Skip to main content
This is an optional step in addition to configuring Curator for SAML authentication. See these links for help configuring SAML within Curator first:

​
Configuring Curator to Sign SAML Requests

If your SAML Identity Provider (IdP) requires SAML requests to be signed, you’ll need a certificate and private key in Curator’s authentication settings. Curator can automatically generate these for you, or you can provide your own. Curator will automatically generate a self-signed certificate and private key when you import your IdP’s SAML metadata for the first time. This certificate is valid for 1 year and uses 4096-bit RSA encryption. Steps:
  2. With SAML selected, drop your IdP’s metadata XML file onto step 2 of the guide and click Apply these settings.
  3. Curator will automatically generate and populate the Curator signing certificate and Curator private key fields in the Request signing and certificates section.
  4. Expand the Request signing and certificates section and toggle on the Sign sign-in requests and Sign logout requests options.
  5. Save the changes.
  6. You will likely need to send the certificate file to your SAML IdP administrator.

​
Manual Certificate Generation (Optional)

If you prefer to generate certificates manually or need to regenerate them (e.g., for periodic security rotation), you have two options:

​
Option 1: Use Curator’s Rotate Button

  2. Expand the Request signing and certificates section. The validity of both certificates is shown at the top, and the page warns you 30 days before Curator’s certificate expires.
  3. Click the Rotate Curator certificate button.
  4. The Curator signing certificate and Curator private key fields will be automatically populated.

​
Option 2: Generate Your Own Certificate

  1. Generate a certificate and private key using an external tool (e.g., SAMLTool.com or OpenSSL).
  2. Navigate to Curator’s Backend > Settings > Security > Authentication Settings and expand the Request signing and certificates section.
  3. Copy the certificate contents and paste them into the Curator signing certificate field.
  4. Copy the private key contents and paste them into the Curator private key field.
  5. Save the changes.

​
Final Steps

After setting up your certificate (automatically or manually):
  1. Toggle on the Sign sign-in requests and Sign logout requests options in the Request signing and certificates section.
  2. Save the changes.
  3. Send the certificate file to your SAML IdP administrator, or point them at the Download metadata XML output from step 1 of the guide, which includes the new certificate.
  4. If the IdP signing certificate field is blank, you’ll need to get an updated metadata file from your IdP administrator and re-import it in step 2 of the guide.