Add custom certificate in SAML configuration

Issue

• As part of the SAML configuration, it is possible to generate a Certificate and a Private Key.
• This generates both a self-signed key and a container storekey (in $LIFERAY_HOME/data/keystore.jks by default).
• How to use a different key instead of the default one?

Environment

• Liferay DXP 7.0+

Resolution

For Liferay DXP 7.3 and 7.4

• Certificates can be managed directly from the General tab of the SAML administration view.

For Liferay DXP up to 7.2

1. It is possible to have several entries in the keystore at the same time.
2. Liferay will only consider the entry with an alias equal to the Entity ID chosen in the tab General of SAML Administration.
3. To have Liferay use our own key:
   1. Change the alias of the generated entry to some other name. For example:

   keytool -changealias -alias <ENTITY_ID> -destalias <ANOTHER_NAME> -keypass <PASSWORD> -keystore keystore.jks

   2. Import the new key making sure that the alias is set to <ENTITY_ID>. For instance, a key can be imported from another keystore (of type PKCS12 in the example) using:

   keytool -importkeystore -srckeystore <P12_FILEPATH> -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype jks -srcalias <SOURCE_ALIAS> -destalias <ENTITY_ID>

   3. Check the tab General in SAML Administration. If the new key is not displayed it may be required to press on Authenticate Certificate to provide a necessary password.

Additional Information

• When the Certificate and Private Key is created the first time, the following trace is shown in the log
  

  WARN [http-nio-8080-exec-8][FileSystemKeyStoreManagerImpl:86] Creating a new SAML keystore at <LIFERAY_HOME>/data/keystore.jks

• The keystore filepath, password, and type can be specified in the SAML Configuration system settings.