Changing signing algorithm for a specific relying party

[Greg Haverkamp]

It's all covered here: https://wiki.shibboleth.net/confluence/x/F4AEAQ

Here's how we're doing it, stripping specifics to avoid shaming:

    <bean id="lblSHA1DependentSPConfig"
parent="shibboleth.DefaultSecurityConfiguration">
        <property name="signatureSigningConfiguration">
            <bean parent="shibboleth.SigningConfiguration.SHA1" />
        </property>
    </bean>

    <!-- Container for any overrides you want to add. -->

    <util:list id="shibboleth.RelyingPartyOverrides">

...

        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{...}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="Shibboleth.SSO"
p:includeAttributeStatement="true"

p:securityConfiguration-ref="lblSHA1DependentSPConfig"  />
                </list>
            </property>
        </bean>
...

Greg


On Tue, Jan 5, 2016 at 11:52 AM, Wessel, Keith <kwessel at illinois.edu> wrote:

> We have a vendor, Qualys, whose connection with our IDP has broken since
> our upgrade to V3. They're getting an error trying to validate the
> signature on the assertion we're sending to them. I suspect they're not
> able to handle SSHA-256 signatures.
>
> I don't see any info in the relying party docs for V3 on how to override
> the signing algorithm for a specific SP. What would I need to add to the
> block in my relying-party.xml for Qualys to use SSHA-1 signatures? I
> already have a block for Qualys to not encrypt assertions, but I'm not sure
> how to set the signing algorithm.
>
> Thanks,
> Keith
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160105/23f41943/attachment.html>