idp sha2 signing

[Tom Scavo]

On Tue, Oct 7, 2014 at 12:58 PM, Qian, Yi <yqian at ku.edu> wrote:
>
> University of Kansas is trying to federate with Equifax, they requires sha2
> signing, our IdP is Shibboleth 2.4 and I believe it is using sha1, I found a
> contribution from shib wiki
> https://wiki.shibboleth.net/confluence/display/SHIB2/Changing+IdP+Signature+Method+Algorithm
> to change shib IdP using sha2.
>
> 1.      Is it still accurate? the last update is little over a year ago.

Yes, that is still the recommended approach for Shib IdP 2.4 or later.

> 2.      The warning message indicate the signing method change is all or
> nothing, I cannot adjust per individual SP, is that correct?

That is correct.

> 3.      Since we have quite bit SPs, so before I move down the road, is
> there a way to check with SPs that they support sh2 signing?

You can follow a course of action such as this:

https://spaces.internet2.edu/x/EQvkAg

YMMV of course.

Tom