Change the default value of SAML response`s signature algorithm for security

[ogis-song]

Description

The default value of the signature algorithm for SAML responses should be changed to SHA-256. In the current implementation, the default value of the signature algorithm for SAML responses is SHA-1. SHA-1 is at risk due to the existence of a vulnerability that allows spoofing attacks to be performed.

Trouble spots：CONFIGURE-GLOBAL SERVICE-Common Federation Configuration

• XML signature algorithm
• XML digest algorithm

Solution

Correct as follows：

• file：openam-server-only\src\main\resources\services\famFederationCommon.xml
• Correction method：
  • XML signature algorithm：Change the value of DefaultValues in SignatureAlgorithm to http://www.w3.org/2001/04/xmldsig-more#rsa-sha256.
  • XML digest algorithm：Change the value of DefaultValues in DigestAlgorithm to http://www.w3.org/2001/04/xmlenc#sha256.