Sending the SAMLReply/Assertion

[Mak, Steve]

                say I’m planning on migrating all my customers from sha-1 to sha-256, for example, I’d like to know which of them might still be using Sha-1 before I turn that off

The simplest way would be to inspect all of your customer's metadata. If any of them are signing requests – which is generally unnecessary – they must include a signing cert. You can easily inspect their public signing certs for the signature algorithm without shibSP logs.

If you are concerned with the IdPs public signing cert – you can do the same since you have their IdP metadata also.

As an IdP I have had consuming services request different signature algorithms in the past and we create a new pub cert and send them special idp metadata. It's fairly simple to create a new signing credential and security config in Shibboleth IdP for that. I'm not sure what IdP you're using.

From an IdP perspective I already know all my SPs that "only support sha1" because I need to make a security override for them.
From an SP perspective I already know all the IdPs I federate with and can see their certificates.

If we were planning on deprecating sha1 services I wouldn't need logging at all because I already have all that info elsewhere.

But yes, certificate rollover is a pain for pretty much everyone. The ONLY way you get out of it cleanly is if 100% of your relying parties regularly pull your IdP metadata from a known source, you add the new signing cert to it, and wait enough time for all services be in the cert overlap and then refresh your metadata so that you can switch over to the new one. Then you wait even longer before you pull the old one out and if you don't hear about any fires downstream then your rollover is done.

As an SP, cert rollover is much smaller typically. You just send the IdP your new pub cert and ask them to add it, or you add it to your own published metadata that the IdP pulls. Once you get the all clear, you switch over your SP and you're done.

- Steve
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210713/f0dfd34c/attachment.htm>