title: Azure B2C with custom SAML2 policy and Sha256 as the signing algorithm
body: <p>I am using Sustainsys package <code>Sustainsys.Saml2.AspNetCore2</code> to build a service provider web app in ASP.NET Core 3.1, which uses Azure B2C as the identity provider using <code>SAML2</code>. I have the following issue:</p>
  
  <ol>
  <li><p>If I use <code>Sha1</code> as the signing algorithm, using the option <code>MinIncomingSigningAlgorithm</code>, then an exception is thrown by <code>CryptoConfig.CreateFromName</code> because that method does not know the <code>Sha1</code> algorithm.</p></li>
  <li><p>If I use <code>Sha256</code> as the signing algorithm then Azure B2C signs the response with <code>Sha1</code> even though I have specified <code>&lt;Item Key="XmlSignatureAlgorithm"&gt;Sha256&lt;/Item&gt;</code> in the <code>RelyingParty</code> of my custom policy. <strong>I should note that this seems to only happen when the service provider starts the single logout flow.</strong> The login flow completes without issues and there the signing algorithm is <code>Sha256</code>. Here is my RelyingParty section:</p></li>
  </ol>
  
  <pre><code> &lt;RelyingParty&gt;
      &lt;DefaultUserJourney ReferenceId="SignUpOrSignIn" /&gt;
      &lt;TechnicalProfile Id="PolicyProfile"&gt;
        &lt;DisplayName&gt;PolicyProfile&lt;/DisplayName&gt;
        &lt;Protocol Name="SAML2"/&gt;
         &lt;Metadata&gt;
          &lt;Item Key="XmlSignatureAlgorithm"&gt;Sha256&lt;/Item&gt;
        &lt;/Metadata&gt;
        &lt;OutputClaims&gt;
          &lt;OutputClaim ClaimTypeReferenceId="displayName" /&gt;
          &lt;OutputClaim ClaimTypeReferenceId="givenName" /&gt;
        &lt;/OutputClaims&gt;
        &lt;SubjectNamingInfo ClaimType="objectId" ExcludeAsClaim="true"/&gt;
      &lt;/TechnicalProfile&gt;
    &lt;/RelyingParty&gt;
  </code></pre>
  
  <p>Furthermore, the metadata of Azure B2C uses <code>Sha256</code> as the signature and digest method. Here is the relevant section:</p>
  
  <pre><code>&lt;SignedInfo&gt;
      &lt;CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
      &lt;SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/&gt;
      &lt;Reference URI="..."&gt;
          &lt;Transforms&gt;
          &lt;Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
          &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
          &lt;InclusiveNamespaces xmlns="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="saml samlp xenc xs"/&gt;
          &lt;/Transform&gt;
          &lt;/Transforms&gt;
          &lt;DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/&gt;
      &lt;/Reference&gt;
  &lt;/SignedInfo&gt;
  </code></pre>
  
  <p>Any help is highly appreciated. Thank you.</p>