<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 3/24/17 2:15 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:D2E1E761-CB5D-44A9-9650-1B46FECFDD41@osu.edu"
type="cite">
<pre wrap="">On 3/24/17, 1:56 PM, "users on behalf of Ramaiah, Vanna G." <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfoframaiah@musc.edu"><users-bounces@shibboleth.net on behalf of ramaiah@musc.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">When using legacy file, is there a way to change the default algorithm to sha1 or just for one provider?
</pre>
</blockquote>
<pre wrap="">
I don't think it works, but you can try changing the property default if you like.</pre>
</blockquote>
<br>
I wasn't sure either, so I looked. I think Scott is correct. The
Spring RelyingPartyGroupParser which is involved here for the legacy
XML doesn't set up anything for SignatureSigningConfiguration in the
RelyingPartyConfigurationResolver it produces. So I believe that
the SHA-256 default is actually coming from the OpenSAML global
library defaults, not anything in the IdP layer.<br>
<br>
That is consistent with the way V2 worked in terms of the approach.
We just changed both the IdP and library defaults for signing to
SHA-256.<br>
<br>
<blockquote cite="mid:D2E1E761-CB5D-44A9-9650-1B46FECFDD41@osu.edu"
type="cite">
<pre wrap=""> That would be a horrible choice to change.</pre>
</blockquote>
<br>
Agreed. You don't want to cripple your whole system with a weak(er)
algorithm to workaround a vendor that's arguably broken. At the
very least, their technology is out-of-date.<br>
<br>
<br>
<blockquote cite="mid:D2E1E761-CB5D-44A9-9650-1B46FECFDD41@osu.edu"
type="cite">
<pre wrap="">
You cannot change it for just one, so you have no real choice, you're done, move off it. Or insist that the SP correct its bug I guess.
</pre>
</blockquote>
<blockquote cite="mid:D2E1E761-CB5D-44A9-9650-1B46FECFDD41@osu.edu"
type="cite">
</blockquote>
<br>
I agree those are the 2 best choices.<br>
<br>
If you really, really wanted to globally change the IdP (really
OpenSAML) signing defaults to SHA-1 - and were OK with what that
means in terms of the security ramifications - then there is a way
to wire that in Spring, albeit a little nasty syntax maybe. If you
really, really, really want to go there, you can add something like
the following to your conf/global.xml. I haven't tested, so YMMV.<br>
<br>
<br>
<tt> <bean id="OpenSAMLGlobalSigningConfig"
class="org.opensaml.xmlsec.SecurityConfigurationSupport" </tt><tt><br>
</tt><tt>
factory-method="getGlobalSignatureSigningConfiguration"</tt><tt><br>
</tt><tt> depends-on="shibboleth.OpenSAMLConfig" /></tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"</tt><tt><br>
</tt><tt> p:targetObject-ref="OpenSAMLGlobalSigningConfig"</tt><tt><br>
</tt><tt> p:targetMethod="setSignatureAlgorithms"></tt><tt><br>
</tt><tt> <property name="arguments"></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1"
/></tt><tt><br>
</tt><tt> <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1"
/></tt><tt><br>
</tt><tt> <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA1"
/></tt><tt><br>
</tt><tt> <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_MAC_HMAC_SHA1"
/></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><tt> <bean
class="org.springframework.beans.factory.config.MethodInvokingBean"</tt><tt><br>
</tt><tt> p:targetObject-ref="OpenSAMLGlobalSigningConfig"</tt><tt><br>
</tt><tt>
p:targetMethod="setSignatureReferenceDigestMethods"></tt><tt><br>
</tt><tt> <property name="arguments"></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <list></tt><tt><br>
</tt><tt> <util:constant
static-field="org.opensaml.xmlsec.signature.support.SignatureConstants.ALGO_ID_DIGEST_SHA1"
/></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </list></tt><tt><br>
</tt><tt> </property></tt><tt><br>
</tt><tt> </bean></tt><tt><br>
</tt><tt> </tt><tt><br>
</tt><br>
</body>
</html>