Upgrade from V2 to V3 - how to change to SHA1

[Jeffrey Crawford]

I was able to do the following in the relying-party.xml

outside of the shibboleth.RelyingPartyOverrides add:

    <bean id="SHA1SecurityConfig"
          parent="shibboleth.DefaultSecurityConfiguration"

p:signatureSigningConfiguration-ref="shibboleth.SigningConfiguration.SHA1"
/>

then in the override sections reference it and add the bean to the profile:

            <property name="profileConfigurations">
                <list>
                    <bean parent="Shibboleth.SSO"
                          p:includeAttributeStatement="true"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
/>
                    <bean parent="SAML2.SSO"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
/>
                    <bean parent="SAML2.ECP"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
/>
                    <bean parent="SAML2.Logout"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
/>
                    <bean parent="SAML2.AttributeQuery"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
/>
                    <bean parent="SAML2.ArtifactResolution"
                          p:securityConfiguration-ref="SHA1SecurityConfig"
/>
                </list>
            </property>

I'm not sure if all the profiles are required but I needed to fix something
quick and never went back to check what was really required.

Jeffrey E. Crawford
Enterprise Service Team <jeffreyc at ucsc.edu>
    ^         ^
   / \  ^    / \    ^
  /   \/ \  /   \  / \
 /        \/     \/   \
/                      \

You have been assigned this mountain to prove to others that it *can* be
moved.

On Thu, Jul 20, 2017 at 8:07 AM, Jorj Bauer <jorj at temple.edu> wrote:

> We did it when we first rolled out IdP v3 by modifying the code (until we
> could get everything cleaned up).
>
> No idea if that approach still works several minor version updates later.
> This is very old and may no longer be accurate, but it might give you a
> hint as to how to proceed.
>
> IdP v3 relies on the defaults of OpenSAML. Somewhere around line 142 of
> src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConf
> igurationBootstrap.java:
>
> // RSA
> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256,
> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384,
> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512,
> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1,
>
> ... change that to have RSA_SHA1 at the top.
>
> Recompile the JAR, skipping unit tests (the unit tests will now fail
> because we've violated the assumption about default algorithm ordering):
>
> $ mvn -Dmaven.test.skip=true install
>
> Copy the target .jar file (target/opensaml-xmlsec-impl-3.1.1.jar, or
> something like that) to your installation, and thne rebuild your war file.
>
> HTH,
> -- Jorj
>
>
>
>
> On 07/20/2017 10:59 AM, Ramaiah, Vanna G. wrote:
>
>> Does anyone know how to change the signing algorithm globally from SHA2
>> to SHA1?
>>
>> -----Original Message-----
>> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
>> Scott
>> Sent: Wednesday, July 19, 2017 3:04 PM
>> To: Shib Users <users at shibboleth.net>
>> Subject: Re: Upgrade from V2 to V3 - how to change to SHA1
>>
>>
>>
>> On 7/19/17, 2:54 PM, "users on behalf of Ramaiah, Vanna G." <
>> users-bounces at shibboleth.net on behalf of ramaiah at musc.edu> wrote:
>>
>> We upgraded from V2 to V3.3. We have one SP that cannot use SHA256.
>>> How to change the signing configuration just for one SP? Shib wiki has
>>> document for the installation not for upgraded files. Please help.
>>>
>>
>> There is no support for changing it in the legacy relying-party format.
>> Globally changing it back is undoubtedly possible, but I don't think I have
>> ever worked out any particular way to do it.
>>
>> -- Scott
>>
>>
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>>
>>
>>
>>
>> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170720/b5e337b4/attachment.html>