Forcing SHA1 signing via metadata

[Cantor, Scott]

> I figured it might be slightly more encapsulated because I'm already
> writing metadata for this vendor.  If there is a reason to prefer one way
> over the other, just let me know.

The actual wiring of a lot of specialized rules is much harder in Spring than writing a few lines of XML in a metadata file and letting the IdP chew on it. The only reason the SHA-1 change is not is that we pre-wired it with a bean you can just inject, so that specific case happens to be simpler.

> OpsGenie is the vendor.  They don't have Shibboleth specific SSO
> instructions.  Their generic SAML 2.0 docs don't mention the algorithm,
> but the ADFS instructions [1] specifically say to switch to SHA1.  I don't
> see it mentioned on any of their other SSO integrations though...  Maybe
> it's only required to use SHA1 for ADFS??

No, but I would get it working first and then flip it back and verify that it doesn't actually work. Three guesses how often any of these vendors updates their documentation.

-- Scott