.

    2. If you already have your SAML IdP configuration data, under Configure SAML IDP, enter the corresponding values from your Azure Portal. Otherwise, enter fake placeholder data.

  13. Select Create to save the profile configuration.

  14. Select your new profile.

  15. Under Advanced settings, select Download SP Metadata to download the temporary SAML metadata file that is used to configure your SAML IdP.

When you have a profile for SAML IdP authentication, create an app in Microsoft Azure AD.

In this section: