Backchannel failing after upgrade

[Cantor, Scott]

On 1/20/17, 3:06 PM, "users on behalf of James Drews" <users-bounces at shibboleth.net on behalf of james.drews at wisc.edu> wrote:

>    Following up (start of semester fires down to smoldering on my end). It appears that the backchannel doesn't like the
> certificate signature algorithm md5WithRSAEncryption.

Oracle disabled MD5 by default last year in an update. If you want to re-enable it, you can override a security system property during container startup or edit java.security and have it break the next time a Java update is applied.

Since we don't supply Java ourselves (for licensing reasons among others), I'd like to note that it wasn't the IdP upgrade that broke this.

There are very few MD5 certs lying around in SPs, it would have to date back many years. There was one at OSU. I didn't even think of it.

As I said already, you should not need this anyway, no SP should need to be using queries.
 
-- Scott