title: Two questions about PHP Simple SAML by OneLogin
body: <p>If anyone has experience with Simple SAML (PHP) <a href="https://github.com/onelogin/php-saml" rel="nofollow">https://github.com/onelogin/php-saml</a> I would really appreciate your help.</p>
  
  <p>First of all, I have got it working. My app is the Service Provider and it does indeed permit authentication from an external Identity Provider. Hurrah!</p>
  
  <p>However I have two questions that have come up as part of that process:</p>
  
  <p>1) My SP generates a metadata URL. If the client has <em>already</em> provided their IDP's details, then that code works fine. I can see that the php-saml code builds the settings object, which validates, and returns the metadata XML. All good.</p>
  
  <p><em>But</em> if the client requests that metadata URL (in order to configure my SP at their end, in their IDP, <em>first</em>) it reports an error:  </p>
  
  <p><strong>"Invalid array settings: idp_entityId_not_found, idp_sso_not_found, idp_cert_or_fingerprint_not_found_and_required"</strong></p>
  
  <p>Obviously that exception is pretty self-explanatory: of course those details have indeed not been provided yet.</p>
  
  <p>So my question is: in looking at the XML of the SP metadata, it doesn't return any of their IDP details, so why <em>can't</em> it generate the metadata without knowing those details?</p>
  
  <p>The reason this is a concern is what if the IDP has the same issue at <em>their</em> end (ie <strong>they</strong> wouldn't have the SP's details, get the same error, and so neither can proceed)?!</p>
  
  <p>2) As part of the settings array, it asks for a x509 certificate and a private key to sign requests. Currently I'm using my site's SSL certificate (my-domain.com). That all works fine.</p>
  
  <p>But I see other SP let people download their certificate.</p>
  
  <p>So I could let people download the x509 part of my certificate - the public bit, I assume. But I'm wondering if the certificate even needs to be linked to the domain used by the metadata/ACS URLs?</p>
  
  <p>Or can it be any old certificate e.g. a self-signed one? What do you do?</p>
  
  <p>Thanks! I'm so confused by this. Simple it is surely not.</p>