Support for SHA256?

[Brent Putman]

Sorry, just now getting to my backlog of email.


On 6/5/13 2:35 PM, Cantor, Scott wrote:
> Ok, now I know why you'e confused (and no, it's not a bug). The current
> code base derives the algorithm to use from the credential, and it picks
> that based on the security configuration information. If you want to use
> SHA-2, you have to supply an alternative SecurityConfiguration in the
> appropriate spots to get it to decide on a different algorithm to use.

I too was confused by the OP's original message(s).  Yes, this is all
correct.  OpenSAML can certainly handle SHA-256 signatures, SHA-256
Digests, etc, and indeed any other algorithm, as long as Santuario and
the underlying Java crypto providers support it, there's a defined
algorithm URI and so forth.


>
> With an OpenSAML app, you can do this programmatically (don't ask, I don't
> know how, check the archives or wiki, or wait for Brent to response). I
> believe the bean example JeffK posted from Brent is an example of part of
> that.


Not quite, the project he referenced is the example I did of how to
modify the *global* security configuration using a Spring bean, for
example for use in the IdP.  For more low-level OpenSAML usage, you
could more simply just construct an instance of SecurityConfiguration as
desired.  You could start with the same base config as the global
default, as generated by this class, and then modify it as appropriate.

However, that whole interface is just to facilitate dynamic algorithm
selection based on credentials and things like that, for general use
cases where you don't want to hardcode choices.  You can also much more
directly use e.g. RSA + SHA-256 signatures by just setting up the
Signature instance with the right algorithm selections directly,
avoiding use of SecurityConfiguration entirely.

> What's happening is you didn't supply an alternative security
> configuration, and that's the only way to override the global algorithm
> defaults.


Or alternatively just not use the helper code that makes use of the
SecurityConfiguration interface and instead just supply the desired
algorithm(s) directly on the Signature.

--Brent