Forcing SHA1 signing via metadata

[Cantor, Scott]

> I'm reading the profile document[2] for that, but it isn't exactly clear
> what I need to put in my manual metadata I'm writing.

Helpful fodder, https://wiki.shibboleth.net/shibboleth

  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
  </md:Extensions>

I don't know that I would necessarily advise it as superior to just creating a rule for it, it's not as simple as just adding a NameIDFormat.

What is it that required that? I just went live, and so far the only thing that didn't handle SHA-2 has been a 12 year old ezproxy server that needs to die in a fire.

-- Scott