Forcing SHA1 signing via metadata

[Andrew Morgan]

On Tue, 15 Mar 2016, Cantor, Scott wrote:

>> I figured it might be slightly more encapsulated because I'm already 
>> writing metadata for this vendor.  If there is a reason to prefer one 
>> way over the other, just let me know.
>
> The actual wiring of a lot of specialized rules is much harder in Spring 
> than writing a few lines of XML in a metadata file and letting the IdP 
> chew on it. The only reason the SHA-1 change is not is that we pre-wired 
> it with a bean you can just inject, so that specific case happens to be 
> simpler.
>
>> OpsGenie is the vendor.  They don't have Shibboleth specific SSO 
>> instructions.  Their generic SAML 2.0 docs don't mention the algorithm, 
>> but the ADFS instructions [1] specifically say to switch to SHA1.  I 
>> don't see it mentioned on any of their other SSO integrations though... 
>> Maybe it's only required to use SHA1 for ADFS??
>
> No, but I would get it working first and then flip it back and verify 
> that it doesn't actually work. Three guesses how often any of these 
> vendors updates their documentation.

I followed your advice.  Testing OpsGenie with SHA1 - works.  Testing 
OpsGenie with SHA256 - works.  I'm glad I learned how to set the 
algorithm, but apparently OpsGenie doesn't need SHA1 after all.

Thanks,
 	Andy