spring-projects / spring-projects/spring-security
Make the digest algorithm configurable for SAML authentication request and SAML Logout request
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
- Spring Security 6.5.11 with opensaml 5.x
- If it's required to sign the SAML Authn Request and SAML Logout Request, users shall have option to specify the digest algorithm.
Current Behavior
The hardcoded algorithm is SignatureConstants.ALGO_ID_DIGEST_SHA256.
For my application, the digest algorithm has to be SignatureConstants.ALGO_ID_DIGEST_SHA384 or higher.
Context
Develop SAML 2.0 related application. Implement the SP-initiated SAML login and RP-initiated SAML logout.
This issue blocked me to meet the security requirements for my application.
For my application, I have to configure the digest algorithm to be SignatureConstants.ALGO_ID_DIGEST_SHA384 or higher.
I did not have any workaround. There is no alternative.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the Spring Security SAML Authn Request and SAML Logout Request signing entry points, then trace where SignatureConstants.ALGO_ID_DIGEST_SHA256 is selected. Check the related tests and verify that both request types accept the configured digest algorithm, including SHA-384 or stronger values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100