HVR does send RSA-SHA1-signed AuthnRequests today. This is expected behaviour of the current code, not a customer misconfiguration.

Our SAML however only allows SHA256 -signed AuthnRequests. 

Please make this in HVR configurable.
 
Where it comes from

• src/jw/http/auth/server.go:2040 builds the SAML middleware with samlsp.New(samlsp.Options{… SignRequest: true …}). It never sets a signature method.
• The crewjam/saml library picks the method itself. I fetched the library source for both versions from GitHub (no local copy):
  • v0.5.1, samlsp/new.go: defaultSigningMethodForKey returns dsig.RSASHA1SignatureMethod for an RSA key.
  • v0.4.14 (used by go.mod.compat): hard-coded dsig.RSASHA1SignatureMethod.
• HVR's SP key is always an *rsa.PrivateKey (samlSpPrivateKey), so every signed AuthnRequest uses http://www.w3.org/2000/09/xmldsig#rsa-sha1.