Include RSAKeyValue In Assertions

[Brent Putman]

On 6/22/16 7:48 PM, Jason wrote:
> Hello,
>
> With a v2 IdP, is it possible to have the IdP include an RSAKeyValue
> element in the XML signature in addition to the X509Data element?



Yes.  As Scott said though, it is a global change, so be aware. You'll
be doing this for all SPs.  Most shouldn't care, so just FYI.   (In v3,
you can customize things like this on a per-SP basis if desired).

You have to first add an extension project. You can use the basic
install instructions here [1].

Then, instead of the config snippet for internal.xml indicated in the
"Edit IdP configuration" config section for the algorithm changes, use
this instead:


    <bean id="shibboleth.idp.ext.OpensamlCustomSecurityConfig"
         
class="edu.internet2.middleware.shibboleth.idp.ext.securityconfig.OpensamlCustomSecurityConfigBean"
          depends-on="shibboleth.OpensamlConfig">

        <property name="keyInfoGeneratorFactories">
            <list>
                <bean
class="org.opensaml.xml.security.x509.X509KeyInfoGeneratorFactory">
                        <property name="emitEntityCertificate"
value="true" />
                        <property name="emitEntityCertificateChain"
value="true" />
                        <property name="emitPublicKeyValue" value="true" />
                </bean>
            </list>
        </property>

    </bean>



Of course, if you *do* want to also change the signing algorithms, you
can add those property elements to the bean as well, as indicated in the
wiki.

Restart the IdP, and that should do it.



[1]
https://wiki.shibboleth.net/confluence/display/SHIB2/Changing+IdP+Signature+Method+Algorithm#ChangingIdPSignatureMethodAlgorithm-Obtainingthesoftware
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160623/f383045e/attachment.html>