SHIB-METAGEN.1(1)

📦
version 3.5.2 · 6 versions
, in ubuntu resolute, ubuntu stonking

💖 SHIB-METAGEN — bestie edition 💖

okay so this is shib-metagen, from the Shibboleth manual (section 1), and it's genuinely one of those little tools that just does the thing and dips. no cap.

✨ NAME ✨

shib-metagen — generate metadata for a Shibboleth SP 🎀

🌸 SYNOPSIS 🌸

shib-metagen [-12ADLNO] [-c cert [-c cert ...]]
    [-e entity-id] [-f format [-f format ...]]
    [-h host [-h host ...]] [-n host [-n host ...]]
    [-l host-file] [-o organization]
    [-a admin [-a admin ...]]
    [-s support [-s support ...]]
    [-t tech [-t tech ...]] [-u url]

💅 DESCRIPTION 💅

so basically, shib-metagen generates metadata for a Shibboleth SP. the metadata gets printed straight to standard output. most of the parameters are optional (chill, you don't need all of them), BUT — and this is the part that matters — you gotta give at least one of -h or -n, because that's how the tool knows the hostname to use when constructing URLs for the Shibboleth service for the SP. no hostname, no metadata, periodt. 💀

you can layer on more metadata with the other command-line parameters, and most parameters can be given multiple times (yes bestie, stack them 🫶).

👑 OPTIONS 👑

  • -1 — generate SAML 1.0 metadata. the default, if you don't give either -1 or -2, is to generate metadata for both SAML 1.0 and SAML 2.0.
  • -2 — generate SAML 2.0 metadata. same deal: default (no -1, no -2) is metadata for both SAML 1.0 and SAML 2.0.
  • -A — include artifact metadata. ✨
  • -a admin — an administrative contact for this Shibboleth SP. you can skip it entirely (in which case administrative contact metadata just isn't included), or give it multiple times to list multiple contacts. admin should be in the form "first/last/email" where first is the given name and last is the surname.
  • -c cert — specifies the SSL certificate used to identify this Shibboleth SP. give it multiple times to specify multiple certificates. if you don't give it at all, the default certificate is sp-cert.pem in the current working directory.
  • -D — include discovery service information in the metadata. by default, discovery service info is not included.
  • -e entity-id — the entity ID for this SP. this must be a unique identifier for this SP and it must be a URL. if -o is given and -u is not given, entity-id is used as the URL for the organization running this Shibboleth SP. if it's not specified, it defaults to "https://host/shibboleth" where host is the argument to the first -h option.
  • -f format — include this NameIDFormat in the metadata. can be given more than once. 🌈
  • -h host — a hostname for this SP (possibly a virtual host). either this option, the -n option, or the -l option must be specified at least once. repeat it for every virtual host that responds to the Shibboleth protocol. use -h for hostnames or virtual hosts that use SSL. 🔥
  • -L — include Single Logout information in the metadata. not included by default.
  • -l host-list — read the list of hostnames for this SP from a file. each line of the file gets treated as if it were passed as an argument to the -h option — so, a hostname or virtual host that responds to the Shibboleth protocol and uses SSL. 🦋
  • -N — include NameID management information in the metadata. not included by default.
  • -n host — a hostname for this SP (possibly a virtual host). either this option, the -h, or the -l option must be specified at least once. repeat it for every virtual host that responds to the Shibboleth protocol. use -n for hostnames or virtual hosts that do not use SSL to protect the Shibboleth communication.
  • -O — include XML namespace declarations in the generated metadata. this is the default. ✨
  • -o organization — the name of the organization that runs this Shibboleth SP. can be given only once, and may be omitted, in which case organization metadata is not included. normally this isn't necessary, but other software systems might use it for stuff like displaying lists of entities with human-readable names.
  • -s support — a support contact for this Shibboleth SP. may be omitted (then support contact metadata isn't included), or given multiple times to list multiple contacts. support should be in the form "first/last/email" where first is the given name and last is the surname. 🫶
  • -t tech — a technical contact for this Shibboleth SP. may be omitted (then technical contact metadata isn't included), or given multiple times to list multiple contacts. tech should be in the form "first/last/email" where first is the given name and last is the surname.
  • -u url — sets the URL for the organization. this info is only used if the -o option is also given to specify the name of the organization. if -o is given and -u is not given, the entity ID (set with -e) is used as the organization URL.
heads up bestie: that -o / -u / -e triangle is lowkey the only place where these options talk to each other. read it twice, it'll click. 💜

🧚 AUTHOR 🧚

this manual page was written by Russ Allbery for Debian GNU/Linux.

Copyright 2009, 2011 Russ Allbery. this manual page is hereby placed into the public domain by its author.

okay and for the cute lil sign-off: this is version 3.5.2, dated 2026-02-01, from the Shibboleth source — so if you're reading this, you're reading the exact same page everyone else got, no crumbs left behind. slay. 💖✨

📦 where this page comes from