Signing Assertion with SHA256

[Yang, Gang CTR (US)]

Brent,

Thanks for the reply. I followed your pointer to make code changes and it worked. But what's interesting is that OpenAM seems not have defined the constant for SHA256 digest method. I could only find SignatureConstants.ALGO_ID_DIGEST_SHA384 and SignatureConstants.ALGO_ID_DIGEST_SHA1. I wonder if SHA256 is actually supported. What digest method is used for the signature of the SignedInfo then?

I also found some posts that mentioned SecurityConfiguration class, which contains the security parameters including the reference digest method. However, this a read-only interface and I can't seem to change anything. I'm wondering what's the right interface or class in OpenAM to programmatically change the configuration. This way may be more general than changing each ContentReference instance's settings. Would appreciate if any one can provide any pointer on this.

Thanks again.
Gang
________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] on behalf of Brent Putman [putmanb at georgetown.edu]
Sent: Monday, January 13, 2014 12:32 PM
To: dev at shibboleth.net
Subject: Re: Signing Assertion with SHA256

On 1/13/14 11:20 AM, Yang, Gang CTR (US) wrote:
>
> However, I'm having a hard time to find the OpenSAML API to set the digest method for the reference. In my code, I first obtain the org.opensaml.xml.signature.Signature, which allows me to set only the signature algorithm and canonicalization algorithm. Then after associating the signature object with the SAML object, I call Singer.sigObject(Signature) to sign the SAML object, where I don't seem to have a chance to set the digest method for the references. Can some one provide a pointer or help?


The Reference(s) in the signature are determined by the list of
ContentReference(s) that are exposed on the OpenSAML Signature class.

After you add the Signature instance to the SAML instance being signed
(e.g. Assertion), there will be one ContentReference instance in that
list (b/c the Assertion's AbstractSignableSAMLObject superclass
auto-adds it when Signarure#setSignature is called).  The
ContentReference concrete type will be SAMLObjectContentReference.  That
content reference subtype has methods to get and set the DigestMethod
algorithm that will be used.
--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net