IdP and algorithm support extensions in SP metadata

[Max Spicer]

If you are able to manage this with security configurations, you may find
this article useful. It gives detail on defining multiple configurations
and using metadata to apply them on a per-SP basis.

https://shibboleth.atlassian.net/wiki/spaces/KB/pages/3043917826/IdP+Key+and+Certificate+Management

Regards,

Max Spicer

On Mon, 16 Oct 2023 at 23:22, Brent Putman via users <users at shibboleth.net>
wrote:

>
> On 10/16/23 8:50 AM, Cantor, Scott via users wrote:
>
> I won't go into the details about why this is desired, but is there any way to
> tell the IdP to *ignore* algorithm extensions in SP metadata, and to
> prioritize an entity attribute filter that is adding a securityConfig override to
> that SP entry?
>
> No, there's no filtering option to remove that extension. I considered it because of all the incorrect metadata claiming (lack of) GCM support in InCommon, which prevents me forcing them over to GCM, but I never got around to it.
>
>
> Haven't tested, but I believe there is a different way to effectively get
> the desired result (sign with the RSA cert rather than the EC one).  You
> could add a custom security config for those RPs which excludes all the
> ECDSA algorithm URIs ("exclude" as in the now-deprecated term
> "blacklist").  That should prevent the EC cert from being selected, and so
> fall through to the RSA one.
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 
Max Spicer
Identity Systems, IT Services, University of York
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231017/eaff477e/attachment.htm>