NAME

Punk::SAML::Metadata - SAML metadata, read and written

DESCRIPTION

Writes this service provider's own metadata, and signs it when a deployment's provider requires that.

Reading an identity provider's metadata is Punk::SAML::IdP.

METHODS

build (%opts)

The SP document. Takes entity_id, acs_url, and optionally cert, name_id_format, authn_requests_signed and want_assertions_signed.

acs_url is passed in rather than derived, because the application computed it once when it compiled and this must not become a second answer to what its assertion consumer URL is.

sign ($xml, $id, $key_pem, $cert_pem)

An enveloped signature over the element carrying that ID, spliced in as its first child. Some providers refuse unsigned metadata by policy; it is not otherwise needed, and metadata is a public document.

This is the one place this distribution creates an XML signature rather than checking one, and it uses the same canonicalisation and the same algorithms as the verifier. Be clear about what a test of it proves: a signer that agrees with its own verifier would agree just as well if both were wrong. What proves the canonicalisation is File::Raw::XML's transcribed W3C vectors, and what proves this document is a provider accepting it.

content_type

application/samlmetadata+xml, which is the media type the specification names. Punk's $c->xml sends application/xml; most consumers accept either, and the ones that do not are exactly the strict deployments this matters to.

AUTHOR

LNATION, <email at lnation.org>

LICENSE AND COPYRIGHT

This software is Copyright (c) 2026 by LNATION.

This is free software, licensed under the Artistic License 2.0.