How to change signature method from rsa-sha1 to rsa-sha256 ?

[wester]

Hi all,

In our picketlink IDP instance , the SAML authentication request or response xml is configured to use sha1 algorithm for signature.

The signature info in SAML xml content looks like below :

<dsig:SignedInfo>

  <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" />

  <dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />

  <dsig:Reference URI="#ID_dd83fe41-adb6-46c8-84b4-ddd1f6d41087">

  <dsig:Transforms>

  <dsig:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />

  <dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />

  </dsig:Transforms>

  <dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />

  <dsig:DigestValue>DSqFGv0LDt27bCrPiwEBICJkDK0=</dsig:DigestValue>

  </dsig:Reference>

  </dsig:SignedInfo>

For some security reason, I would like to change this algorithm to adopt sha256 or other more secured algorithms.

How can I change this signature method from rsa-sha1 to rsa-sha256 ??

[pcraveiro]

Hi Wester,

    Opened the following JIRA to track this.

        https://issues.jboss.org/browse/PLINK-497

Thanks.

[pcraveiro]

Hi,

    Can you test using a SNAPSHOT ? JIRA updated.

Regards.

[dagbai]

Hi all,

Is it possible to set the Signature to a  hashed Algorithm to SHA-256 on an SP server when its binding type is REDIRECT. I noticed this does not work, for some reason algorithm is set to SHA-1.

I've searched online to see if there is documentation regarding this issue using redirect binding for SAML or picketlink and I cannot find anything. Is this a bug, or is it impossible to set signature algorithm for redirect binding to SHA-256?

I am using picketlink 2.7.0 CR3 with wildfly JBOSS server.

[pcraveiro]

There is a RFE for that in JIRA.

https://issues.jboss.org/browse/PLINK-621