SAMLSIGN(1)

💖 SAMLSIGN — bestie edition 💖

okay so this is the OpenSAML manual page for samlsign, and honestly? it's giving "i sign your XML and i verify your XML and i look cute doing it" ✨

---

✨ NAME ✨

samlsign — sign and verify XML documents 🖋️🔍

---

🌸 SYNOPSIS 🌸

samlsign <options>

---

🦋 DESCRIPTION 🦋

samlsign signs or verifies signed XML documents. no cap, that's the whole job and it's iconic.

Wanna sign a document? use -s. Wanna verify one? literally just omit -s, that's it, that's the vibe.

When you're verifying, one of -c, -R, or -T is required. and when you're signing, either -k or -R is required. no skipping, bestie, the tool will simply not know what you want from it 😭

By default, samlsign signs or verifies standard input. if you'd rather it pull the document from somewhere else, pass -u (URL) or -f (file path) 🫶

And the glow-up: signed documents are always printed to standard output. always always. periodt. 💅

---

🎀 OPTIONS 🎀

• -u URL — the URL of the document you wanna sign or verify 🌐
• -f PATH — the full path of the document you wanna sign or verify 📁
• -id ID — instead of acting on the whole entire document, only act on the object with the specified ID. only that one object (with its shiny new signature) gets printed to standard output. main character object energy, lowkey 👑
• -s — sign, rather than the default action of verify ✍️
• -k KEY — the full path to the key you're using to sign 🔑
• -c CERT — the full path to the certificate you're using to verify 📜
• -R RESOLVER — specifies a credential resolver to use, either for signing or for verification 🧰
• -T TRUST — specifies the trust engine for TrustEngine-based verification 🛡️
• -M METADATA — specifies the metadata for TrustEngine-based verification 📚
• -i ISSUER — specifies the issuer for verification 🏷️
• -p PROT — specifies the protocol for TrustEngine-based verification. this one lets you name an arbitrary protocol by name, but honestly you'd more commonly use one of the options listed below for the standard protocol names 💫
• -r RNAME — specifies the resource name for TrustEngine-based verification. again, arbitrary resource name by name is allowed, but you'd more commonly reach for one of the options listed below for the standard resource names 🏗️
• -ns RNS — specifies the namespace for TrustEngine-based verification. if you don't give one, the default is SAML20MD_NS 🌌
• -saml10 — use the SAML1.0 protocol for TrustEngine-based verification 🕰️
• -saml11 — use the SAML1.1 protocol for TrustEngine-based verification 🕰️
• -saml2 — use the SAML2.0 P NS protocol for TrustEngine-based verification 🚀
• -idp — set the resource name to IDPSSODescriptor for TrustEngine-based verification 🪪
• -aa — set the resource name to AttributeAuthorityDescriptor for TrustEngine-based verification 🗂️
• -pdp — set the resource name to PDPDescriptor for TrustEngine-based verification ⚖️
• -sp — set the resource name to SPSSODescriptor for TrustEngine-based verification 🤝
• -V — validate the document while you're signing or verifying it. the path to the schemas used for validation can be overridden by setting the OPENSAML_SCHEMAS environment variable 🔬
• -alg algorithm — specifies the signature algorithm to use, overriding the default. only used when signing ✨
• -dig algorithm — specifies the digest algorithm to use, overriding the default. only used when signing ✨

---

💀 EXIT STATUS 💀

• 0 — success 🎉
• -1 — an error in how samlsign was called (incorrect arguments, for example) 🙈
• -2 — an error occurred when initializing the configuration 😵
• -10 — an exception was caught 😭

---

🌈 EXAMPLES 🌈

To sign SAML 2.0 metadata, use:

samlsign -k /path/to/key -c /path/to/cert -f /path/to/metadata

that's it. that's the whole recipe. slay 🍓

---

👑 AUTHOR 👑

This manpage were written by Ferenc Wágner and Russ Allbery for Debian GNU/Linux 🫶

---

📜 COPYRIGHT 📜

Copyleft (C) 2008 Ferenc Wágner This is free software in the public domain.

---

ok bestie that's the whole page, every flag accounted for, not a single detail left behind 💖

and the cute little sign-off at the bottom: this one's from UCAID, dated 2011 Jul 25 🌸 go forth and sign responsibly ✨💅