<div dir="ltr"><div class="gmail_default" style="font-family:"courier new",monospace">I was able to do the following in the relying-party.xml</div><div class="gmail_default" style="font-family:"courier new",monospace"><br></div><div class="gmail_default" style="font-family:"courier new",monospace">outside of the shibboleth.RelyingPartyOverrides add:</div><div class="gmail_default" style="font-family:"courier new",monospace"><br></div><div class="gmail_default"><div class="gmail_default" style="font-family:"courier new",monospace"> <bean id="SHA1SecurityConfig"</div><div class="gmail_default" style="font-family:"courier new",monospace"> parent="shibboleth.DefaultSecurityConfiguration"</div><div class="gmail_default" style="font-family:"courier new",monospace"> p:signatureSigningConfiguration-ref="shibboleth.SigningConfiguration.SHA1" /></div><div style="font-family:"courier new",monospace"><br></div><div style="font-family:"courier new",monospace">then in the override sections reference it and add the bean to the profile:</div><div style="font-family:"courier new",monospace"><br></div><div><div><font face="courier new, monospace"> <property name="profileConfigurations"></font></div><div><font face="courier new, monospace"> <list></font></div><div><font face="courier new, monospace"> <bean parent="Shibboleth.SSO" </font></div><div><font face="courier new, monospace"> p:includeAttributeStatement="true"</font></div><div><font face="courier new, monospace"> p:securityConfiguration-ref="SHA1SecurityConfig" /></font></div><div><font face="courier new, monospace"> <bean parent="SAML2.SSO"</font></div><div><font face="courier new, monospace"> p:securityConfiguration-ref="SHA1SecurityConfig" /></font></div><div><font face="courier new, monospace"> <bean parent="SAML2.ECP"</font></div><div><font face="courier new, monospace"> p:securityConfiguration-ref="SHA1SecurityConfig" /></font></div><div><font face="courier new, monospace"> <bean parent="SAML2.Logout"</font></div><div><font face="courier new, monospace"> p:securityConfiguration-ref="SHA1SecurityConfig" /></font></div><div><font face="courier new, monospace"> <bean parent="SAML2.AttributeQuery"</font></div><div><font face="courier new, monospace"> p:securityConfiguration-ref="SHA1SecurityConfig" /></font></div><div><font face="courier new, monospace"> <bean parent="SAML2.ArtifactResolution"</font></div><div><font face="courier new, monospace"> p:securityConfiguration-ref="SHA1SecurityConfig" /></font></div><div><font face="courier new, monospace"> </list></font></div><div><font face="courier new, monospace"> </property></font></div></div><div style="font-family:"courier new",monospace"> </div><div style="font-family:"courier new",monospace">I'm not sure if all the profiles are required but I needed to fix something quick and never went back to check what was really required.</div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><font face="monospace, monospace">Jeffrey E. Crawford<br>Enterprise Service Team<a href="mailto:jeffreyc@ucsc.edu" target="_blank"></a></font><div><font face="monospace, monospace"> ^ ^</font></div><div><font face="monospace, monospace"> / \ ^ / \ ^</font></div><div><font face="monospace, monospace"> / \/ \ / \ / \</font></div><div><font face="monospace, monospace"> / \/ \/ \</font></div><div><font face="monospace, monospace">/ \</font></div><div><font face="monospace, monospace"><br></font></div><div><font face="monospace, monospace">You have been assigned this mountain to prove to others that it *can* be moved.</font></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Jul 20, 2017 at 8:07 AM, Jorj Bauer <span dir="ltr"><<a href="mailto:jorj@temple.edu" target="_blank">jorj@temple.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">We did it when we first rolled out IdP v3 by modifying the code (until we could get everything cleaned up).<br>
<br>
No idea if that approach still works several minor version updates later. This is very old and may no longer be accurate, but it might give you a hint as to how to proceed.<br>
<br>
IdP v3 relies on the defaults of OpenSAML. Somewhere around line 142 of src/main/java/org/opensaml/xml<wbr>sec/config/DefaultSecurityConf<wbr>igurationBootstrap.java:<br>
<br>
// RSA<br>
SignatureConstants.ALGO_ID_SIG<wbr>NATURE_RSA_SHA256,<br>
SignatureConstants.ALGO_ID_SIG<wbr>NATURE_RSA_SHA384,<br>
SignatureConstants.ALGO_ID_SIG<wbr>NATURE_RSA_SHA512,<br>
SignatureConstants.ALGO_ID_SIG<wbr>NATURE_RSA_SHA1,<br>
<br>
... change that to have RSA_SHA1 at the top.<br>
<br>
Recompile the JAR, skipping unit tests (the unit tests will now fail because we've violated the assumption about default algorithm ordering):<br>
<br>
$ mvn -Dmaven.test.skip=true install<br>
<br>
Copy the target .jar file (target/opensaml-xmlsec-impl-3<wbr>.1.1.jar, or something like that) to your installation, and thne rebuild your war file.<br>
<br>
HTH,<br>
-- Jorj<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
<br>
On 07/20/2017 10:59 AM, Ramaiah, Vanna G. wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Does anyone know how to change the signing algorithm globally from SHA2 to SHA1?<br>
<br>
-----Original Message-----<br>
From: users [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibbole<wbr>th.net</a>] On Behalf Of Cantor, Scott<br>
Sent: Wednesday, July 19, 2017 3:04 PM<br>
To: Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
Subject: Re: Upgrade from V2 to V3 - how to change to SHA1<br>
<br>
<br>
<br>
On 7/19/17, 2:54 PM, "users on behalf of Ramaiah, Vanna G." <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:ramaiah@musc.edu" target="_blank">ramaiah@musc.edu</a>> wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
We upgraded from V2 to V3.3. We have one SP that cannot use SHA256.<br>
How to change the signing configuration just for one SP? Shib wiki has document for the installation not for upgraded files. Please help.<br>
</blockquote>
<br>
There is no support for changing it in the legacy relying-party format. Globally changing it back is undoubtedly possible, but I don't think I have ever worked out any particular way to do it.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
<br>
<br>
<br>
<br>
<br>
</blockquote>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
</div></div></blockquote></div><br></div>