MDQUERY.1(1)

💖 MDQUERY — ok bestie let's talk about mdquery (section 1, Shibboleth girlie) 💖

---

✨ NAME ✨

mdquery — the lil tool that goes and queries your Shibboleth metadata 🕵️♀️✨

---

🌸 SYNOPSIS 🌸

mdquery -e entity [-a app] [-nostrict]

mdquery -e entity -r role -p protocol [-a app]
    [-ns namespace] [-nostrict]

---

🦋 DESCRIPTION 🦋

okay so mdquery literally queries and displays your Shibboleth SP metadata. that's the whole vibe 💅

but fr fr, she's mainly a debugging tool — you use her while you're following the advice of the Shibboleth maintainers. that's her moment, that's her main character energy 👑

she can show you either the metadata for an entity, or the metadata for a particular role. pick your fighter 🎀

---

💜 OPTIONS 💜

• -a app — tells her which application ID to grab metadata for. if you don't say anything, the default is "default". no notes. 🫶
• -e entity — the entity ID you wanna see metadata for. normally this is the entity descriptor ID of an entity that's giving you Problems™ (like, say, the entity ID for the local SP). yes bestie, we're debugging her specifically 🙈
• -nostrict — relaxes how strict the checking is. yes, including expiration dates. she's going ✨chill mode✨ for you 😌
• -ns namespace — when you're pulling metadata for one particular role, this is where you say which namespace. if you don't, the default is the SAML20MD namespace 🌈
• -p protocol — specifies a protocol when you're retrieving metadata for a particular role. normally you'd just use -saml10, -saml11, or -saml2 to name the protocol, but this one lets you throw in an arbitrary protocol. freestyle it, queen 🔥
• -saml10 — protocol = SAML 1.0. old school, but iconic ⭐
• -saml11 — protocol = SAML 1.1. the middle child, we love her too 💖
• -saml2 — protocol = SAML 2.0. the moment, the era, the slay 💅
• -r role — retrieves the metadata for one particular role. normally you'd use -idp, -aa, -pdp, or -sp to name the role, but this one lets you specify an arbitrary role. choose your own adventure, bestie 🧚
• -idp — role = IDPSSODescriptor. 💫
• -aa — role = AttributeAuthorityDescriptor. 🍓
• -pdp — role = PDPDescriptor. 🎀
• -sp — role = SPSSODescriptor. 👑

---

💖 AUTHOR 💖

this manual page was written by Russ Allbery for Debian GNU/Linux. ty king 🫡✨

---

👑 COPYRIGHT 👑

Copyright 2008 Russ Allbery. this manual page is hereby placed into the public domain by its author. so generous, so giving, we stan 😭💜

---

okay that's the whole page bestie, no cap, you're fully caught up 🌈🦋💅

and a lil sign-off for the record: this is version 3.5.2, dated 2026-02-01. mwah 💋