Versions Compared

Old Version 7

changes.mady.by.user Sovann Huynh

Saved on

compared with

New Version Current

changes.mady.by.user Tabassum Jafri

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Info
titleCXF and OpenSAML

Latest CONNECT release (5.23) leverages CXF 3.1.9 and OpenSAML 3.1.1

...

SHA versions supported by OpenSAML and CXF can be specified in saml.properties in the CONNECT properties directory. Note that while multiple versions can be specified, a default must also be specified and can be overridden in the entity request (described in section Overriding default SHA version section below). ). Make sure the properties include backslash after comma.  Refer to sample entries in saml.properties

  • saml.digestAlgorithms - comma separated list of SignatureConstants/URIs, of the desired digest algorithms to support
  • saml.signatureAlgorithms - comma separated list of SignatureConstants/URIs, of the desired signature algorithms to support
  • saml.defaultDigestAlgorithm - default digest algorithm to use if an override is not provided in the entity message. Defaults to SHA1 if not set.
  • saml.defaultSignatureAlgorithm - default signature algorithm to use if an override is not provided in the entity message. Defaults to RSA-SHA1 if not set.

See https://github.com/apigee/java-xmltooling/blob/master/src/main/java/org/opensaml/xml/signature/SignatureConstants.java for all supported SHA versions.

Anchor
sample entries in saml.properties
sample entries in saml.properties

Sample signatureAlogrithmsSample defaultDigestAlogrithm
Code Block
titleSample saml.digestAlogrithmsproperties SHA version configuration
saml.signatureAlgorithms=ALGO_ID_SIGNATURE_RSA_SHA512\,ALGO_ID_SIGNATURE_RSA_SHA1\,ALGO_ID_SIGNATURE_RSA_SHA256
Code Block
title

saml.
saml.digestAlgorithms=ALGO_ID_DIGEST_SHA512\,ALGO_ID_SIGNATURE_RSADIGEST_SHA1\,ALGO_ID_SIGNATURE_RSADIGEST_SHA256
Code Block
title

saml.
saml.defaultDigestAlgorithmdefaultSignatureAlgorithm=ALGO_ID_DIGEST_SHA512
Code Block
titleSample saml.defaultSignatureAlogrithm
saml.defaultSignatureAlgorithmSIGNATURE_RSA_SHA1
saml.defaultDigestAlgorithm=ALGO_ID_SIGNATURE_RSA_SHA512DIGEST_SHA1

Anchor
Overriding default SHA version
Overriding default SHA version
Overriding default SHA version

Once a list of allowable SHA versions and a default has been specified, a specific version from the allowable list can be specified in the entity request. An example algorithm override follows:

...

Responding gateways

All versions specfied specified in saml.xxx signatureAlgortihms and saml.digestAlgorithms can be accepted by a responding CONNECT gateway

Code Block
titlesaml.properties
saml.signatureAlgorithms=ALGO_ID_SIGNATURE_RSA_SHA512\,ALGO_ID_SIGNATURE_RSA_SHA1\,ALGO_ID_SIGNATURE_RSA_SHA256
saml.digestAlgorithms=ALGO_ID_DIGEST_SHA512\,ALGO_ID_DIGEST_SHA1\,ALGO_ID_DIGEST_SHA256