Insecure/obsolete default signature algorithm

[simongellis-attentive]

If you don't provide a value for onelogin.saml2.security.signature_algorithm, this library defaults to signing requests with RSA-SHA1.

SHA-1 as a signature algorithm is obsolete. Wikipedia says that it is

recommended to remove SHA-1 from products as soon as possible and instead use SHA-2 or SHA-3. Replacing SHA-1 is urgent where it is used for digital signatures.

It would probably make more sense to default to SHA-256 instead.

[haavar]

I agree this is problematic. I think the defaults should change. I discovered that our configuration signed the authN requests with SHA1, and it seems like ADFS will need to sign the authN response with SHA1 when the request is signed with SHA1.

I think the default should also change to not allow SHA1 signatures in the response. Someone spoofing a response worries me more than someone spoofing a request.