<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 8/31/16 9:41 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:3A85F655-80C3-4BD2-9928-049DD3F9D437@osu.edu"
type="cite">
<pre wrap="">On 8/31/16, 8:35 AM, "dev on behalf of Lasse Højgaard" <a class="moz-txt-link-rfc2396E" href="mailto:dev-bounces@shibboleth.netonbehalfoflash@stibosystems.com"><dev-bounces@shibboleth.net on behalf of lash@stibosystems.com></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">So: is the documentation wrong, or is there some technical explanation for this
limitation?
</pre>
</blockquote>
<pre wrap="">
I suspect it's documentation copied from older versions and is wrong. </pre>
</blockquote>
<br>
Yes, it is copied from v2 and it is wrong. It actually was never
even true in v2. Even there in v2 we always pulled the algorithm to
use from the global SecurityConfiguration in use. However, the
setting was global, so not as useful in practice.<br>
<br>
In v3 you can supply the algorithm just like for other signing, via
the SignatureSigningParameters of the SecurityParametersContext of
the outbound MessageContext.<br>
<br>
I think this actually may have just come from the language in the
binding spec, which only explicitly mentions RSA and DSA with SHA1.
<br>
<br>
In any case, I'll fix the Javadocs.<br>
<br>
<br>
<blockquote cite="mid:3A85F655-80C3-4BD2-9928-049DD3F9D437@osu.edu"
type="cite">
<pre wrap="">The algorithm identifiers come from the XML Signature standard, so as long as we have the necessary mappings in place, any of them should work, including ECDSA.
</pre>
</blockquote>
<br>
Yes, exactly. For example, any of the RSA, DSA and ECDSA variants
with any of the SHA-2 variants should work, as long as the algorithm
URI is known to the library via an appropriate AlgorithmDescriptor,
and the JVM has the corresponding runtime support. Even an HMAC one
would work, if you supplied a symmetric key credential (with
SecretKey) and the appropriate algorithm URI.<br>
<br>
New locally-defined AlgorithmDescriptors can be registered on the
AlgorithmRegistry instance used. So even algorithms that don't come
with OpenSAML out-of-the-box can be used, as long as you have a JCA
security provider that implements it.<br>
</body>
</html>