<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 6/22/16 7:48 PM, Jason wrote:<br>
</div>
<blockquote
cite="mid:CAHB-x8TTWCPqpcJgKri-VkKFFJZNMZ4H9-CUXV-Dfja5_HryHQ@mail.gmail.com"
type="cite">
<pre wrap="">Hello,
With a v2 IdP, is it possible to have the IdP include an RSAKeyValue
element in the XML signature in addition to the X509Data element?</pre>
</blockquote>
<br>
<br>
<br>
Yes. As Scott said though, it is a global change, so be aware.
You'll be doing this for all SPs. Most shouldn't care, so just
FYI. (In v3, you can customize things like this on a per-SP basis
if desired).<br>
<br>
You have to first add an extension project. You can use the basic
install instructions here [1].<br>
<br>
Then, instead of the config snippet for internal.xml indicated in
the "Edit IdP configuration" config section for the algorithm
changes, use this instead:
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<br>
<br>
<br>
<tt> <bean
id="shibboleth.idp.ext.OpensamlCustomSecurityConfig"</tt><tt><br>
</tt><tt>
class="edu.internet2.middleware.shibboleth.idp.ext.securityconfig.OpensamlCustomSecurityConfigBean"</tt><tt><br>
</tt><tt> depends-on="shibboleth.OpensamlConfig"></tt><tt><br>
</tt><tt><br>
</tt><tt> <property name="keyInfoGeneratorFactories"></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <bean
class="org.opensaml.xml.security.x509.X509KeyInfoGeneratorFactory"></tt><tt><br>
</tt><tt> <property
name="emitEntityCertificate" value="true" /></tt><tt><br>
</tt><tt> <property
name="emitEntityCertificateChain" value="true" /></tt><tt><br>
</tt><tt> <property
name="emitPublicKeyValue" value="true" /></tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt><br>
<br>
<br>
</tt>Of course, if you *do* want to also change the signing
algorithms, you can add those property elements to the bean as well,
as indicated in the wiki.<br>
<br>
Restart the IdP, and that should do it.<br>
<tt><br>
<br>
</tt><br>
[1]
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/Changing+IdP+Signature+Method+Algorithm#ChangingIdPSignatureMethodAlgorithm-Obtainingthesoftware">https://wiki.shibboleth.net/confluence/display/SHIB2/Changing+IdP+Signature+Method+Algorithm#ChangingIdPSignatureMethodAlgorithm-Obtainingthesoftware</a><br>
</body>
</html>