Trouble Configuring SHA-256 Signatures

[Brent Putman]

On 1/14/15 7:18 AM, Marvin Addison wrote:



>
>     <bean id="shibboleth.idp.ext.OpensamlCustomSecurityConfig"
>        
> class="edu.internet2.middleware.shibboleth.idp.ext.securityconfig.OpensamlCustomSecurityConfigBean"
>         depends-on="shibboleth.OpensamlConfig">
>
>         <!-- primary algorithms for use with RSA signing keys -->
>         <property name="signatureAlgorithmRSA"
>             value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
>         <property name="signatureReferenceDigestMethod"
>             value="http://www.w3.org/2001/04/xmlenc#sha256"/>


Those algorithms look correct to me for RSA, at least just eyeballing
it.  In any case, if they weren't, you'd get an exception from Santuario
or the JCA framework indicating an invalid or unresolveable algorithm. 
The same would be true if the SHA-256 variants weren't supported by your
JRE.



>
> I've turned up loggers for more information, but I simply don't see
> what's wrong. I hope someone on the list has some suggestions.
>

I don't have any really good ideas.  Maybe if this security config
initializing bean was really running before OpenSAML actually was
initialized, the global security config instance would be null, so the
config bean would be essentially a no-op and so nothing would be set. 
But the depends-on above looks correct, unless you guys have renamed the
'shibboleth.OpensamlConfig' bean for some reason.  Maybe check for an
unintended character added to the bean name or something l like - a
stray vi keystroke, etc?

The only logging in the config bean is just the case where the global
security config isn't an instance of the expected type, which would also
catch the null case I just described.  That's on WARN, so if you aren't
seeing that, I'm out of ideas at the moment.  This bean is very simple,
there's not much to go wrong.

Since it's just the one class and the project is easy to build, my only
other suggestion would be to add some debug logging to the config
initializing bean, just to see if it's even getting called and doing
anything.  Or if you want I could do that in the project in svn itself.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150114/22454bb9/attachment.html