<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=windows-1252">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Just reporting some (minor) success. Managed to get my first 3.0.0
test IdP up and running today, complete with LDAP authN and
attribute resolution. <br>
<br>
At Ian's request I was investigating/testing the support for
algorithm agility in metadata "for real" (not unit tests), and for
me it just worked as expected. SP's metadata specified SHA-512
variants for signing and digest, and that's what it did. <br>
<br>
I shouldn't be, but I'm still amazed sometimes when this stuff
actually works. :-)<br>
<br>
--Brent<br>
<div class="moz-forward-container"><br>
<br>
-------- Forwarded Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject:
</th>
<td>Re: algorithm agility</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
<td>Tue, 13 Jan 2015 20:47:59 -0500</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
<td>Brent Putman <a class="moz-txt-link-rfc2396E" href="mailto:putmanb@georgetown.edu"><putmanb@georgetown.edu></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
<td>Ian Young <a class="moz-txt-link-rfc2396E" href="mailto:ian@iay.org.uk"><ian@iay.org.uk></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
<br>
<div class="moz-cite-prefix">On 1/13/15 3:05 PM, Brent Putman
wrote:</div>
<blockquote cite="mid:54B57A6D.4050105@georgetown.edu" type="cite">
<blockquote
cite="mid:8E9B495D-0C30-411F-9B55-C54D7AABA094@iay.org.uk"
type="cite">
<div class="">I don't think there's much point in your
spending time digging further, unless you have a test
framework you can just try it on. </div>
</blockquote>
<br>
Coincidentally the last few days I've been boning up on Jetty
9.2.x and updating my test IdP 2.x VM (b/c it was ancient and
vulnerable to POODLE). Now that that's done, I was going to
tackle standing up a 3.0.0 IdP for real. Probably not today,
but soon-ish. So I may be in a position to investigate later
this week.<br>
<br>
</blockquote>
<br>
<br>
The office was quiet today, so I did actually manage to get my
first IdP 3.x stood up and working, with LDAP and everything
(yay). I did find a bug in the first 5 seconds of running the
installer, which didn't auger well... <br>
<br>
Anyway, I tried the algorithms in metadata for an SP, and for me
it just worked as expected. The IdP out-of-the-box defaults to
SHA-256 algorithms for signing, which I confirmed. Then I put the
SHA-512 variants in the SP's EntityDescriptor's Extensions:<br>
<br>
<tt><md:Extensions></tt><tt><br>
</tt><tt> <alg:SigningMethod
xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
Algorithm=<a moz-do-not-send="true"
class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512">"http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"</a>></alg:SigningMethod></tt><tt><br>
</tt><tt> <alg:DigestMethod
xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
Algorithm=<a moz-do-not-send="true"
class="moz-txt-link-rfc2396E"
href="http://www.w3.org/2001/04/xmlenc#sha512">"http://www.w3.org/2001/04/xmlenc#sha512"</a>></alg:DigestMethod></tt><tt><br>
</tt><tt></md:Extensions></tt><br>
<br>
<br>
<br>
and I got the expected result on the response signature. Log
details below.<br>
<br>
To save you some time, this logback.xml snippet should give you
some good diagnostic info:<br>
<br>
<tt><logger
name="org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver"
level="TRACE"/></tt><tt><br>
</tt><tt><logger
name="org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver"
level="TRACE"/></tt><tt><br>
</tt><tt><logger
name="org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters"
level="TRACE"/></tt><tt><br>
</tt><br>
<br>
<br>
So I think you've got some local problem going on. If you can't
figure it out, I can help you troubleshoot it if you give me some
more info. But I think at least the simple basic algorithm
agility capability using metadata is working as expected. It's
possible of course that you're triggering some bug that I'm not.<br>
<br>
<br>
<br>
My log data:<br>
<br>
<br>
<tt>2015-01-13 20:31:30,605 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:184]
- Profile Action PopulateSignatureSigningParameters: Signing
enabled</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,606 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:197]
- Profile Action PopulateSignatureSigningParameters: Resolving
SignatureSigningParameters for request</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,607 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:229]
- Profile Action PopulateSignatureSigningParameters: Adding
metadata to resolution criteria for signing/digest algorithms</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,608 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:228]
- Resolved extensions from parent EntityDescriptor:
{urn:oasis:names:tc:SAML:metadata:algsupport}SigningMethod</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,608 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:88]
- Evaluating SAML metadata SigningMethod with algorithm: <a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a>,
minKeySize: null, maxKeySize: null</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,610 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:101]
- Evaluating credential of type: RSA, with length: 2048</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,611 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:107]
- Credential passed eval against SigningMethod</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,611 - DEBUG
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:108]
- Resolved signature algorithm URI from SAML metadata
SigningMethod: <a moz-do-not-send="true"
class="moz-txt-link-freetext"
href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a></tt><tt><br>
</tt><tt>2015-01-13 20:31:30,611 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:228]
- Resolved extensions from parent EntityDescriptor:
{urn:oasis:names:tc:SAML:metadata:algsupport}DigestMethod</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,612 - TRACE
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:184]
- Evaluating SAML metadata DigestMethod with algorithm: <a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.w3.org/2001/04/xmlenc#sha512">http://www.w3.org/2001/04/xmlenc#sha512</a></tt><tt><br>
</tt><tt>2015-01-13 20:31:30,612 - DEBUG
[org.opensaml.saml.security.impl.SAMLMetadataSignatureSigningParametersResolver:189]
- Resolved reference digest method algorithm URI from SAML
metadata DigestMethod: <a moz-do-not-send="true"
class="moz-txt-link-freetext"
href="http://www.w3.org/2001/04/xmlenc#sha512">http://www.w3.org/2001/04/xmlenc#sha512</a></tt><tt><br>
</tt><tt>2015-01-13 20:31:30,619 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:149]
- Resolved SignatureSigningParameters:</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:153]
- Signing credential with key algorithm: RSA</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:158]
- Signature algorithm URI: <a moz-do-not-send="true"
class="moz-txt-link-freetext"
href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512">http://www.w3.org/2001/04/xmldsig-more#rsa-sha512</a></tt><tt><br>
</tt><tt>2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:160]
- Signature KeyInfoGenerator: present</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,620 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:162]
- Reference digest method algorithm URI: <a
moz-do-not-send="true" class="moz-txt-link-freetext"
href="http://www.w3.org/2001/04/xmlenc#sha512">http://www.w3.org/2001/04/xmlenc#sha512</a></tt><tt><br>
</tt><tt>2015-01-13 20:31:30,621 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:163]
- Canonicalization algorithm URI: <a moz-do-not-send="true"
class="moz-txt-link-freetext"
href="http://www.w3.org/2001/10/xml-exc-c14n#">http://www.w3.org/2001/10/xml-exc-c14n#</a></tt><tt><br>
</tt><tt>2015-01-13 20:31:30,621 - DEBUG
[org.opensaml.xmlsec.impl.BasicSignatureSigningParametersResolver:164]
- HMAC output length: null</tt><tt><br>
</tt><tt>2015-01-13 20:31:30,621 - DEBUG
[org.opensaml.saml.common.profile.impl.PopulateSignatureSigningParameters:237]
- Profile Action PopulateSignatureSigningParameters: Resolved
SignatureSigningParameters</tt><br>
<br>
<br>
</div>
<br>
</body>
</html>