Make the digest algorithm configurable for SAML authentication request and SAML Logout request

Author: judicial1855-a11yCreated Sep 14, 2026Updated Sep 14, 2026
Labelsstatus: waiting-for-triagetype: enhancement
  • Spring Security 6.5.11 with opensaml 5.x
  • If it's required to sign the SAML Authn Request and SAML Logout Request, users shall have option to specify the digest algorithm.

Current Behavior The hardcoded algorithm is SignatureConstants.ALGO_ID_DIGEST_SHA256.

For my application, the digest algorithm has to be SignatureConstants.ALGO_ID_DIGEST_SHA384 or higher.

Context Develop SAML 2.0 related application. Implement the SP-initiated SAML login and RP-initiated SAML logout.

This issue blocked me to meet the security requirements for my application. For my application, I have to configure the digest algorithm to be SignatureConstants.ALGO_ID_DIGEST_SHA384 or higher. I did not have any workaround. There is no alternative.

Source: spring-projects/spring-security