Forcing SHA1 signing via metadata

[Andrew Morgan]

On Tue, 15 Mar 2016, Cantor, Scott wrote:

>> I'm reading the profile document[2] for that, but it isn't exactly 
>> clear what I need to put in my manual metadata I'm writing.
>
> Helpful fodder, https://wiki.shibboleth.net/shibboleth
>
>  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
>    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
>    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
>  </md:Extensions>
>
> I don't know that I would necessarily advise it as superior to just 
> creating a rule for it, it's not as simple as just adding a 
> NameIDFormat.

I figured it might be slightly more encapsulated because I'm already 
writing metadata for this vendor.  If there is a reason to prefer one way 
over the other, just let me know.

> What is it that required that? I just went live, and so far the only 
> thing that didn't handle SHA-2 has been a 12 year old ezproxy server 
> that needs to die in a fire.

OpsGenie is the vendor.  They don't have Shibboleth specific SSO 
instructions.  Their generic SAML 2.0 docs don't mention the algorithm, 
but the ADFS instructions [1] specifically say to switch to SHA1.  I don't 
see it mentioned on any of their other SSO integrations though...  Maybe 
it's only required to use SHA1 for ADFS??

Thanks,
 	Andy


[1] https://www.opsgenie.com/docs/sso/adfs