IdP and algorithm support extensions in SP metadata

[Brent Putman]

On 10/16/23 8:50 AM, Cantor, Scott via users wrote:
>> I won't go into the details about why this is desired, but is there any way to
>> tell the IdP to *ignore* algorithm extensions in SP metadata, and to
>> prioritize an entity attribute filter that is adding a securityConfig override to
>> that SP entry?
> No, there's no filtering option to remove that extension. I considered it because of all the incorrect metadata claiming (lack of) GCM support in InCommon, which prevents me forcing them over to GCM, but I never got around to it.


Haven't tested, but I believe there is a different way to effectively 
get the desired result (sign with the RSA cert rather than the EC 
one).  You could add a custom security config for those RPs which 
excludes all the ECDSA algorithm URIs ("exclude" as in the 
now-deprecated term "blacklist").  That should prevent the EC cert from 
being selected, and so fall through to the RSA one.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231016/5723aad6/attachment.htm>