<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 3/24/15 1:06 PM, Michael O Holstein
wrote:<br>
</div>
<blockquote cite="mid:1427217073873.94286@csuohio.edu" type="cite">
<pre wrap="">
Next question .. when specifying SHA1 for a RelyingParty where do you define the certificates (both in the config and where to put them) .. since the default certs are SHA256 and you can't sign SHA1 with that.
</pre>
</blockquote>
<br>
Well, that's not actually correct. The signature algorithm used by
the cert issuer (or self-signer) to issue the cert have nothing to
do with the SAML XML signature generation. You can certainly
generate SHA-1-based signatures regardless of the algorithm(s) used
within the signing cert (partially b/c you aren't literally signing
with the cert, you're signing with the public/private key pair. The
fact that the public key is also in a cert is incidental).<br>
<br>
That said, you can use a different cert with which to sign for a
specific relying party. That is also documented on the same wiki
page. It's essentially the "Per-Profile Credential" example,
except: To combine SHA-1 algorithms with the custom credential
you'd modify the parent bean there to be
shibboleth.SigningConfiguration.SHA1 rather than the .SHA256 one,
like so:<br>
<br>
<br>
<tt><bean id="ObnoxiousSecurityConfig"
parent="shibboleth.DefaultSecurityConfiguration"></tt><tt><br>
</tt><tt> <property name="signatureSigningConfiguration"></tt><tt><br>
</tt><tt> <bean
parent="shibboleth.SigningConfiguration.SHA1"
p:signingCredentials-ref="ObnoxiousVendorCredential" /></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt></bean></tt><code class="xml string"></code>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</body>
</html>