<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="en-VN" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Sure, but say I’m planning on migrating all my customers from sha-1 to sha-256, for example, I’d like to know which of them might still be using Sha-1 before I turn that off. If I could get a list (metrics) indicating
that IDP-X is using SHA-1, then I would reach out to them and ask “does your IDP even support sha-256?”, for example.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Similarly, in a certificate rollover, I’d want to tell customers “you’re still using the old metadata and cert. Please update.”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Without knowing who is actually doing what, I can’t really just disable things (potentially breaking a customer’s access).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Or am I thinking about this wrong?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Jan<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="mso-margin-top-alt:0cm;margin-right:0cm;margin-bottom:12.0pt;margin-left:36.0pt">
<b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of Mak, Steve <makst@upenn.edu><br>
<b>Date: </b>Monday, 12 July 2021 at 10:11<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Subject: </b>Re: Sending the SAMLReply/Assertion<o:p></o:p></span></p>
</div>
<p class="MsoNormal" style="margin-left:36.0pt">Jan,<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> Another idea: Is there an SP API (Soap or otherwise) where I might be able to get the saml assertion from the SP given a session Index?<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><a href="https://urldefense.com/v3/__https:/wiki.shibboleth.net/confluence/display/SP3/AssertionExport__;!!GEjU_1jlQXGQfQ!zNO34PJuMU3z1J98VK87x159ZxHTZpUd4Kl65pZL6U_glsG1vwgp2GpMXlHOuEyLog$">https://wiki.shibboleth.net/confluence/display/SP3/AssertionExport</a><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> <span style="color:black">
What I’m specifically looking for is things like which hashing and encryption algorithms (and hopefully which certificate was used, i.e. things like SP subject-name and serial number) were used (and by whom).</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">I want to remind you that the encryption that an IdP uses will be something it picks from your service's supported encryption algos which will be listed in
<b>your</b> SP metadata… so if you want to strike an algo off your list you would simply update your sp metadata and communicate that change to the IdP. At least that's what it's there for. I'm not sure if you're implying that IdPs simply pick whatever they
want and that's not always the case. <b>Your</b> SP metadata provides them with the encryption cert to use and the supported algos and the IdP builds from that menu. So, the only thing you'd be really auditing is your own config.<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"> <o:p></o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt">- Steve<o:p></o:p></p>
</div>
</body>
</html>