Fix signature location bug

In the XSD of SAML metadata the signature should be present directly
after the md:EntityDescriptor tag as a child node. We placed it at the
bottom of the field violating the XSD of SAML metadata.

We should potentially fix it in XML::Sig but that is for another day.

Signed-off-by: Wesley Schwengle <waterkip@cpan.org>

Author: waterkip

lib/Net/SAML2/SP.pm

@@ -688,11 +688,31 @@ sub metadata {
             sig_hash    => 'sha256',
             digest_hash => 'sha256',
             x509        => 1,
-            ns          => { md => 'urn:oasis:names:tc:SAML:2.0:metadata' },
+            ns          => { md => URN_METADATA },
             id_attr     => '/md:EntityDescriptor[@ID]',
         }
     );
-    return $signer->sign($metadata);
+    my $md = $signer->sign($metadata);
+
+    my $xp = XML::LibXML::XPathContext->new(
+        XML::LibXML->load_xml(string =>$md)
+    );
+    $xp->registerNs('md', URN_METADATA);
+    $xp->registerNs('dsig', URN_SIGNATURE);
+
+    my $nodes = $xp->findnodes('/md:EntityDescriptor[@ID]');
+    my $rootnode = $nodes->get_node(1);
+
+    my $child = $rootnode->firstChild;
+    return $md if $child->nodeName() eq 'dsig:Signature';
+
+    $nodes = $xp->findnodes('//dsig:Signature');
+    my $signode = $nodes->get_node(1);
+
+    $signode->unbindNode;
+    $rootnode->insertBefore($signode, $child);
+
+    return '<?xml version="1.0" encoding="UTF-8"?>' . $rootnode->toString;
 }
 
 =head2 get_default_assertion_service

t/02-create-sp.t

@@ -70,7 +70,10 @@ use URN::OASIS::SAML2 qw(:bindings :urn);
     }
 
 
-    get_single_node_ok($xpath, '//ds:Signature');
+    my $root_node = get_single_node_ok($xpath, '/md:EntityDescriptor');
+    my $signature_node = $root_node->firstChild;
+    is($signature_node->nodeName(),
+        'dsig:Signature', "First node is the signature");
 
     is(
         'e73560b0e23602121aedc55bcb1ca637',