SHA1 signed authn request issue

[Yavor Yanakiev]

Hello,

We have a third party vendor which is sending a signed authentication
request but with SHA1. IdP v3.3 is rejecting the request with

2017-03-10 15:22:40,716 - WARN
[org.apache.xml.security.signature.XMLSignature:760] - [128.122.5.152] -
Signature verification failed.
2017-03-10 15:22:40,719 - ERROR
[org.opensaml.security.x509.impl.BasicX509CredentialNameEvaluator:300] -
[128.122.5.152] - Credential failed name check: [subjectName='CN=*.
taskstream.com,OU=Technology,O=TaskStream\, LLC,L=New York City,ST=New
York,C=US']

Since we were able to modify the metadata we set AuthnRequestsSigned="false"

<md:SPSSODescriptor WantAssertionsSigned="false"
AuthnRequestsSigned="false"
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<md:KeyDescriptor use="signing">

but it didn't do the trick.

The rest of the SPs we work with and which are sending signed authn request
seem to use SAH256  and there is no issues with them.  Also, IdP v3.2 has
no similar problem.

Is SHA1 disabled in IdP v3.3 for authentication requests and if so, how we
can enabled it for a particular SP?

-- 
Yavor Yanakiev
Systems Developer for Identity Services
212-992-7585
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170310/01eb5c03/attachment.html>