Rails request.create in rsa-sha256? - ruby-on-rails

Question

I am working on SAML authentication
I have settings with digest and signature method in rsa-sha256, but when I create the request to redirect a authenticating user the request is in rsa-sha1 ...
In the url, there is SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1
But I want it to be rsa-sha256
Settings :
def saml_settings
settings = OneLogin::RubySaml::Settings.new({:idp_cert_fingerprint_algorithm => XMLSecurity::Document::SHA256})
settings.assertion_consumer_service_url = "..."
settings.issuer = "..."
settings.idp_sso_target_url = "..."
settings.name_identifier_format = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
#settings.authn_context = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
settings.certificate = CONFIG_CERTIFICATE
settings.private_key = CONFIG_PRIVATE_KEY
settings.security[:authn_requests_signed] = true # Enable or not signature on AuthNRequest
settings.security[:logout_requests_signed] = true # Enable or not signature on Logout Request
settings.security[:logout_responses_signed] = true # Enable or not signature on Logout Response
settings.security[:digest_method] = XMLSecurity::Document::SHA256
settings.security[:signature_method] = XMLSecurity::Document::SHA256
settings.security[:embed_sign] = false
settings
end
and when I create the request :
request = OneLogin::RubySaml::Authrequest.new
redirect_to(request.create(saml_settings))
Here, request.create(saml_settings) is returning the In the url, there is SigAlg=http%3A%2F%2Fwww.w3.org%2F2000%2F09%2Fxmldsig%23rsa-sha1
How can I change this to be in rsa-sha256?

Answer 1

Actually, I found the anwser :
In the lib, the sha1 ou sha256 ecryption will be defined by the settings,
in the method create_params of OneLogin::RubySaml::Authrequest we have
if settings.security[:authn_requests_signed] && !settings.security[:embed_sign] && settings.private_key
params['SigAlg'] = XMLSecurity::Document::SHA1
...
end
so, I had
settings.security[:embed_sign] = false
And so the condition was TRUE. But it has to be FALSE
so I've put
settings.security[:embed_sign] = true
(actually, it has to be at true)
and
request.create(saml_settings, {:SigAlg => XMLSecurity::Document::SHA256}))
And it's done !
( cf http://www.rubydoc.info/github/onelogin/ruby-saml/OneLogin/RubySaml/Authrequest#create-instance_method )