SP expecting SHA1 or SHA256 algorithm but Shibboleth IDP responding with SHA 512.

[Brent Putman]

On 7/13/16 2:32 AM, Muthuraman Sethuraman Sethuraman (US - Advisory) wrote:
>
> Netscaler SP is not supporting SHA512 algorithms yet.
>
>  
>
> Is there a way i can configure Shibboleth IDP 3.2.1 to use sha256
> algorithm to sign the response.
>


Well, the out-of-the-box IdP v3 default is actually SHA-256.  So unless
you specifically  configured for SHA-512, I think the only way this
could happen is if the SP's metadata says to do SHA-512. The stated
preferences of the SP in its metadata will override the IdP configuration.

So check that. If Netscaler themselves gave you their metadata, or
you're getting it from a metadata publisher, etc, then it's just wrong
and you should tell them.  If this is a case where you had to construct
the SP metadata yourself in order to feed to the IdP, then you just
need to remove or re-order the algorithms listed in the Extensions element.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160713/7aabdc29/attachment.html>