<?php

$settings = array(
    // If 'strict' is True, then the PHP Toolkit will reject unsigned
    // or unencrypted messages if it expects them to be signed or encrypted.
    // Also it will reject the messages if the SAML standard is not strictly
    // followed: Destination, NameId, Conditions ... are validated too.
    'strict' => true,

    // Enable debug mode (to print errors).
    'debug' => false,

    // Set a BaseURL to be used instead of try to guess
    // the BaseURL of the view that process the SAML Message.
    // Ex http://example.rit.edu/app
    'baseurl' => 'http://example.rit.edu/app',

    // Service Provider Data that we are deploying.
    'sp' => array(
        // Identifier of the SP entity  (must be a URI)
        'entityId' => $baseurl . '/sp',
        // Specifies info about where and how the<AuthnResponse> message MUST be
        // returned to the requester, in this case our SP.
        'assertionConsumerService' => array(
            // URL Location where the <Response> from the IdP will be returned
            'url' => $baseurl . '/consume.php',
            // SAML protocol binding to be used when returning the <Response>
            // message. OneLogin Toolkit supports this endpoint for the
            // HTTP-POST binding only.
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
        ),
        // Specifies info about where and how the <Logout Response> message MUST be
        // returned to the requester, in this case our SP.
        'singleLogoutService' => array(
            // URL Location where the <Response> from the IdP will be returned
            'url' => $baseurl . '/slo.php',
            // SAML protocol binding to be used when returning the <Response>
            // message. OneLogin Toolkit supports the HTTP-Redirect binding
            // only for this endpoint.
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
        ),
        // Specifies the constraints on the name identifier to be used to
        // represent the requested subject.
        // Take a look on lib/Saml2/Constants.php to see the NameIdFormat supported.
        'NameIDFormat' => 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
        // Usually x509cert and privateKey of the SP are provided by files placed at
        // the certs folder. But we can also provide them with the following parameters
        // 'x509cert' => '',
        // 'privateKey' => '',

        /*
         * Key rollover
         * If you plan to update the SP x509cert and privateKey
         * you can define here the new x509cert and it will be
         * published on the SP metadata so Identity Providers can
         * read them and get ready for rollover.
         */
        // 'x509certNew' => '',
    ),

    // Identity Provider Data that we want connected with our SP.
    'idp' => array(
        'entityId' => 'https://shibboleth.main.ad.rit.edu/idp/shibboleth',
        'singleSignOnService' => array(
            'url' => 'https://shibboleth.main.ad.rit.edu/idp/profile/SAML2/Redirect/SSO',
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
        ),
        // SLO endpoint info of the IdP.
        'singleLogoutService' => array(
            'url' => 'https://shibboleth.main.ad.rit.edu/logout.html',
            'binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
        ),
        // Public x509 certificate of the IdP
        'x509cert' => 'MIIDVDCCAjygAwIBAgIVAMPFek+px9vIGJ0/+QhwyptEXQqaMA0GCSqGSIb3DQEB BQUAMCUxIzAhBgNVBAMTGnNoaWJib2xldGgubWFpbi5hZC5yaXQuZWR1MB4XDTA4 MTEyNTE4MzU0N1oXDTI4MTEyNTE4MzU0N1owJTEjMCEGA1UEAxMac2hpYmJvbGV0 aC5tYWluLmFkLnJpdC5lZHUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB AQC3LLiBrUjXO+LFsfrk4u5lQ62FfXJEPJnmL6/4WVsOtpLWMQZesuiOlyhFTsTN dlmFp37UTcZ9MJsTeG/1M87BxUnPB22Qn7TPNLh7Oi3QDinVyukPXRl6B/bHdtMh lq5V+E8rNyITaOc7YB6GkNLBOVBRemBcttmlwz5whHWwU/MNdQlBf4/KIu7mV5dp WQrnPvaTk3nle4vOtbPThipD5jiD2r/a4/l5gROJRuLvxQaiNfBfACwowp9R9DHK lpqD4EPSEv2v0RXJyFx4pMi/hnfmSjvIQi9s+J5sKzyNN3JtCzrVO5GSiddO46bR tvp5H/rz0cNpp5rnjz+NRkarAgMBAAGjezB5MFgGA1UdEQRRME+CGnNoaWJib2xl dGgubWFpbi5hZC5yaXQuZWR1hjFodHRwczovL3NoaWJib2xldGgubWFpbi5hZC5y aXQuZWR1L2lkcC9zaGliYm9sZXRoMB0GA1UdDgQWBBRJRQ19Vjpa3qktIoVtEqdL onWQFTANBgkqhkiG9w0BAQUFAAOCAQEAmXDiVgm0fmvvhtzYO2GFBIpZNNzd+8ou jnUNTKNAliKToarQvLDTQUENh2L558u3OvwFXlC7hcnGNKin4VjQ/GWps+J7dQ67 gCiYMquyf5i9UE/j5ilriNXmSwzwvB/YPJzEMIFd2XBI550ODeIMf5B0gGx1EMB1 jyWpy4iOZbMCBbGn0Vo2/AeGyiUmT6/qcDnrMTg4fvAqG26kujwPBb42UpkwSo2E OZDp3OGGicpNhWVWca74r8KHYJGNBwXYmZ5ntP5Yfd9cElJKFLS21igLGkhr/o4N Im4Q86WvRXW4cHfy8OB9fEIURxSmGeZMYsd0YLh8ouPlWuLl3hWsyQ==',
    ),
);

<?php

define("TOOLKIT_PATH", '/var/www/php-saml/');
require_once dirname(TOOLKIT_PATH.'/_toolkit_loader.php';


// Or use the following if installing the toolkit via Composer
// require_once __DIR__ . '/vendor/autoload.php';

use OneLogin\Saml2\Settings;
use OneLogin\Saml2\Error;

require_once 'settings.php' ;

try {
    #$auth = new OneLogin\Saml2\Auth($settingsInfo);
    #$settings = $auth->getSettings();
    // Now we only validate SP settings
    $settings = new Settings($settingsInfo, true);
    $metadata = $settings->getSPMetadata(true);
    $errors = $settings->validateMetadata($metadata);
    if (empty($errors)) {
        header('Content-Type: text/xml');
        echo $metadata;
    } else {
        throw new Error(
            'Invalid SP metadata: '.implode(', ', $errors),
            Error::METADATA_SP_INVALID
        );
    }
} catch (Exception $e) {
    echo $e->getMessage();
}