OneLogin - Changing SAML Certificates Across Applications (4383367)

OneLogin - Changing SAML Certificates Across Applications

A new OneLogin SAML signing certificate needed to be applied across multiple SAML 2.0 applications.
The request was to avoid changing the certificate one application at a time in the OneLogin GUI.
The behavior observed was that OneLogin does not provide a GUI option to bulk associate SAML certificates.

• SAML authentication requires both the Identity Provider and the Service Provider to trust the same certificate.
• Each vendor application has its own security requirements and its own process for applying the certificate on the Service Provider side.
• The Service Provider-side certificate process is controlled by the application provider and cannot be modified or automated from OneLogin.
• There is no way to bulk associate SAML certificates within the OneLogin GUI.

• Create a new certificate in OneLogin.
  • This provides the replacement certificate that can be assigned to SAML 2.0 applications and shared with Service Providers.
• For each SAML 2.0 application in the OneLogin GUI, open the application certificate setting and select X.509.
  • This opens the certificate configuration that controls the SAML signing certificate for that application.
• In each SAML 2.0 application, select Change and choose the newly created certificate.
  • This assigns the new certificate to the application on the OneLogin side.
• Contact each Service Provider and provide either the new metadata or the new X.509 certificate.
  • This allows the Service Provider to configure the same certificate on its side, which is required for SAML authentication to work properly.
• Coordinate a cutover date and time with each SAML 2.0 application provider.
  • This helps ensure the certificate is changed in OneLogin and on the Service Provider side at the same planned time.
• Do not change only the OneLogin application certificate without coordinating the matching Service Provider-side certificate change.
  • If the certificates do not match on both sides, access to the service may not work properly.
• Use the OneLogin API when certificate IDs need to be changed in bulk.
  • This provides a bulk method because the OneLogin GUI does not support bulk certificate association.
• Use the OneLogin API app update endpoint for each target application:
  • https://{{api-domain}}/api/2/apps/{{appID}}
  • Request body:

        {
          "certificate_id": 11234
        }

  • This changes the target application to use the specified certificate ID.
• Find the certificate ID from the certificate URL after creating the certificate in OneLogin:
  • Go to Security > Certificates.
  • Select the certificate.
  • Use the ID at the end of the certificate URL, such as certificates/11234.
  • This identifies the exact certificate ID required for the API request body.

OneLogin does not have a GUI option to bulk associate SAML certificates. Certificate IDs can be changed in bulk through the OneLogin API. The certificate on the OneLogin side and the Service Provider side must match. Vendor application certificate changes are controlled by each Service Provider. Access to the service may not work properly if the certificates do not match on both sides.