Sign Metadata

Author: timlegge

lib/Net/SAML2/SP.pm

@@ -311,11 +311,13 @@ Returns the metadata XML document for this SP.
 sub metadata {
     my ($self) = @_;
 
+    use Net::SAML2::Util qw/generate_id/;
+
     my $x = XML::Generator->new(':pretty', conformance => 'loose');
     my $md = ['md' => 'urn:oasis:names:tc:SAML:2.0:metadata'];
     my $ds = ['ds' => 'http://www.w3.org/2000/09/xmldsig#'];
 
-    $x->EntityDescriptor(
+    my $metadata = $x->EntityDescriptor(
         $md,
         {
             entityID => $self->id },
@@ -324,7 +326,8 @@ sub metadata {
             { AuthnRequestsSigned => defined($self->authnreq_signed) ? $self->authnreq_signed : '1',
               WantAssertionsSigned => defined($self->want_assertions_signed) ? $self->want_assertions_signed : '1',
               errorURL => $self->url . $self->error_url,
-              protocolSupportEnumeration => 'urn:oasis:names:tc:SAML:2.0:protocol' },
+              protocolSupportEnumeration => 'urn:oasis:names:tc:SAML:2.0:protocol',
+              ID => generate_id()},
             $x->KeyDescriptor(
                 $md,
                 {
@@ -405,6 +408,21 @@ sub metadata {
             ),
         )
     );
+
+    use Net::SAML2::XML::Sig;
+
+    my $signer = Net::SAML2::XML::Sig->new({
+                        key => $self->key,
+                        cert => $self->cert,
+                        sig_hash => 'sha256',
+                        digest_hash => 'sha256',
+                        x509 => 1,
+                });
+
+    # create a signature
+    my $signed = $signer->sign($metadata);
+
+    return $signed;
 }
 
 __PACKAGE__->meta->make_immutable;

lib/Net/SAML2/XML/Sig.pm

@@ -1590,7 +1590,7 @@ sub _signedinfo_xml {
 
     #return qq{<dsig:SignedInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
     return qq{<dsig:SignedInfo xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#">
-                <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" />
+                <dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
                 <dsig:SignatureMethod Algorithm="$algorithm" />
                 $digest_xml
             </dsig:SignedInfo>};