Get-ADFSTkSecureHashAlgorithm has incorrect logic for identifing a SHA-256 SigningMethod

[bigdavisc]

Background

After the recent launch of a service in the Canadian Access Federation (CAF) federated feed, we identified that IdPs running AD FS were not respecting the existence of <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> in our SPs metadata, and were continuing to sign assertions using SHA-1. RHEL10 no longer supports the SHA-1 algorithm by default, and this was preventing users from logging in to our service.

Issue

The Get-ADFSTkSecureHashAlgorithm function of the ADFSToolkit was not correctly searching for a <alg:SigningMethod> elements in metadata, so all RPs imported to AD FS were being set or overwritten with SHA-1 as the configured SignatureAlgorithm.

Replication

1. Create a sandbox AD FS environment.
2. Create a new Federation Configuration using the CAF defaults
3. Import an EntityId that has <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> present in the top-level <md:Extensions> section of the <EntityDescriptor>. I used https://cowil.uvic.ca as an example.
4. Check the SignatureAlgorithm of the newly imported Relaying Party trust. The result is

> Get-AdfsRelyingPartyTrust -Identifier "https://cowil.uvic.ca" | Select Name,SignatureAlgorithm

Name              SignatureAlgorithm
----              ------------------
CAF:cowil.uvic.ca http://www.w3.org/2000/09/xmldsig#rsa-sha1

5. Manually change the SignatureAlgorithm by running Set-AdfsRelyingPartyTrust -TargetIdentifier "https://cowil.uvic.ca" -SignatureAlgorithm "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256".
6. Check the SignatureAlgorithm of the newly imported Relaying Party trust. The result is

> Get-AdfsRelyingPartyTrust -Identifier "https://cowil.uvic.ca" | Select Name,SignatureAlgorithm

Name              SignatureAlgorithm
----              ------------------
CAF:cowil.uvic.ca http://www.w3.org/2001/04/xmldsig-more#rsa-sha256

7. Force a re-import of the same SP.
8. Notice that the SignatureAlgorithm has regressed

> Get-AdfsRelyingPartyTrust -Identifier "https://cowil.uvic.ca" | Select Name,SignatureAlgorithm

Name              SignatureAlgorithm
----              ------------------
CAF:cowil.uvic.ca http://www.w3.org/2000/09/xmldsig#rsa-sha1