saml/metadata.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  vault-live SP Metadata
  EntityID: https://vault-live.local/sp
  Generated by vault-live/saml/metadata_builder.py
  Trust is established via this document — not via public CA.
-->
<md:EntityDescriptor
    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
    xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
    entityID="https://vault-live.local/sp"
    validUntil="2027-01-01T00:00:00Z">

  <md:SPSSODescriptor
      AuthnRequestsSigned="true"
      WantAssertionsSigned="true"
      protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

    <!-- SP signing certificate (DER/Base64) — replace with generated cert -->
    <md:KeyDescriptor use="signing">
      <ds:KeyInfo>
        <ds:X509Data>
          <ds:X509Certificate>
            PLACEHOLDER_SP_SIGNING_CERT
          </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>

    <!-- SP encryption certificate (DER/Base64) — for EncryptedAssertion -->
    <md:KeyDescriptor use="encryption">
      <ds:KeyInfo>
        <ds:X509Data>
          <ds:X509Certificate>
            PLACEHOLDER_SP_ENCRYPTION_CERT
          </ds:X509Certificate>
        </ds:X509Data>
      </ds:KeyInfo>
    </md:KeyDescriptor>

    <md:NameIDFormat>
      urn:oasis:names:tc:SAML:2.0:nameid-format:transient
    </md:NameIDFormat>

    <md:AssertionConsumerService
        Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
        Location="https://vault-live.local/sp/acs"
        index="1"
        isDefault="true"/>

  </md:SPSSODescriptor>

</md:EntityDescriptor>