[JIRA] (IDP-1956) authn fails: an SP rejects SHA1 and our IdP produces a response with SHA1 digest

[Paul Fardy (Jira)]

Paul Fardy ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=70121%3A200c5e14-304a-4be9-94e1-fae3663ec1f6 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiNWJjZDhmODE5ZWI2NGZlZGEwZDliN2NkNzExNjgwMjMiLCJwIjoiaiJ9 ) / Story ( https://shibboleth.atlassian.net/browse/IDP-1956?atlOrigin=eyJpIjoiNWJjZDhmODE5ZWI2NGZlZGEwZDliN2NkNzExNjgwMjMiLCJwIjoiaiJ9 ) IDP-1956 ( https://shibboleth.atlassian.net/browse/IDP-1956?atlOrigin=eyJpIjoiNWJjZDhmODE5ZWI2NGZlZGEwZDliN2NkNzExNjgwMjMiLCJwIjoiaiJ9 ) authn fails: an SP rejects SHA1 and our IdP produces a response with SHA1 digest ( https://shibboleth.atlassian.net/browse/IDP-1956?atlOrigin=eyJpIjoiNWJjZDhmODE5ZWI2NGZlZGEwZDliN2NkNzExNjgwMjMiLCJwIjoiaiJ9 )

Issue Type: Story Affects Versions: 4.0.1 Assignee: Brent Putman ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A97de0981-adc3-4044-95ed-131622fad81e ) Attachments: idp-signing.crt, sandbox-fardypau-resp-20220531T0936.xml, sandbox.crt Components: Security and Cryptography Created: 31/May/22 3:31 PM Priority: Trivial Reporter: Paul Fardy ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=70121%3A200c5e14-304a-4be9-94e1-fae3663ec1f6 )

Why does the encrypted response reference a SHA1 digest. Sample encrypted assertion attached.

We have an SP that's upgrading and the new versions rejects SHA1 methods.
Our Prod IdP's cert has
 {{ Signature Algorithm: sha1WithRSAEncryption
Issuer: CN=idpz.utorauth.utoronto.ca }} 

So we've set another IdP with SHA256.
 {{ Signature Algorithm: sha256WithRSAEncryption
Issuer: CN=idpx.utorauth.utoronto.ca }} 

But it produces encrypted responses with xmldsig#sha1. Unencrypted responses work. But the SP has currently removed the block on SHA1. We want to restore the block.

Attached Files: idp-signing.crt , SP's sandbox.crt , and a sample encrypted response.

( https://shibboleth.atlassian.net/browse/IDP-1956#add-comment?atlOrigin=eyJpIjoiNWJjZDhmODE5ZWI2NGZlZGEwZDliN2NkNzExNjgwMjMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1956#add-comment?atlOrigin=eyJpIjoiNWJjZDhmODE5ZWI2NGZlZGEwZDliN2NkNzExNjgwMjMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100198- sha1:f4460c0 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/ac6337c0/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-39326f31-9507-4279-a978-c33159b06dfd
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/ac6337c0/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-34c958f8-6df6-4d86-9fcf-0f6dcf8f6cf1
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/ac6337c0/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-story-b2624d83-0af8-4ccf-a540-9df017585991
Type: image/png
Size: 369 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/ac6337c0/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-57baeda3-25cd-4541-8157-59fbf3b4c711
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220531/ac6337c0/attachment-0007.png>