Danish Nemlogin sha256 AuthRequest

[Bo Lorentsen]

Hi ...

I am normally a very happy shibboleth SP user, and it serves us well to
integrate SSO too all kinds of systems. Even the nginx module works fast
and stable, so first, thanks to all the authors that have spend time and
energy creating this fantastic tool !

But, I of cause have some problems now, and need to know if anyone may
be able to enlighten me a bit. I have really tried to make our SP
(shibboleth 2.6) send out AuthRequest using sha256 and not sha1 to a
specific idP (nemlogin), but without any luck.

As I understands it, there are two ways to make this work, tinkering
with the idP metadata by injection a <ds:SignedInfo> block,

or inside the shibboleth2.xml file, using application override :

 <ApplicationOverride id="ssi_mrsa"
entityID="https://saml.ssi.essenslms.com" signing="true">
     <Sessions handlerSSL="true" cookieProps="https">
         <SSO entityID="https://saml.nemlog-in.dk">
             SAML2
         </SSO>

         <Logout asynchronous="false">SAML2 Local</Logout>
      </Sessions>

      <CredentialResolver type="File" key="ssi_mrsa.pem"
certificate="ssi_mrsa.pem"/>

      <*RelyingParty* Name="https://saml.ssi.essenslms.com"
digestAlg="http://www.w3.org/2001/04/xmlenc#sha256"
signingAlg="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>

      <MetadataProvider type="XML" validate="true"
          
uri="https://test-nemlog-in.dk/Testportal/Prod-nemlog-in-2-2017.xml"
           backingFilePath="nemlogin_ssi_metadata.xml"
reloadInterval="7200"/>

      <AttributeExtractor type="XML" validate="true" reloadChanges="false"
           path="attribute-map-nemlogin.xml"/>
</ApplicationOverride>

Both of these methods does not result in any errors in the log, but I
still get an sha1 AuthRequest, and not a sha256, as I was hoping for :-(

The shibboleth2.xml version would be my preferred, as I can keep getting
the metadata directly from idP, but the just overwrite the signingAlg
for the idP only (nemlogin does not include any SignedInfo block, as
other idP's does).

I have looked closely inside the log files, but it does not complain
about anything at all, it just ignore my sha256.

I would be really happy is someone could tell me if I have misunderstood
the documentation/concept, or have I been writing the wrong Alg urls ?

Regards ...

/BL

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180625/8eb627e6/attachment.html>