Sending the SAMLReply/Assertion

[Jan Vilhuber]

Sure, but say I’m planning on migrating all my customers from sha-1 to sha-256, for example, I’d like to know which of them might still be using Sha-1 before I turn that off. If I could get a list (metrics) indicating that IDP-X is using SHA-1, then I would reach out to them and ask “does your IDP even support sha-256?”, for example.

Similarly, in a certificate rollover, I’d want to tell customers “you’re still using the old metadata and cert. Please update.”

Without knowing who is actually doing what, I can’t really just disable things (potentially breaking a customer’s access).

Or am I thinking about this wrong?
Jan


From: users <users-bounces at shibboleth.net> on behalf of Mak, Steve <makst at upenn.edu>
Date: Monday, 12 July 2021 at 10:11
To: Shib Users <users at shibboleth.net>
Subject: Re: Sending the SAMLReply/Assertion
Jan,

                Another idea: Is there an SP API (Soap or otherwise) where I might be able to get the saml assertion from the SP given a session Index?

https://wiki.shibboleth.net/confluence/display/SP3/AssertionExport<https://urldefense.com/v3/__https:/wiki.shibboleth.net/confluence/display/SP3/AssertionExport__;!!GEjU_1jlQXGQfQ!zNO34PJuMU3z1J98VK87x159ZxHTZpUd4Kl65pZL6U_glsG1vwgp2GpMXlHOuEyLog$>


                What I’m specifically looking for is things like which hashing and encryption algorithms (and hopefully which certificate was used, i.e. things like SP subject-name and serial number) were used (and by whom).

I want to remind you that the encryption that an IdP uses will be something it picks from your service's supported encryption algos which will be listed in your SP metadata… so if you want to strike an algo off your list you would simply update your sp metadata and communicate that change to the IdP. At least that's what it's there for. I'm not sure if you're implying that IdPs simply pick whatever they want and that's not always the case. Your SP metadata provides them with the encryption cert to use and the supported algos and the IdP builds from that menu. So, the only thing you'd be really auditing is your own config.

- Steve
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210713/c8280efc/attachment.htm>