<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi ... <br>
</p>
<p>I am normally a very happy shibboleth SP user, and it serves us
well to integrate SSO too all kinds of systems. Even the nginx
module works fast and stable, so first, thanks to all the authors
that have spend time and energy creating this fantastic tool !<br>
</p>
<p>But, I of cause have some problems now, and need to know if
anyone may be able to enlighten me a bit. I have really tried to
make our SP (shibboleth 2.6) send out AuthRequest using sha256 and
not sha1 to a specific idP (nemlogin), but without any luck.</p>
<p>As I understands it, there are two ways to make this work,
tinkering with the idP metadata by injection a
<ds:SignedInfo> block, <br>
</p>
<p>or inside the shibboleth2.xml file, using application override :</p>
<p><tt> <ApplicationOverride id="ssi_mrsa"
entityID=<a class="moz-txt-link-rfc2396E" href="https://saml.ssi.essenslms.com">"https://saml.ssi.essenslms.com"</a> signing="true"></tt><tt><br>
</tt><tt> <Sessions handlerSSL="true"
cookieProps="https"></tt><tt><br>
</tt><tt> <SSO entityID=<a class="moz-txt-link-rfc2396E" href="https://saml.nemlog-in.dk">"https://saml.nemlog-in.dk"</a>></tt><tt><br>
</tt><tt> SAML2</tt><tt><br>
</tt><tt> </SSO></tt><tt><br>
</tt><tt><br>
</tt><tt> <Logout asynchronous="false">SAML2
Local</Logout></tt><tt><br>
</tt><tt> </Sessions></tt><tt><br>
</tt><tt><br>
</tt><tt> <CredentialResolver type="File"
key="ssi_mrsa.pem" certificate="ssi_mrsa.pem"/></tt><tt><br>
</tt><tt><br>
</tt><tt> <<b>RelyingParty</b>
Name=<a class="moz-txt-link-rfc2396E" href="https://saml.ssi.essenslms.com">"https://saml.ssi.essenslms.com"</a>
digestAlg=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/04/xmlenc#sha256">"http://www.w3.org/2001/04/xmlenc#sha256"</a>
signingAlg=<a class="moz-txt-link-rfc2396E" href="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">"http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"</a>/></tt><tt><br>
</tt><tt><br>
</tt><tt> <MetadataProvider type="XML" validate="true"</tt><tt><br>
</tt><tt>
uri=<a class="moz-txt-link-rfc2396E" href="https://test-nemlog-in.dk/Testportal/Prod-nemlog-in-2-2017.xml">"https://test-nemlog-in.dk/Testportal/Prod-nemlog-in-2-2017.xml"</a></tt><tt><br>
</tt><tt> backingFilePath="nemlogin_ssi_metadata.xml"
reloadInterval="7200"/></tt><tt><br>
</tt><tt><br>
</tt><tt> <AttributeExtractor type="XML" validate="true"
reloadChanges="false"</tt><tt><br>
</tt><tt> path="attribute-map-nemlogin.xml"/></tt><tt><br>
</tt><tt></ApplicationOverride></tt><tt><br>
</tt></p>
<p>Both of these methods does not result in any errors in the log,
but I still get an sha1 AuthRequest, and not a sha256, as I was
hoping for :-(<br>
</p>
<p>The shibboleth2.xml version would be my preferred, as I can keep
getting the metadata directly from idP, but the just overwrite the
signingAlg for the idP only (nemlogin does not include any
SignedInfo block, as other idP's does).<br>
</p>
<p>I have looked closely inside the log files, but it does not
complain about anything at all, it just ignore my sha256.<br>
</p>
<p>I would be really happy is someone could tell me if I have
misunderstood the documentation/concept, or have I been writing
the wrong Alg urls ? <br>
</p>
<p>Regards ...<br>
</p>
<p>/BL<br>
</p>
</body>
</html>