Allow setting signing_algorithm and digest_algorithm of pysaml2 library

[robertaistleitner]

I have the requirement to set a custom signing_algorithm as well as digest_algorithm for our SP which is (as far as I've seen) is not possible at the moment because those settings are not passed to the pysaml2 library config (

django-saml2-auth/django_saml2_auth/saml.py

Line 284 in 801bdb2

sp_config = Saml2Config()

).

Is there a workaround on how to implement this or is this something that needs to be implemented?

[mostafa]

Hey @robertaistleitner,

I am not sure of the usage of these specific settings, as the algorithms are automatically picked up by the pysaml2 library from the metadata autoconf URL and the authn request/response, but I'd be happy to see contributions.

[robertaistleitner]

Here is the relevant part of the metadata XML of the IDP which says that sha256 should be used as signing method, but it looks like this is ignored since the signed authn request shows that it's signed using sha1.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<EntityDescriptor entityID="https://..." xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:query="urn:oasis:names:tc:SAML:metadata:ext:query" xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:xenc11="http://www.w3.org/2009/xmlenc11#" xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" xmlns:x509qry="urn:oasis:names:tc:SAML:metadata:X509:query" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <IDPSSODescriptor WantAuthnRequestsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <Extensions>
            <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
            <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
        </Extensions>

[Christofon]

Any updates here?

[mostafa]

@Christofon As I mentioned above, feel free to contribute.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.