extending the SHA-2 addon for the Shib IdP

[Cantor, Scott]

On 10/29/13, 8:30 AM, "Tom Scavo" <trscavo at gmail.com> wrote:

>Regarding the shib extension for SHA-2:
>
>https://wiki.shibboleth.net/confluence/x/H4O3
>
>How difficult would it be to extend this addon so that the IdP could,
>say, configure SHA-256 by default, but then have the ability to
>override that default on a per-RP basis (for those SPs not compatible
>with SHA-2)?

There is no way to extend it to do that without replacing the profile
handlers themselves, they're hardcoded to call into code without providing
a non-default security configuration object. There is no pluggability in
the code as it stands on top, only in the lower layers.

So you're talking about new config work (lots of it) and then rewriting
all of the profile code to use new base classes that know how to use new
configuration to drive different calls into OpenSAML.

It's IdP V2.5, nothing really short of that. There's no way to make it
deployable without it being an upgrade.

-- Scott