From a348ec9a9dd156c7891e86ad53148aa457f06af1 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 11 Dec 2013 11:25:26 +0000
Subject: [PATCH] de_dfnaai eduGAIN aggregate is now signed with SHA-256.
 Production aggregate remains SHA-1.

---
 mdx/de_dfnaai/beans.xml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/mdx/de_dfnaai/beans.xml b/mdx/de_dfnaai/beans.xml
index d260375d..d5e93675 100644
--- a/mdx/de_dfnaai/beans.xml
+++ b/mdx/de_dfnaai/beans.xml
@@ -62,8 +62,12 @@
     <!--
         Check signing signature.
     -->
-    <bean id="de_dfnaai_checkSignature" parent="XMLSignatureValidationStage"
-        p:id="de_dfnaai_checkSignature">
+    <bean id="de_dfnaai_checkEdugainSignature" parent="XMLSignatureValidationStageSHA256"
+        p:id="de_dfnaai_checkEdugainSignature">
+        <property name="verificationCertificate" ref="de_dfnaai_signingCertificate"/>
+    </bean>
+    <bean id="de_dfnaai_checkProductionSignature" parent="XMLSignatureValidationStage"
+        p:id="de_dfnaai_checkProductionSignature">
         <property name="verificationCertificate" ref="de_dfnaai_signingCertificate"/>
     </bean>
     
@@ -82,7 +86,7 @@
                         invalid signature
                 -->
                 <ref bean="check_validUntil"/>
-                <ref bean="de_dfnaai_checkSignature"/>
+                <ref bean="de_dfnaai_checkProductionSignature"/>
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>
@@ -105,7 +109,7 @@
                         invalid signature
                 -->
                 <ref bean="check_validUntil"/>
-                <ref bean="de_dfnaai_checkSignature"/>
+                <ref bean="de_dfnaai_checkEdugainSignature"/>
                 <ref bean="errorTerminatingFilter"/>
                 
                 <ref bean="disassemble"/>