Metadata Aggregator - Issues with XMLSignatureSigningStage

[Krug, Jeff]

That was my first guess as well, but I installed those when I first got the error.  Although I never validated they were installed correctly, so it's possible I overlooked something.  It seemed it was just a matter of replacing two policy jar files in the java home security directory.  

________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Tom Poage [tfpoage at ucdavis.edu]
Sent: Wednesday, November 02, 2011 11:29 AM
To: Shib Dev
Subject: Re: Metadata Aggregator - Issues with XMLSignatureSigningStage

Missing JCE Unlimited Strength Policy files, perhaps?

On Nov 2, 2011, at 8:04 AM, Krug, Jeff wrote:

> I did have one question regarding signing algorithm.  Using the xmlsectool-1.1.4 I tweaked it to default to SHA256 signatures (and it uses Apache's digital signature classes to do this).  This worked fine.  The aggregator defaults to SHA256 (although conveniently configurable via a property) using the javax.crypto libraries, but for this I get the following error:
>
> 2011-11-02 10:52:30,398 - ERROR [net.shibboleth.metadata.dom.XMLSignatureSigningStage:644] - Unable to create signature method http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
> java.security.NoSuchAlgorithmException: unsupported algorithm
>        at org.jcp.xml.dsig.internal.dom.DOMXMLSignatureFactory.newSignatureMethod(Unknown Source) ~[na:1.6.0_16]
>        at net.shibboleth.metadata.dom.XMLSignatureSigningStage.buildSignedInfo(XMLSignatureSigningStage.java:641) [aggregator-pipeline-0.6.1.jar:na]
>
> I can set it to use SHA1 via the property and it works fine, but I feel like there is something obvious I'm overlooking that needs to be done to support SHA256 (and better, the same type of error shows up for SHA384 and SHA512).

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net