single sign on - Two questions about PHP Simple SAML by OneLogin -

if has experience simple saml (php) https://github.com/onelogin/php-saml appreciate help.

first of all, have got working. app service provider , indeed permit authentication external identity provider. hurrah!

however have 2 questions have come part of process:

1) sp generates metadata url. if client has already provided idp's details, code works fine. can see php-saml code builds settings object, validates, , returns metadata xml. good.

but if client requests metadata url (in order configure sp @ end, in idp, first) reports error:

"invalid array settings: idp_entityid_not_found, idp_sso_not_found, idp_cert_or_fingerprint_not_found_and_required"

obviously exception pretty self-explanatory: of course details have indeed not been provided yet.

so question is: in looking @ xml of sp metadata, doesn't return of idp details, why can't generate metadata without knowing details?

the reason concern if idp has same issue @ their end (ie they wouldn't have sp's details, same error, , neither can proceed)?!

2) part of settings array, asks x509 certificate , private key sign requests. i'm using site's ssl certificate (my-domain.com). works fine.

but see other sp let people download certificate.

so let people download x509 part of certificate - public bit, assume. i'm wondering if certificate needs linked domain used metadata/acs urls?

or can old certificate e.g. self-signed one? do?

thanks! i'm confused this. simple surely not.

i'm maintainer of onelogin saml toolkit.

related 1) have request of split settings validation , implement in toolkits: https://github.com/onelogin/python-saml/issues/74

related 2)

saml requires x509 cert/key in order sign/encrypt saml elements.

• some idps/sps use same x509 of apache/nginx server enable https (bought certs).

• others use self signed certs, (you can create yours tool (https://www.samltool.com/self_signed_certs.php). recommend when creating them use idp/sp domain in order able identify them later (but not required saml). can use old ones, since can generate them anytime practice have them linked domain , them fresh, avoiding others share in past).