RelyingPartyOverrides

[Brent Putman]

On 3/24/15 1:06 PM, Michael O Holstein wrote:
>
> Next question .. when specifying SHA1 for a RelyingParty where do you define the certificates (both in the config and where to put them) .. since the default certs are SHA256 and you can't sign SHA1 with that.

Well, that's not actually correct.  The signature algorithm used by the
cert issuer (or self-signer) to issue the cert have nothing to do with
the SAML XML signature generation. You can certainly generate
SHA-1-based signatures regardless of the algorithm(s) used within the
signing cert (partially b/c you aren't literally signing with the cert,
you're signing with the public/private key pair.  The fact that the
public key is also in a cert is incidental).

That said, you can use a different cert with which to sign for a
specific relying party.  That is also documented on the same wiki
page.  It's essentially the "Per-Profile Credential" example, except: 
To combine SHA-1 algorithms with the custom credential you'd modify the
parent bean there to be shibboleth.SigningConfiguration.SHA1 rather
than the .SHA256 one, like so:


<bean id="ObnoxiousSecurityConfig"
parent="shibboleth.DefaultSecurityConfiguration">
    <property name="signatureSigningConfiguration">
        <bean parent="shibboleth.SigningConfiguration.SHA1"
p:signingCredentials-ref="ObnoxiousVendorCredential" />
    </property>
</bean>||
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150324/a83cfd6f/attachment.html