> ## Documentation Index
> Fetch the complete documentation index at: https://docs.curator.interworks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing Login Requests

> Optional steps to configure Curator to sign SAML login requests.

This is an optional step in addition to configuring Curator for SAML authentication.  See these links for help
configuring SAML within Curator first:

* [Okta](https://docs.curator.interworks.com/setup/authentication/okta_saml.md)
* [OneLogin](https://docs.curator.interworks.com/setup/authentication/one_login_saml.md)
* [AzureAD](https://docs.curator.interworks.com/setup/authentication/azure_ad_saml.md)

## Configuring Curator to Sign SAML Requests

If your SAML Identity Provider (IdP) requires SAML requests to be signed, you'll need a certificate and private key in
Curator's authentication settings. Curator can automatically generate these for you, or you can provide your own.

### Automatic Certificate Generation (Recommended)

Curator will automatically generate a self-signed certificate and private key when you import your IdP's SAML metadata
for the first time. This certificate is valid for 1 year and uses 4096-bit RSA encryption.

**Steps:**

1.
2. With **SAML** selected, drop your IdP's metadata XML file onto step 2 of the guide and click **Apply these
   settings**.
3. Curator will automatically generate and populate the **Curator signing certificate** and **Curator private
   key** fields in the **Request signing and certificates** section.
4. Expand the **Request signing and certificates** section and toggle on the **Sign sign-in requests** and **Sign
   logout requests** options.
5. Save the changes.
6. You will likely need to send the certificate file to your SAML IdP administrator.

### Manual Certificate Generation (Optional)

If you prefer to generate certificates manually or need to regenerate them (e.g., for periodic security rotation), you
have two options:

#### Option 1: Use Curator's Rotate Button

1.
2. Expand the **Request signing and certificates** section. The validity of both certificates is shown at the top,
   and the page warns you 30 days before Curator's certificate expires.
3. Click the **Rotate Curator certificate** button.
4. The **Curator signing certificate** and **Curator private key** fields will be automatically populated.

#### Option 2: Generate Your Own Certificate

1. Generate a certificate and private key using an external tool (e.g., [SAMLTool.com](https://www.samltool.com/self_signed_certs.php)
   or OpenSSL).
2. Navigate to Curator's **Backend** > **Settings** > **Security** > **Authentication Settings** and expand the
   **Request signing and certificates** section.
3. Copy the certificate contents and paste them into the **Curator signing certificate** field.
4. Copy the private key contents and paste them into the **Curator private key** field.
5. Save the changes.

### Final Steps

After setting up your certificate (automatically or manually):

1. Toggle on the **Sign sign-in requests** and **Sign logout requests** options in the **Request signing and
   certificates** section.
2. Save the changes.
3. Send the certificate file to your SAML IdP administrator, or point them at the **Download metadata XML** output
   from step 1 of the guide, which includes the new certificate.
4. If the **IdP signing certificate** field is blank, you'll need to get an updated metadata file from your IdP
   administrator and re-import it in step 2 of the guide.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.