rsa-sha256中的Rails request.create？

Question

我正在进行SAML身份验证。

我在rsa-sha256中有带有摘要和签名方法的设置，但是当我创建重定向身份验证用户的请求时，请求在rsa-sha1中.

在url中，有SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1

但我希望它是rsa-sha256

设置:

  def saml_settings
    settings = OneLogin::RubySaml::Settings.new({:idp_cert_fingerprint_algorithm            => XMLSecurity::Document::SHA256})

    settings.assertion_consumer_service_url = "..."
    settings.issuer                         = "..."
    settings.idp_sso_target_url             = "..."
    settings.name_identifier_format         = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
    #settings.authn_context = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
    settings.certificate = CONFIG_CERTIFICATE
    settings.private_key = CONFIG_PRIVATE_KEY
    settings.security[:authn_requests_signed]  = true     # Enable or not signature on AuthNRequest
    settings.security[:logout_requests_signed] = true     # Enable or not signature on Logout Request
    settings.security[:logout_responses_signed] = true     # Enable or not signature on Logout Response

    settings.security[:digest_method]    = XMLSecurity::Document::SHA256
    settings.security[:signature_method] = XMLSecurity::Document::SHA256

    settings.security[:embed_sign]        = false


    settings
  end

当我创建请求时：

request = OneLogin::RubySaml::Authrequest.new
redirect_to(request.create(saml_settings))

在这里，request.create(saml_settings)正在返回url中的内容，有SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1

如何将此更改为在rsa-sha256中？

Answer 1

实际上，我找到了安沃瑟：

在库中，sha1 ou sha256氪the将由设置定义，

在create_params of OneLogin::RubySaml::Authrequest方法中，我们有

if settings.security[:authn_requests_signed] && !settings.security[:embed_sign] && settings.private_key
  params['SigAlg'] = XMLSecurity::Document::SHA1
  ... 
end

所以，我

settings.security[:embed_sign]        = false

所以条件是对的。但它必须是FALSE

所以我把

settings.security[:embed_sign]        = true

(事实上，它必须是真实的)

和

request.create(saml_settings, {:SigAlg => XMLSecurity::Document::SHA256}))

一切都结束了！

( cf method )