<div>We have a requirement to use SHA256-based algorithms for SAML 2 signature and digest for communicating with an external IDP (possibly Shibboleth, but not positive).</div><div><br></div><div>I have been able to switch the signing algorithm very easily using the shibboleth2.xml signingAlg on the ApplicationDefault, ApplicationOverride and RelyingParty nodes. I've also been able to confirm that setting the shibboleth2.xml digestAlg will properly set the digest algorithm within a signature.</div>
<div><br></div><div>Where I am struggling is that a digest algorithm of SHA1 is consistently being used for the EncryptedKey within the EncryptedAssertion, EncryptedID, despite the digestAlg setting within the shibboleth2.xml</div>
<div><br></div><div>Is there any way to force this digest algorithm an SHA256 as well? It seems to default to SHA1 regardless of value in digestAlg attribute.</div><div><br></div><div>Using Shibboleth SP 2.4.3 on Linux RHEL 5, 64-bit, OpenSaml 2.4.3, XML Tooling 1.4.2.</div>
<div><br></div><div>An example below:</div><div><br></div><div><samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"</div><div> Destination="<a href="https://idp.example.com/SAML2/Redirect/SLO">https://idp.example.com/SAML2/Redirect/SLO</a>"</div>
<div> ID="_4fecc1e19c77c2beed48212b3f721968"</div><div> IssueInstant="2012-04-17T16:47:08Z"</div><div> Version="2.0"></div><div>
<saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://sp.example.com/Shibboleth">https://sp.example.com/Shibboleth</a></saml:Issuer></div><div> <saml:EncryptedID xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"></div>
<div> <xenc:EncryptedData xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>"</div><div> Type="<a href="http://www.w3.org/2001/04/xmlenc#Element">http://www.w3.org/2001/04/xmlenc#Element</a>"></div>
<div> <xenc:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#aes128-cbc">http://www.w3.org/2001/04/xmlenc#aes128-cbc</a>" /></div><div> <ds:KeyInfo xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"></div>
<div> <xenc:EncryptedKey xmlns:xenc="<a href="http://www.w3.org/2001/04/xmlenc#">http://www.w3.org/2001/04/xmlenc#</a>"></div><div> <xenc:EncryptionMethod Algorithm="<a href="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</a>"></div>
<div> <ds:DigestMethod Algorithm="<a href="http://www.w3.org/2000/09/xmldsig#sha1">http://www.w3.org/2000/09/xmldsig#sha1</a>"</div><div> xmlns:ds="<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>"/></div>
<div> </xenc:EncryptionMethod></div><div> <xenc:CipherData></div><div> <xenc:CipherValue>.....</xenc:CipherValue></div><div> </xenc:CipherData></div>
<div> </xenc:EncryptedKey></div><div> </ds:KeyInfo></div><div> <xenc:CipherData></div><div> <xenc:CipherValue>... ...</xenc:CipherValue></div>
<div> </xenc:CipherData></div><div> </xenc:EncryptedData></div><div> </saml:EncryptedID></div><div> <samlp:SessionIndex>8ebfb37e2afededc003df1cf741b7fc21cea1099c79280bad2dd264b6e651d25</samlp:SessionIndex></div>
<div></samlp:LogoutRequest></div>