> For the complete documentation index, see [llms.txt](https://docs.collibra.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.collibra.com/data-quality-self-hosted/admin-configuration/admin-console/user-management/saml-security/migrating-to-a-custom-saml-keystore.md).

# Migrating to a custom SAML keystore

To improve the security of Data Quality & Observability (self-hosted), we removed the default keystore password from the installation packages in the Data Quality & Observability (self-hosted) 2024.07 release. This page shows you how to migrate to a custom SAML keystore.

Depending on whether your organization has SSL enabled, there are two options for configuring a custom SAML keystore.

{% tabs %}
{% tab title="Standalone" %}
{% stepper %}
{% step %}
In the owl-env.sh for Standalone or Web ConfigMap for Cloud Native deployments of Data Quality & Observability (self-hosted), set the SAML properties for the keystore the same as the SSL keystore file. For example:

```
#enable SAML & show the SAML SSO option on the login page
SAML_ENABLED=true
 
#set SSL communication properties for SAML
SAML_KEYSTORE_FILE=file:/etc/ssl/dev-keystore.jks
SAML_KEYSTORE_PASS=****
SAML_KEYSTORE_ALIAS=****
 
#set the name of the IdP variable to hold the user roles in the response
SAML_ROLES_PROP_NAME=memberOf
 
#set the EntityId of the application to be supplied to the IdP
SAML_ENTITY_ID=OwlOneLogin
 
#optionally use a file for the IdP metadata vs a URL (default is true)
SAML_METADATA_USE_URL=false
```

<table><thead><tr><th width="152">Variable</th><th>Description</th></tr></thead><tbody><tr><td><code>SAML_ENABLED</code></td><td><p>Whether Data Quality &#x26; Observability (self-hosted) uses SAML.</p><p>If set to <code>false</code>, users sign in with a username and password.</p><p>If set to <code>true</code>, SAML handles the authentication request.</p></td></tr><tr><td><code>SAML_KEYSTORE_FILE</code></td><td>This path can be changed to any path as long as it contains the public and private key combination to be used by Data Quality &#x26; Observability (self-hosted) and necessary certificates required for SAML.</td></tr><tr><td><code>SAML_KEYSTORE_PASS</code></td><td>The password used while creating the public and private key for the keystore file.</td></tr><tr><td><code>SAML_KEYSTORE_ALIAS</code></td><td>The alias used while creating the public and private key for the keystore file.</td></tr><tr><td><code>SAML_ROLES_PROP_NAME</code></td><td>The name of the IdP variable to hold the user roles in the response.</td></tr><tr><td><code>SAML_ENTITY_ID</code></td><td>The unique identifier for the SP entity that must match the SP entity ID used in the IdP circle of trust configuration.</td></tr><tr><td><code>SAML_METADATA_USE_URL</code></td><td><p>Whether Collibra DQ uses a URL or a file for the identity provider metadata.</p><p>Set to <code>false</code> for file-based SAML and <code>true</code> for URL-based configurations.</p></td></tr></tbody></table>
{% endstep %}

{% step %}
Start the Data Quality & Observability (self-hosted) application.
{% endstep %}

{% step %}
(Required only if signing or encrypting SAML assertion) Download the Data Quality & Observability (self-hosted) SP metadata from the **https\://\<your\_dq\_environment\_url>/saml/metadata** endpoint and share it with the IdP to configure the SP.
{% endstep %}
{% endstepper %}
{% endtab %}

{% tab title="Cloud Native" %}
{% hint style="warning" %}
When using SAML in its current implementation, you must enable SSL to use a custom keystore. If you rely on a Load Balancer to manage SSL, you can still enable SSL by stopping SSL at the Load Balancer. You can also enable an HTTP port to allow a Load Balancer to connect to it, as shown in step 3 on the **Without SSL enabled** tab of the [Migrating to a custom SAML keystore](/data-quality-self-hosted/security-configuration/saml-authentication/migrating-to-a-custom-saml-keystore.md) topic. In a future release, we plan to provide support for custom keystores without SSL enabled.
{% endhint %}

{% stepper %}
{% step %}
Create a keystore file, as demonstrated in [Setting up SSL (HTTPS)](/data-quality-self-hosted/security-configuration/setting-up-ssl-https.md).
{% endstep %}

{% step %}
For Cloud Native deployments of Data Quality & Observability (self-hosted):

1. Create a K8s secret using the keystore file:

   ```
   kubectl create secret generic dq-ssl-secret --from-file \<file-name.jks\> --namespace \<dev\>
   ```
2. Mount the JKS file through the following Helm Charts variable:

   ```
   --set global.web.tls.enabled=true --set global.web.security.saml.keyStoreFile=file:///etc/ssl/dqkeystore.jks --set global.web.security.saml.keyStoreAlias=\<alias-name\> --set global.web.security.saml.keyStorePass=\<keystore-pass\>
   ```

{% endstep %}

{% step %}
Start the Data Quality & Observability (self-hosted) application.
{% endstep %}

{% step %}
Download the Data Quality & Observability (self-hosted) SP metadata from the **https\://\<your\_dq\_environment\_url>/saml/metadata** endpoint and share it with the IdP to configure the SP.
{% endstep %}
{% endstepper %}
{% endtab %}
{% endtabs %}