Upgrade from V2 to V3 - how to change to SHA1

[Jeffrey Crawford]

okay just realized I gave the answer in the non-legacy format.

Jeffrey E. Crawford
Enterprise Service Team <jeffreyc at ucsc.edu>
    ^         ^
   / \  ^    / \    ^
  /   \/ \  /   \  / \
 /        \/     \/   \
/                      \

You have been assigned this mountain to prove to others that it *can* be
moved.

On Thu, Jul 20, 2017 at 9:31 AM, Jeffrey Crawford <jeffreyc at ucsc.edu> wrote:

> I was able to do the following in the relying-party.xml
>
> outside of the shibboleth.RelyingPartyOverrides add:
>
>     <bean id="SHA1SecurityConfig"
>           parent="shibboleth.DefaultSecurityConfiguration"
>           p:signatureSigningConfiguration-ref="shibboleth.SigningConfiguration.SHA1"
> />
>
> then in the override sections reference it and add the bean to the profile:
>
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="Shibboleth.SSO"
>                           p:includeAttributeStatement="true"
>                           p:securityConfiguration-ref="SHA1SecurityConfig"
> />
>                     <bean parent="SAML2.SSO"
>                           p:securityConfiguration-ref="SHA1SecurityConfig"
> />
>                     <bean parent="SAML2.ECP"
>                           p:securityConfiguration-ref="SHA1SecurityConfig"
> />
>                     <bean parent="SAML2.Logout"
>                           p:securityConfiguration-ref="SHA1SecurityConfig"
> />
>                     <bean parent="SAML2.AttributeQuery"
>                           p:securityConfiguration-ref="SHA1SecurityConfig"
> />
>                     <bean parent="SAML2.ArtifactResolution"
>                           p:securityConfiguration-ref="SHA1SecurityConfig"
> />
>                 </list>
>             </property>
>
> I'm not sure if all the profiles are required but I needed to fix
> something quick and never went back to check what was really required.
>
> Jeffrey E. Crawford
> Enterprise Service Team <jeffreyc at ucsc.edu>
>     ^         ^
>    / \  ^    / \    ^
>   /   \/ \  /   \  / \
>  /        \/     \/   \
> /                      \
>
> You have been assigned this mountain to prove to others that it *can* be
> moved.
>
> On Thu, Jul 20, 2017 at 8:07 AM, Jorj Bauer <jorj at temple.edu> wrote:
>
>> We did it when we first rolled out IdP v3 by modifying the code (until we
>> could get everything cleaned up).
>>
>> No idea if that approach still works several minor version updates later.
>> This is very old and may no longer be accurate, but it might give you a
>> hint as to how to proceed.
>>
>> IdP v3 relies on the defaults of OpenSAML. Somewhere around line 142 of
>> src/main/java/org/opensaml/xmlsec/config/DefaultSecurityConf
>> igurationBootstrap.java:
>>
>> // RSA
>> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256,
>> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384,
>> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512,
>> SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1,
>>
>> ... change that to have RSA_SHA1 at the top.
>>
>> Recompile the JAR, skipping unit tests (the unit tests will now fail
>> because we've violated the assumption about default algorithm ordering):
>>
>> $ mvn -Dmaven.test.skip=true install
>>
>> Copy the target .jar file (target/opensaml-xmlsec-impl-3.1.1.jar, or
>> something like that) to your installation, and thne rebuild your war file.
>>
>> HTH,
>> -- Jorj
>>
>>
>>
>>
>> On 07/20/2017 10:59 AM, Ramaiah, Vanna G. wrote:
>>
>>> Does anyone know how to change the signing algorithm globally from SHA2
>>> to SHA1?
>>>
>>> -----Original Message-----
>>> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
>>> Scott
>>> Sent: Wednesday, July 19, 2017 3:04 PM
>>> To: Shib Users <users at shibboleth.net>
>>> Subject: Re: Upgrade from V2 to V3 - how to change to SHA1
>>>
>>>
>>>
>>> On 7/19/17, 2:54 PM, "users on behalf of Ramaiah, Vanna G." <
>>> users-bounces at shibboleth.net on behalf of ramaiah at musc.edu> wrote:
>>>
>>> We upgraded from V2 to V3.3. We have one SP that cannot use SHA256.
>>>> How to change the signing configuration just for one SP? Shib wiki has
>>>> document for the installation not for upgraded files. Please help.
>>>>
>>>
>>> There is no support for changing it in the legacy relying-party format.
>>> Globally changing it back is undoubtedly possible, but I don't think I have
>>> ever worked out any particular way to do it.
>>>
>>> -- Scott
>>>
>>>
>>> --
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>>
>>>
>>>
>>>
>>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170720/e601dccf/attachment-0001.html>