Updating IdPSigningCertificate for ADFS

To update the IdPSigningCertificate for Active Directory Federation Services (ADFS) Token Signing Certificate that has been renewed. Follow these steps:

The steps below include the steps to export the Token Signing Certificate from ADFS after it has been renewed.

Export a Signing Certificate from AD FS; The following steps can also be found in the Infor Lawson Authentication Configuration Guide.

1. Log into the AD FS server and click Administrative Tools->ADFS Management.
2. On the AD FS window, Click Service to open the Service Snap-in.
3. Click on Certificates under Service to see the Certificates pane showing all available certificates
4. Select the certificate under Token-Signing in the Certificates Pane to get to the certificate folder
5. Click the Copy to File option in the Details tab of the Certificate window
6. Click Next in the Welcome to the Certificate Export Wizard window
7. At the prompt, select the “Base64encoded X.509 (.CER)” option to choose the file format in which the certificate is to be exported and then click Next.
8. At the prompt to select the location where the token signing certificate is to be saved and specify a filename
9. At the prompt, verify that the file type is “Base 64 Encoded (.cer)” and then click Save.
10. The Certificate Export Wizard window displays the File Name and location specified. Write down the file path specified or change it to your preferred location.
11. Click Next to proceed with exporting.
12. Click Finish. When you see this message, “The export was successful.” Click OK.
13. Click OK again to close out the wizard.
14. Locate the file you exported and copy it to the LSF server.

Reload AD FS signing certificate in Lawson System Foundation

1. Make sure you copied the certificate that was exported in the above steps to a directory on the LSF server.
2. Run the ssoconfig -c utility from a command prompt.  Enter the password when prompted.
3. From the main menu, select “Manage WS Federation Settings”.
4. From the sub-menu, select “Manage Certificates”.
5. From the next sub-menu, select “Delete IdP certificate”.
6. At the prompt, type the name of the IdP service, ADFS (this may be different)
7. Message “Signing Certificate has been deleted successfully” is displayed
8. From the menu, select “Import IdP certificate”
9. At the prompt, type the name of the IdP service, ADFS (this may be different)
10. At the prompt, type the path of the certificate. The system assumes that the certificate is in the current folder so supply path information as needed.
11. Message “IdP signing certificate has been successfully imported to keystore”
12. From the menu, select “Exit”

Restart the Lawson System Foundation environment and WebSphere Application server or Cluster in the proper order.