NAME
Punk::SAML::IdP - one identity provider
DESCRIPTION
An identity provider: its entity id, its single sign-on URL, and its signing certificates with their fingerprints.
Usable with no application booted, because punk saml verify has to work against a saved document at two in the morning.
METHODS
read ($bytes, %opts)
Reads a provider out of metadata bytes, not a URL. Fetching is a separate thing, and keeping them apart is what lets every refusal below be tested against a string rather than a network.
Returns a hashref: entity_id, sso_url, certs (PEM, in the order published), fingerprints (SHA-256 hex over the same DER, so it is the number a provider's console shows), name_id_formats and want_authn_requests_signed.
entity_id selects one entity from federation metadata. Without it, an EntitiesDescriptor holding several is refused with the ids listed.
What is refused
A provider publishing no HTTP-Redirect SingleSignOnService, because this plugin sends AuthnRequests by redirect and a redirect to a POST-only endpoint is an error the provider phrases unhelpfully, at a user, hours later.
A KeyDescriptor is a signing key when use="signing" or when there is no use attribute at all: the specification says a missing use means both, and providers omit it constantly. use="encryption" is not one, and metadata with no signing certificate is refused.
A certificate that will not parse is refused here, at boot, rather than at the first login.
Certificate validity dates are not enforced by default. Providers routinely sign with certificates that expired months ago, the trust here is the configured key rather than a chain, and refusing one helps nobody.
AUTHOR
LNATION, <email at lnation.org>
LICENSE AND COPYRIGHT
This software is Copyright (c) 2026 by LNATION.
This is free software, licensed under the Artistic License 2.0.