Upgrade from V2 to V3 - how to change to SHA1

[Jorj Bauer]

We did it when we first rolled out IdP v3 by modifying the code (until 
we could get everything cleaned up).

No idea if that approach still works several minor version updates 
later. This is very old and may no longer be accurate, but it might give 
you a hint as to how to proceed.

IdP v3 relies on the defaults of OpenSAML. Somewhere around line 142 of 
src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConfigurationBootstrap.java:

// RSA
SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256,
SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384,
SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512,
SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1,

... change that to have RSA_SHA1 at the top.

Recompile the JAR, skipping unit tests (the unit tests will now fail 
because we've violated the assumption about default algorithm ordering):

$ mvn -Dmaven.test.skip=true install

Copy the target .jar file (target/opensaml-xmlsec-impl-3.1.1.jar, or 
something like that) to your installation, and thne rebuild your war file.

HTH,
-- Jorj



On 07/20/2017 10:59 AM, Ramaiah, Vanna G. wrote:
> Does anyone know how to change the signing algorithm globally from SHA2 to SHA1?
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
> Sent: Wednesday, July 19, 2017 3:04 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: Upgrade from V2 to V3 - how to change to SHA1
>
>
>
> On 7/19/17, 2:54 PM, "users on behalf of Ramaiah, Vanna G." <users-bounces at shibboleth.net on behalf of ramaiah at musc.edu> wrote:
>
>> We upgraded from V2 to V3.3. We have one SP that cannot use SHA256.
>> How to change the signing configuration just for one SP? Shib wiki has document for the installation not for upgraded files. Please help.
>
> There is no support for changing it in the legacy relying-party format. Globally changing it back is undoubtedly possible, but I don't think I have ever worked out any particular way to do it.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
>
>
>
>