---
title: "EasySSO SAML with Azure AD - Signing, Validation, Encryption"
canonical: "https://www.techtime-initiative.com/space/EasySSO/5931607/EasySSO%20SAML%20with%20Azure%20AD%20-%20Signing%2C%20Validation%2C%20Encryption"
format: markdown
---
Configuration necessary to integrate EasySSO with Azure AD using SAML with Signing, Validation and Encryption.

> ℹ️ **None of these features are strictly required.** For a minimal configuration see [How to Configure EasySSO with Azure AD](https://techtime-website.atlassian.net/wiki/spaces/EasySSO/pages/5898716)

> Macro (toc)

## Signing and Validation

This will also allow for Single Logout (SLO) and IdP initiated logout.

### Step 1: EasySSO Configuration 

#### On the Certificates page:

1. Click the **Generate Certificates** button
2. Paste the contents of the **SP Signing certificate** into a text file and then change the filename to **cert.cer**
3. Remove the header (**-----BEGIN CERTIFICATE-----**) and footer (**-----END CERTIFICATE-----**)

#### On the General page:

1. Make sure **Sign SP Login request** is ticked
2. For **Logout Binding Type** select **POST **
3. Copy **POST Binding URL** and paste into **Single Logout URL** text box
4. Make sure** Sign SP Logout request** is ticked
5. Make sure **Sign SP Logout response** is ticked
6. Make sure **Verify SP Logout Request Signature** is ticked
7. Make sure **Verify SP Logout Response Signature** is **NOT** ticked

Click **Save**

![EasySSO - EasySSO SAML Signing Setup 002.jpg](media://7eef3fd6-0d59-4595-aa79-71ef98a0ab3b)

![EasySSO - EasySSO SAML Signing Setup 001.jpg](media://b947c771-7bfa-4ba0-84d4-867e50b3d99c)

### Step 2: Azure Configuration

Inside Azure Enterprise Applications - EasySSO

On the **Single sign-on** panel for **EasySSO**,** **On the SAML Certificates **Verification certificates (optional)**, click **Edit**

On the Edit page for **Verification certificates (optional)**

3. Make sure **Require verification certificates** is ticked
4. Make sure **Allow requests signed with RSA-SHA1 **is ticked
5. Click the **Upload certificate** button and upload the previously saved **cert.cer** file

Click **Save**

![EasySSO - Azure SAML Signing Setup 001.png](media://22ff69a5-177b-46a2-bb4d-8727e731bde2)

## Encrypted Assertions

> ℹ️ Azure Encrypted assertions requires Microsoft Entra ID Premium

### Step 1: EasySSO Configuration

1. Open the EasySSO Admin page
2. Click the SAML button to be taken to the SAML Admin configuration
3. Check the 'Encrypt Assertions' check box
4. Click the Save button at the bottom of the page to save the updated configuration
5. Click the 'Certificates' tab
6. Click the button to download the SP Certificate. This certificate is in a CER format

### Step 2: Azure Configuration

1. Open your SAML Administration page
2. Open the SAML Client configuration
3. In the side panel, in the security section, click "Token encryption" and then click to import certificate
4. Upload the SP Certificate previously downloaded into the encrypted certificate section (If your client only allows .crt or .pem certificates, copy the contents of the sp certificate text box into a new file and save it with the name of 'myeasyssosp.crt' or 'myeasyssosp.pem' as appropriate).
5. Click the ellipsis button (...) and then click to Activate token encryption certificate

![Azure_Encrypted_Assertions_2.png](media://5b239373-7e4d-4995-9112-8ee7afb6b0a6)

![Azure_Encrypted_Assertions_1.png](media://297fa32d-6011-4767-9198-2a8b366ff375)