RHEL4 Shibboleth SP 2.4.3 and SHA256 Signatures

[Cantor, Scott]

On 10/6/11 6:49 PM, "shibboleth at krugs.org" <shibboleth at krugs.org> wrote:
>
>Our Federation's SAML2 Metadata recently switched to using SHA256
>for signatures.  Shibboleth SPs on CentOS5 validate these
>signatures fine, but on RHEL4 they are failing.

OpenSSL on RH4 doesn't support SHA-2.

>Any tips on what to specifically look at to try and track this down
>would be good.  As much as I would like to make everyone update to
>a more recent version of RHEL, I am not sure I can make that happen.

Since it's EOL in February, I will not be supplying packages for V2.5 of
the SP.

The IdP does not currently support the metadata extension that allows for
advertising which SPs support SHA-2. That is planned for V3.

You really can't change to SHA-2 with some kind of global change; with any
such change, breakage is what you're going to get. Too many different
implementations out there have gaps.

-- Scott