Unable to verify the XML signature.

[Brent Putman]

On 3/24/17 2:15 PM, Cantor, Scott wrote:
> On 3/24/17, 1:56 PM, "users on behalf of Ramaiah, Vanna G." <users-bounces at shibboleth.net on behalf of ramaiah at musc.edu> wrote:
>
>> When using legacy file, is there a way to change the default algorithm to sha1 or just for one provider?
> I don't think it works, but you can try changing the property default if you like.

I wasn't sure either, so I looked. I think Scott is correct.  The
Spring RelyingPartyGroupParser which is involved here for the legacy
XML doesn't set up anything for SignatureSigningConfiguration in the
RelyingPartyConfigurationResolver it produces.  So I believe that the
SHA-256 default is actually coming from the OpenSAML global library
defaults, not anything in the IdP layer.

That is consistent with the way V2 worked in terms of the approach.  We
just changed both the IdP and library defaults for signing to SHA-256.

>  That would be a horrible choice to change.

Agreed.  You don't want to cripple your whole system with a weak(er)
algorithm to workaround a vendor that's arguably broken.  At the very
least, their technology is out-of-date.


>
> You cannot change it for just one, so you have no real choice, you're done, move off it. Or insist that the SP correct its bug I guess.

I agree those are the 2 best choices.

If you really, really wanted to globally change the IdP (really
OpenSAML) signing defaults to SHA-1 - and were OK with what that means
in terms of the security ramifications - then there is a way to wire
that in Spring, albeit a little nasty syntax maybe.  If you really,
really, really want to go there, you can add something like the
following to your conf/global.xml.  I haven't tested, so YMMV.


    <bean id="OpenSAMLGlobalSigningConfig"
class="org.opensaml.xmlsec.SecurityConfigurationSupport"
        factory-method="getGlobalSignatureSigningConfiguration"
        depends-on="shibboleth.OpenSAMLConfig" />
           
    <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"
        p:targetObject-ref="OpenSAMLGlobalSigningConfig"
        p:targetMethod="setSignatureAlgorithms">
        <property name="arguments">
            <list>
                <list>
                    <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1"
/>
                    <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1"
/>
                    <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA1"
/>
                    <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_MAC_HMAC_SHA1"
/>
                </list>
            </list>
        </property>
    </bean>
   
    <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"
        p:targetObject-ref="OpenSAMLGlobalSigningConfig"
        p:targetMethod="setSignatureReferenceDigestMethods">
        <property name="arguments">
            <list>
                <list>
                    <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_DIGEST_SHA1"
/>
                </list>
            </list>
        </property>
    </bean>
   

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170324/2f47b842/attachment.html>