Trouble Configuring SHA-256 Signatures

[Marvin Addison]

I was shocked to discover that we are apparently not signing SAML messages
with the RSA-SHA256 algorithm despite meticulously following the wiki
instructions [1]. Everything coming out of our pprd IdP has a signature
like the following:

   <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
      <ds:SignedInfo>
         <ds:CanonicalizationMethod Algorithm="
http://www.w3.org/2001/10/xml-exc
-c14n#"/>
         <ds:SignatureMethod Algorithm="
http://www.w3.org/2000/09/xmldsig#rsa-sh
a1"/>

I'm reasonably certain that we had this working at one point with an
earlier extension that Brent developed [2], so I simply upgraded to the
1.0.0 component according to the wiki and didn't verify the signatures.
That's my bad, of course. I guess it's possible I got the config wrong
since the wiki doesn't specify exactly what algorithms to turn on, but I'm
fairly certain it's correct:

    <bean id="shibboleth.idp.ext.OpensamlCustomSecurityConfig"

class="edu.internet2.middleware.shibboleth.idp.ext.securityconfig.OpensamlCustomSecurityConfigBean"
        depends-on="shibboleth.OpensamlConfig">

        <!-- primary algorithms for use with RSA signing keys -->
        <property name="signatureAlgorithmRSA"
            value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
        <property name="signatureReferenceDigestMethod"
            value="http://www.w3.org/2001/04/xmlenc#sha256"/>

        <!-- other signature algorithms for use with other signing keys -->
        <property name="signatureAlgorithmDSA"
            value="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
        <property name="signatureAlgorithmEC"
            value="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256"/>
        <property name="signatureAlgorithmAES"
            value="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256"/>
        <property name="signatureAlgorithmDESede"
            value="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256"/>
     </bean>

I've turned up loggers for more information, but I simply don't see what's
wrong. I hope someone on the list has some suggestions.

Thanks,
M

[1]
https://wiki.shibboleth.net/confluence/display/SHIB2/Changing+IdP+Signature+Method+Algorithm
[2]
https://svn.middleware.georgetown.edu/putmanb/shibboleth-idp-ext-opensaml-custom-security-config/trunk/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150114/9c2369f8/attachment-0001.html