idp: Make signature method configurable

crewjam · Dec 1, 2017 · 2c3fea0 · 2c3fea0
1 parent 5e89d54
commit 2c3fea0
Showing 1 changed file with 13 additions and 2 deletions.
diff --git a/identity_provider.go b/identity_provider.go
@@ -96,6 +96,7 @@ type IdentityProvider struct {
 	ServiceProviderProvider ServiceProviderProvider
 	SessionProvider         SessionProvider
 	AssertionMaker          AssertionMaker
+	SignatureMethod         string
 }
 
 // Metadata returns the metadata structure for this identity provider.
@@ -671,9 +672,14 @@ func (req *IdpAuthnRequest) MakeAssertionEl() error {
 	}
 	keyStore := dsig.TLSCertKeyStore(keyPair)
 
+	signatureMethod := req.IDP.SignatureMethod
+	if signatureMethod == "" {
+		signatureMethod = dsig.RSASHA1SignatureMethod
+	}
+
 	signingContext := dsig.NewDefaultSigningContext(keyStore)
 	signingContext.Canonicalizer = dsig.MakeC14N10ExclusiveCanonicalizerWithPrefixList(canonicalizerPrefixList)
-	if err := signingContext.SetSignatureMethod(dsig.RSASHA1SignatureMethod); err != nil {
+	if err := signingContext.SetSignatureMethod(signatureMethod); err != nil {
 		return err
 	}
 
@@ -867,9 +873,14 @@ func (req *IdpAuthnRequest) MakeResponse() error {
 		}
 		keyStore := dsig.TLSCertKeyStore(keyPair)
 
+		signatureMethod := req.IDP.SignatureMethod
+		if signatureMethod == "" {
+			signatureMethod = dsig.RSASHA1SignatureMethod
+		}
+
 		signingContext := dsig.NewDefaultSigningContext(keyStore)
 		signingContext.Canonicalizer = dsig.MakeC14N10ExclusiveCanonicalizerWithPrefixList(canonicalizerPrefixList)
-		if err := signingContext.SetSignatureMethod(dsig.RSASHA1SignatureMethod); err != nil {
+		if err := signingContext.SetSignatureMethod(signatureMethod); err != nil {
 			return err
 		}