Overview
The following describes what's changing and the required actions.
For detailed information, check out this video on why and how to renew your Syncplicity signing certificate .
What is changing?
The existing Syncplicity Single Sign-On (SSO) digital signature verification certificate is expiring.
What action must I take?
From the following list, select your identity provider and follow the instructions:
- ADFS (Active Directory Federation Services)
- Azure AD
- Shibboleth
- OneLogin and Okta
- Other identity providers
When will these changes take effect?
The change will occur on January 4, 2024, from 8:00 PM to 12:00 AM Pacific Time.
What happens if I take no action?
If no action is taken, after January 4, 2024, your users will no longer be able to authenticate to Syncplicity using SSO (unless your SSO system does not check the SAML request signature). This will not affect users from Desktops and Mobile devices that have already logged in.
Who can I contact for further information?
If you have questions or need additional assistance, contact support@syncplicity.com.
Instructions
The following are instructions for different identity providers.
ADFS
The following steps describe the procedure for SSO with ADFS:
- Download SSO Certificate to access the certificate file.
-
Copy the entire certificate text and save it to a text file named sso-syncplicity-certificate-2024.cer.
Log in to the ADFS server:
- Open the Syncplicity Relying Party Trust→ Properties.
- Click the Signature tab.
- Click Add.
- Browse to where you downloaded the certificate (now named sso-syncplicity-certificate-2024.cer
)and select it. - Click OK on all the dialog prompts.
-
On January 4, 2024, between 8 PM and 12 AM Pacific Time:
-
Open the Syncplicity Relying Party Trust→ Properties.
-
Click the Advanced tab.
-
Click the drop down for Secure Hash Algorithm.
-
Select SHA-256.
-
Click OK on all of the dialog prompts.
-
See our video on why and how to renew your Syncplicity signing certificate for detailed information.
Azure AD
No action is required for this identity provider.
Shibboleth
The following steps describe the procedure for SSO with Shibboleth:
- Download SSO Certificate to access the certificate file.
- Copy the entire certificate text and save it to a text file named sso-syncplicity-certificate-2024.cer.
-
In your relying-party.xml, identify the metadata file pointed to by the MetadataFile attribute. For example, "
/opt/shibboleth-idp/metadata/syncplicity.xml" in the following code:<MetadataProvider id="Syncplicity" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata" metadataFile="/opt/shibboleth-idp/metadata/syncplicity.xml" maintainExpiredMetadata="true" />
- Open the metadata file identified in the previous step and replace everything between the <X509Data> and </X509Data> tags with the contents of the sso-syncplicity-certificate-2024.cer file.
NOTE: The certificate text string should be one single line.
OneLogin,Okta, SecureAuth, JumpCloud
No action is required for these identity providers.
Other identity providers
The following steps describe the procedure SSO for other identity providers, such as PingFederate, PingOne, CA SiteMinder, Centrify, Oracle OIF, and OpenAM.
- Download SSO Certificate to access the certificate file.
- Copy the entire certificate text and save it to a text file named sso-syncplicity-certificate-2024.cer.
- Log onto the identity provider server.
- Go to the Syncplicity service configuration.
- Under the signature verification section, browse the file system and upload the new Syncplicity SHA-256 certificate (sso-syncplicity-certificate-2024.cer).
- Ensure the algorithm used to verify the SAML request signature is set to SHA-256 (if your SSO system does not allow the simultaneous verification of SHA-256 signatures, then only make the algorithm selection changes during the January 4, 2024, 8:00 PM to 12:00 AM Pacific Time window).