NAME

Punk::Command::SAML - the punk saml subcommands

DESCRIPTION

punk saml key, punk saml metadata, punk saml idp and punk saml verify.

Perl rather than XS, and it stays that way: they run once, by hand, and their whole job is printing.

punk saml key

A secret for the flow cookie. The plugin croaks for one at the plugin line and names this command, so the command exists.

punk saml metadata

This application's SP metadata, for the operator setting up the provider with no server running.

punk saml idp <file-or-url>

Entity id, single sign-on URL, each certificate's fingerprint, WantAuthnRequestsSigned and the name id formats. What an operator runs to see why a provider's metadata was refused, and what they paste into a ticket to the provider's administrator.

punk saml verify <file>

Runs the phase-6 checks over a saved SAMLResponse, the base64 as it came or the XML, and prints the first refusal with its code. This is the tool for the ticket that says "SSO stopped working": save the POST from the browser's network tab, run this, and the answer is audience.

--at moves now, so an assertion saved yesterday can be checked today.

METHODS

run (@argv)

usage

cmd_key

cmd_metadata

cmd_idp

cmd_verify

AUTHOR

LNATION, <email at lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION.

This is free software, licensed under the Artistic License 2.0.