search

IdentityServer / IdentityServer2

[deprecated] Thinktecture IdentityServer is a light-weight security token service built with .NET 4.5, MVC 4, Web API and WCF.
Other
410 stars 291 forks source link

Signing Certificate Signature Algorithm seems hard-coded to SHA256? #843

Open punkologist opened 9 years ago

punkologist commented 9 years ago

Hi,

I am working on a solution where I need to re-use a SAML2 token issued by idsrv V2.

This is for integration with Citrix's Sharefile API http://api.sharefile.com/rest/

In particular I need to get the below code sample working:

SAML Authentication: This authentication support assumes you have a mechanism for obtaining a SAML assertion, samlAssertion from the user's IdP.

'var sfClient = new ShareFileClient("https://secure.sf-api.com/sf/v3/"); var oauthService = new OAuthService(sfClient, "[clientid]", "[clientSecret]");

var oauthToken = await oauthService.ExchangeSamlAssertionAsync(samlAssertion, subdomain, applicationControlPlane);

sfClient.AddOAuthCredentials(oauthToken); sfClient.BaseUri = oauthToken.GetUri();'

I have been able to get access to the token. However it is being rejected. Information I have found about Sharefile suggests it is due to the Signature Algorithm being SHA256 and they only accept SHA1.

The problem I have is that the certificate I'm using is infact SHA1 but no matter what I have tried it seems to always produce a token with SHA265.

Any ideas? Is there somewhere I can make a change in the code to set it to SHA1?

Am I better off creating my own new token in the client APP for sending to the sharefile API?

leastprivilege commented 9 years ago

Yes you need to change the source code. In IdSrv3 this is configurable. See here:

https://github.com/IdentityServer/IdentityServer3.WsFederation/blob/master/source/WsFederationPlugin/ResponseHandling/SignInResponseGenerator.cs#L171

The signature algorithm gets configured on the signing credentials - in v2 this would be somewhere in the configuration class.