Neocase HR and portal apps?

[Cantor, Scott]

> When you say "this file" you're talking about the credentials.xml file,
> right?  And, of course, associated 'tweaks' to the relying-party.xml and
> idp.properties files?

No, I'm talking about relying-party.xml

Converting over the credentials is just a rename of the files, or changing the properties that point to them, unless you're using password-encrypted keys.

Converting relying-party.xml is a syntax change and then toggling the legacy property the upgrade process sets. But the syntax is very superficially similar and all the properties match, once you do an example or two, the rest is mechanical. And since you're just doing this for testing, it's not crucial to even convert much of anything, just set it up to do SHA-1 by default and run a quick test with a bare bones file.

> Is that a reasonable approach?  Just keep the changes within that set of
> file to allow for the per-entity configuration flexibility of native v3?

There's no point wasting all your time on fully doing up a new config until you actually prove their bug is SHA-2 support. If you prove that, then you can take the time to do a real conversion and test it all.

> I just got off the phone with one of the Neocase engineers.  Any/all
> assessment of non-Shibboleth SAML implementations aside, I have to say
> the initial contact with the Neocase engineer was VERY ENCOURAGING!  He
> had reviewed some error logs and was headed in this 'SHA-1/SHA-2'
> direction even before we talked.  Right now he's looking for a new DLL to
> change on that end to get this working again.  He was a pleasure to talk
> with!

Good, maybe you won't have to do anything then.

> Yet another 'personal sanity check' for me, if you don't mind...  Am I
> correct in thinking that turning off signing and encryption for this SP
> would make the SHA-1/SHA-2 difference a moot point?

Turning off signing would, sure, but I trust I don't need to explain why that's not a good idea., and if you did and it worked, you've just exposed a complete break in their SP.

This doesn't have anything to do with encryption.

-- Scott