Change SAML Signature Algorithm from SHA1 to SHA2

Single Sign-On

Last Updated:

Overview

A tenant has been configured to support a SAML connection. However, the login attempts fail. Login failure due to incompatibility of both the Signature Algorithm and DigestMethod Algorithm at SP and IdP ends of the SAML transaction.

The Identity Provider (IdP) expects that SAML Requests will be signed using the SHA-2 hash algorithm.  This article explains how Signature Algorithm and DigestMethod Algorithm can be configured for use with SHA-2.

Applies To

  • SAML
  • SHA-256

Cause

The IdP expects that both the Signature Algorithm and DigestMethod Algorithm will be signed with the SHA-2 hash algorithm. However, the Auth0 Service Provider (SP) connection has been configured to support a different value.

Solution

The SHA-2 family consists of six hash functions with digests (hash values) that are 224, 256, 384 or 512 bits. 
For SAML signatures, Auth0 supports SHA-256.

Follow the steps below to switch from SHA-1 to SHA256.
  1. Login to the dashboard as a tenant member ( Administrator ).
  2. Navigate Authentication > Enterprise > [select-SAML-connection].
  3. Scroll down to Sign Request Algorithm: select RSA-SHA256 from the Dropdown Menu.
  4. Scroll down to Sign Request Algorithm Digest: select SHA256 from the Dropdown Menu.
  5. Scroll down to the bottom of the screen: Click Save Changes.
 Screenshot 2024-02-06 at 13.50.35.png
 

Related References 

Recommended content

No recommended content found...
Need more help? Visit the Community
Visit the Auth0 Community