How To: Check an SP-Initiated SAML Realm Is Signing with SHA1 or SHA2

Version Affected: All

 

Overview

This article explains how to confirm whether an SP-Initiated SAML realm (for example, Salesforce) is currently signing its SAML assertions with SHA1 or SHA2.

Check a Realm Is Signing with SHA1 or SHA2

This requires SAML Tracer Extension for Firefox, Chrome or Edge
 

1. Clear the browser cache.
2. Open the browser and open the SAML-tracer add-on (Firefox / Chrome + Edge (Chromium))
   
       
    
3. Browse to the login page of the service and start the login process via SAML SSO
4. Log in to the application. Data will start to appear in SAML-tracer as you do.

5. In SAML-tracer, click the line for the POST request, then open its SAML tab. Look for the SignatureMethod element's Algorithm attribute:

   <SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />

   An algorithm ending in rsa-sha256 (shown above) means the realm is signing with SHA2. An algorithm ending in rsa-sha1 means it's signing with SHA1.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.