I was shocked to discover that we are apparently not signing SAML messages with the RSA-SHA256 algorithm despite meticulously following the wiki instructions [1]. Everything coming out of our pprd IdP has a signature like the following:<div><br></div><div><div>   &lt;ds:Signature xmlns:ds=&quot;<a href="http://www.w3.org/2000/09/xmldsig#">http://www.w3.org/2000/09/xmldsig#</a>&quot;&gt;</div><div>      &lt;ds:SignedInfo&gt;</div><div>         &lt;ds:CanonicalizationMethod Algorithm=&quot;<a href="http://www.w3.org/2001/10/xml-exc">http://www.w3.org/2001/10/xml-exc</a></div><div>-c14n#&quot;/&gt;</div><div>         &lt;ds:SignatureMethod Algorithm=&quot;<a href="http://www.w3.org/2000/09/xmldsig#rsa-sh">http://www.w3.org/2000/09/xmldsig#rsa-sh</a></div><div>a1&quot;/&gt;</div><div><br></div><div>I&#39;m reasonably certain that we had this working at one point with an earlier extension that Brent developed [2], so I simply upgraded to the 1.0.0 component according to the wiki and didn&#39;t verify the signatures. That&#39;s my bad, of course. I guess it&#39;s possible I got the config wrong since the wiki doesn&#39;t specify exactly what algorithms to turn on, but I&#39;m fairly certain it&#39;s correct:</div><div><br></div><div><div>    &lt;bean id=&quot;shibboleth.idp.ext.OpensamlCustomSecurityConfig&quot;</div><div>        class=&quot;edu.internet2.middleware.shibboleth.idp.ext.securityconfig.OpensamlCustomSecurityConfigBean&quot;</div><div>        depends-on=&quot;shibboleth.OpensamlConfig&quot;&gt;</div><div><br></div><div>        &lt;!-- primary algorithms for use with RSA signing keys --&gt;</div><div>        &lt;property name=&quot;signatureAlgorithmRSA&quot;</div><div>            value=&quot;<a href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">http://www.w3.org/2001/04/xmldsig-more#rsa-sha256</a>&quot;/&gt;</div><div>        &lt;property name=&quot;signatureReferenceDigestMethod&quot;</div><div>            value=&quot;<a href="http://www.w3.org/2001/04/xmlenc#sha256">http://www.w3.org/2001/04/xmlenc#sha256</a>&quot;/&gt;</div><div><br></div><div>        &lt;!-- other signature algorithms for use with other signing keys --&gt;</div><div>        &lt;property name=&quot;signatureAlgorithmDSA&quot;</div><div>            value=&quot;<a href="http://www.w3.org/2009/xmldsig11#dsa-sha256">http://www.w3.org/2009/xmldsig11#dsa-sha256</a>&quot;/&gt;</div><div>        &lt;property name=&quot;signatureAlgorithmEC&quot;</div><div>            value=&quot;<a href="http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256">http://www.w3.org/2001/04/xmldsig-more#ecdsa-sha256</a>&quot;/&gt;</div><div>        &lt;property name=&quot;signatureAlgorithmAES&quot;</div><div>            value=&quot;<a href="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256">http://www.w3.org/2001/04/xmldsig-more#hmac-sha256</a>&quot;/&gt;</div><div>        &lt;property name=&quot;signatureAlgorithmDESede&quot;</div><div>            value=&quot;<a href="http://www.w3.org/2001/04/xmldsig-more#hmac-sha256">http://www.w3.org/2001/04/xmldsig-more#hmac-sha256</a>&quot;/&gt;</div><div>     &lt;/bean&gt;</div></div><div><br></div><div>I&#39;ve turned up loggers for more information, but I simply don&#39;t see what&#39;s wrong. I hope someone on the list has some suggestions.</div><div><br></div><div>Thanks,</div><div>M</div><div><br></div><div>[1] <a href="https://wiki.shibboleth.net/confluence/display/SHIB2/Changing+IdP+Signature+Method+Algorithm">https://wiki.shibboleth.net/confluence/display/SHIB2/Changing+IdP+Signature+Method+Algorithm</a></div></div><div>[2] <a href="https://svn.middleware.georgetown.edu/putmanb/shibboleth-idp-ext-opensaml-custom-security-config/trunk/">https://svn.middleware.georgetown.edu/putmanb/shibboleth-idp-ext-opensaml-custom-security-config/trunk/</a></div><div><br></div>