NAME

Punk::SAML::Request - the AuthnRequest and its binding

DESCRIPTION

Builds an AuthnRequest, encodes it for the HTTP-Redirect binding, and signs the redirect.

Usable with no application booted: the login route supplies the arguments from the configuration, and nothing here reads it.

METHODS

new_id

A fresh request id: an underscore and 32 hex characters. The underscore is not decoration. The ID attribute is xs:ID, whose lexical space is an XML Name, and an XML Name may not begin with a digit; a provider that validates the schema refuses a request whose ID does.

build (%args)

The AuthnRequest document. Takes id, instant, destination, acs_url, issuer, and optionally name_id_format and force_authn.

destination is the provider's single sign-on URL as configured, copied and never derived: some providers compare it against the URL they received the request on and refuse a mismatch.

NameIDPolicy is emitted only when name_id_format is given. A policy the provider cannot satisfy comes back as a Responder status and a failed login; letting the provider choose is what works everywhere.

redirect_url ($sso_url, $xml, $relay, $key_pem)

The HTTP-Redirect target: the document raw-deflated, base64'd and URL-encoded, with RelayState and, when a key is given, SigAlg and Signature.

The deflate is RFC 1951 with no header, not zlib and not gzip. A header is the commonest reason a provider answers "invalid request" with no further detail.

$relay is a flow id and never a URL. The return path lives in the flow record on this side, where neither the provider nor an attacker can rewrite it.

The signature is computed over the query string as sent, in the order Bindings section 3.4.4.1 fixes, with RelayState omitted entirely when there is none. The SigAlg follows the key: RSA signs rsa-sha256, EC signs ecdsa-sha256.

AUTHOR

LNATION, <email at lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION.

This is free software, licensed under the Artistic License 2.0.