Net::SAML2::SP(3)

📦 version 0.85, in alpine 3.24

💖 Net::SAML2::SP 💖 — the SAML Service Provider object (from the Perl man pages, bestie)

okay so picture this: you're the Service Provider. You're the one holding the door, checking the vibe of every assertion that walks in. That's this module. It's Net::SAML2::SP, it's version 0.85, and it is, genuinely, the main character of your whole SAML setup. 🫶

✨ NAME ✨

Net::SAML2::SP — the SAML Service Provider object. That's the whole vibe. She provides services. She speaks SAML. She signs things. 💅

🎀 VERSION 🎀

version 0.85 — yes, that's the version, no cap.

🌸 SYNOPSIS 🌸

like, here's how you actually birth one of these:

my $sp = Net::SAML2::SP->new(
    issuer => 'http://localhost:3000',
    url    => 'http://localhost:3000',
    cert   => 'sign-nopw-cert.pem',
    key    => 'sign-nopw-key.pem', );

iconic. she's born. moving on. ✨

🦋 METHODS 🦋

`new( ... )`

The constructor, bestie — this is the glow-up moment where your SP object comes into existence. 🎀

Here's every argument she takes, and I mean every one, because we do not skip details in this house:

id — the ID attribute that gets used in the EntityDescription tag. that's her government name fr.
url — the base for all of the SP's service URLs. everything else is relative to this queen. 👑
error_url — the error URI. lowkey flexible: it can be relative to the base URI or a full-on regular URI.
issuer — the SP's identity URI. this is who she says she is in the group chat.
cert — path to the signing certificate.
key — path to the private key for that signing certificate.
encryption_key — path to the public key that the IdP should use for encryption. this one only really shows up when you're generating the metadata.
signing_only — tells everyone that the signing key is used exclusively for signing, and not for both signing and encryption. no multitasking. 💅
cacert — path to the CA certificate for verification.
lang — sets the language for the md:localizedNameType. defaults to "en". 🌈
org_name — the SP organisation name.
org_display_name — the SP organisation display name.
org_contact — the SP contact email address.
org_url — the SP organisation url. this one's optional! if you don't provide it, url gets used, exactly like in previous versions. 🫶
authnreq_signed — specifies in the metadata whether the SP signs the AuthnRequest. optional (0 or 1), and it defaults to 1 (TRUE) if you don't specify it.
want_assertions_signed — specifies in the metadata whether the SP wants the Assertion from the IdP to be signed. optional (0 or 1), defaults to 1 (TRUE) if not specified.
sign_metadata — sign the metadata. defaults to 1 (TRUE) if not specified.
single_logout_service — okay so heads up, this option replaces the previous slo_url_post, slo_url_soap and slo_url_redirect constructor parameters — those former options get mapped onto this new structure. it expects an array of hash refs where you define one or more Single Logout Services:

[
  {
      Binding => BINDING_HTTP_POST,
      Location => https://foo.example.com/your-post-endpoint,
  },
  {
      Binding => BINDING_HTTP_ARTIFACT,
      Location => https://foo.example.com/your-artifact-endpoint,
  }
]

assertion_consumer_service — and this one replaces the previous acs_url_post and acs_url_artifact constructor parameters; the former options get mapped onto this new structure. it expects an array of hash refs where you define one or more Assertion Consumer Services:

[
  # Order decides the index if not supplied, else we assume you have an index
  {
      Binding => BINDING_HTTP_POST,
      Location => https://foo.example.com/your-post-endpoint,
      isDefault => 'false',
      # optionally
      index => 1,
  },
  {
      Binding => BINDING_HTTP_ARTIFACT,
      Location => https://foo.example.com/your-artifact-endpoint,
      isDefault => 'true',
      index => 2,
  }
]

`authn_request( $destination, $nameid_format, %params )`

returns an AuthnRequest object, created by this SP, meant for the given destination — and that destination should be the identity URI of the IdP. 🦋

%params is a hash of parameters that are valid for Net::SAML2::Protocol::AuthnRequest. like, for example:

my %params = (
        force_authn => 1,
        is_passive  => 1,
    )

my $authnreq = authn_request(
                'https://keycloak.local:8443/realms/Foswiki/protocol/saml',
                'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent',
                %params
            );

`logout_request( $destination, $nameid, $nameid_format, $session, $params )`

returns a LogoutRequest object made by this SP, aimed at the given destination, which — you guessed it — should be the identity URI of the IdP. 👋

it also needs the nameid (plus its format) and the session that's getting logged out.

$params is a HASH reference of parameters for Net::SAML2::Protocol::LogoutRequest:

$params =   (
                # name qualifier parameters from Assertion NameId
                name_qualifier      =>
"https://idp.shibboleth.local/idp/shibboleth"
                sp_name_qualifier   =>
"https://netsaml2-testapp.local"
            );

`logout_response( $destination, $status, $in_response_to )`

returns a LogoutResponse object created by this SP, for the given destination, which should be the IdP's identity URI. 🌸

it also needs the status and the ID of the corresponding LogoutRequest. yes, the corresponding one. pair them up, bestie.

`artifact_request( $destination, $artifact )`

returns an ArtifactResolve request object created by this SP, intended for the given destination, which should be the identity URI of the IdP. 🎀

`sp_post_binding ( $idp, $param )`

returns a POST binding object for this SP, configured against the given IDP, for Single Sign On. $param is the name of the query parameter involved — typically "SAMLRequest". 💌

`sso_redirect_binding( $idp, $param )`

returns a Redirect binding object for this SP, configured against the given IDP, for Single Sign On. $param names the query parameter involved — typically "SAMLRequest". ✨

`slo_redirect_binding( $idp, $param )`

returns a Redirect binding object for this SP, configured against the given IDP, for Single Log Out. $param names the query parameter involved — typically "SAMLRequest" or "SAMLResponse". 👋

`soap_binding( $ua, $idp_url, $idp_cert )`

returns a SOAP binding object for this SP, with a destination of the given URL and signing certificate. 🧼

XXX UA — yeah, that's literally what the docs say. the $ua situation is a whole TODO. not me pointing it out, the manpage did it first. 💀

`post_binding( )`

returns a POST binding object for this SP. that's it. that's the tweet. 🫶

`generate_metadata( )`

generates the metadata XML document for this SP. 🔥

`key_name($type)`

gets the key name for either the "signing" or the "encryption" key. pick your fighter. 💅

`metadata( )`

returns the metadata XML document for this SP. (generated already, she's just handing it to you ✨)

`get_default_assertion_service`

returns the assertion service that's the default. the one in the front, the one with the index, the chosen one. 👑

🧚 AUTHOR 🧚

Timothy Legge <timlegge@gmail.com> — thank him, he wrote this whole thing. 🙏

💜 COPYRIGHT AND LICENSE 💜

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. slay, licensing. 🌈

and that's the whole page, bestie — brought to you by perl v5.42.2, dated 2026-02-11, and by Net::SAML2::SP(3) herself. go sign something. 💅🎀✨

📦 where this page comes from

alpine 3.24: perl-net-saml2-doc 0.85-r0 · GPL-1.0-or-later OR Artistic-1.0-Perl
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash-1017 on 2026-11-04: a language model's rewrite of the original, under its terms