Multiple IdP certs support

[timlegge]

In the Original lib/Net/SAML2/Idp.pm: the certs are a HashRef[Str]

$VAR1 = {
          'signing' => '-----BEGIN CERTIFICATE-----
MIIDFTCCAf2gAwIBAgIBATANBgkqhkiG9w0BAQUFADA3MQswCQYDVQQGEwJVUzEO
MAwGA1UECgwFbG9jYWwxCzAJBgNVBAsMAmN0MQswCQYDVQQDDAJDQTAeFw0xMDEw
MDYxMjM4MTRaFw0xMTEwMDYxMjM4MTRaMFcxCzAJBgNVBAYTAlVTMQ4wDAYDVQQK
DAVsb2NhbDELMAkGA1UECwwCY3QxDTALBgNVBAMMBHNhbWwxHDAaBgkqhkiG9w0B
CQEWDXNhbWxAY3QubG9jYWwwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAMhu
pJZpvu1m6ys+IrWrm3pK+onwRAYCyrgQ0RyK2cHbVLFbjBqTjKnt+PiVbnZPZUTs
tkV9oijZGQvaMy9ingJursICUQzmOfYRDm4s9gFJJOHUGYnItRhp4uj3EoWWyX8I
6Mr+g3/vNgNFvD5S9L7Hk1mSw8SnPlblZAWlFUwXAgMBAAGjgY8wgYwwDAYDVR0T
AQH/BAIwADAxBglghkgBhvhCAQ0EJBYiUnVieS9PcGVuU1NMIEdlbmVyYXRlZCBD
ZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUGy/iPd7PVObrF+lK4+ZShcbStLYwCwYDVR0P
BAQDAgXgMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDANBgkqhkiG9w0B
AQUFAAOCAQEAYoYq3Rc6jC7f8DnKxDHntHxH91F5mfp8Y3j7ALcRG/mrzkMhvxU2
O2qmh4aHzZBoY1EU9VjrVgyPJPAjFQVC+OjIE46Gavh5wobzYmVGeFLOa9NhPv50
h3EOw1eCda3VwcvStWw1OhT8cpEGqgJJVAcjwcm4VBtWjodxRn3E4zBr/xxzR1HU
ISvnu1/xomsSS+aenG5toWmhoJIKFbfhQkpnBlgGD5+12Cxn2jHpgv15262ZZIJS
WPp/0bQqdAAUzkJZPpUGUN1sTXPJexYT6na7XvLd6mvO1g+WDk6aZnW/zcT3T9tL
Iavyic/p4gZtXckweq+VTn9CdZp6ZTQtVw==
-----END CERTIFICATE-----
'
        };

With Multiple Certs support in lib/Net/SAML2/Idp.pm there may be multiple certificate in the metadata as read in from the XML so the certs are now a an array of hashrefs: ArrayRef[HashRef[Str]]

          'certs' => [
                       {
                         'signing' => '-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAVuOAyTCMA0GCSqGSIb3DQEBCwUAMHsxFDASBgNVBAoT
C0dvb2dsZSBJbmMuMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ8wDQYDVQQDEwZH
b29nbGUxGDAWBgNVBAsTD0dvb2dsZSBGb3IgV29yazELMAkGA1UEBhMCVVMxEzAR
BgNVBAgTCkNhbGlmb3JuaWEwHhcNMTcwNDIxMDA1NjU5WhcNMjIwNDIwMDA1NjU5
WjB7MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEWMBQGA1UEBxMNTW91bnRhaW4gVmll
dzEPMA0GA1UEAxMGR29vZ2xlMRgwFgYDVQQLEw9Hb29nbGUgRm9yIFdvcmsxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAsziYPBZSqLzs5pFfoZPTVyoHwM4fmI9qQIScWJB0435s
s5HDRDKBTvO8rg2sGbfMSYVINLvesTeTNkPkMfoSplne6uWjAWkoskvls+0bzp8j
AXb+UJ1cZplQxhWW25TsEcpcMX+p4J0v/syO9lyDubNSpchPGIuzitKXdwFkgcOi
CFk+01MF3COKaO6HoLr5Jqf7I6qjJy72h3ZC7rGUtwjCQPaAfeLIM2uGmdOcm7Ql
/89hBSjJYvJOXOyEZqppYd2tat7UPh4q8UTmPhwETaVssThfNZUpt9iZcCFcWaVh
/mljxD/V20VNMAlzN8VXM/WjbBSAePS30VRF6xXlzwIDAQABMA0GCSqGSIb3DQEB
CwUAA4IBAQAKxc4M+il/bQQcmm/JNKF5ypeC0YH+oRjSwec84pznP2qqjWosR2uR
9hL6CN2dOZU/uCaX1nZviGIlsw9n7JUEfxMs4azYWfdTz7C7l9x6HpF/QK5NwBe1
z3iPZAiKR8hBqt7IeN3nlT4RsaMr0E9UbG5pimxEG0uves5BoHS+3Xfb8sd33dNR
yCm22nb2wWGG+jTKy2G8/24gHB2c0X6/AiD3dZbYqf7pFRWrXefkMaUMaCMnQh+o
wjjxVNEAAQ8QU/2Hwhz6pR0eEGL6UwWufJX8uSGaxqn+397MdrI4CE0gQAZXrB1L
3PU9tdyiap2hWQPo8T2STpOtvcovFPHs
-----END CERTIFICATE-----
'
                       },
                       {
                         'signing' => '-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAWj+rlteMA0GCSqGSIb3DQEBCwUAMHsxFDASBgNVBAoT
C0dvb2dsZSBJbmMuMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ8wDQYDVQQDEwZH
b29nbGUxGDAWBgNVBAsTD0dvb2dsZSBGb3IgV29yazELMAkGA1UEBhMCVVMxEzAR
BgNVBAgTCkNhbGlmb3JuaWEwHhcNMTkwMjE4MDMzNzQ1WhcNMjQwMjE3MDMzNzQ1
WjB7MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEWMBQGA1UEBxMNTW91bnRhaW4gVmll
dzEPMA0GA1UEAxMGR29vZ2xlMRgwFgYDVQQLEw9Hb29nbGUgRm9yIFdvcmsxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAubE4/cl70Lc2f7VV+ZJyzYIzuAMj6ejlbtRnym2kgyYj
aaO0MVU/r38oRC7UqdQIXwA0/S1Eu0k6EYcCUiyTGWz3HKv/OSOSnSDpN4wEWaZb
mJYvu8SjWZQCVdcM4fx1kzrtE+LEBTOKgj0k2G1qUMNI7xaqiJONO9aIeCic5zbA
CNpc+IOZoRS4RaY5Ie7W1ZIXAJ0xWL3snVdqklaJzzU2Myt5QX6W1Sd411Hzo+Ih
i5ksq18ML1tgMTFIqLkY2Luf5JJdZFRcCgvHrFF2CQywE0ftZtSSg5wD+hp3PJpL
5bxxF1vSdyKQbUia1Buc8+Cy6NTIbmLLIrcyULyHSwIDAQABMA0GCSqGSIb3DQEB
CwUAA4IBAQAXKjWrRzhgUW1+pK3V51MGl2b/yf33Ac4fm7GQql0Ag0Neye1EmdLj
D2N9gVeFawMcfRT4GABBHtS5bu01M8QHHAGjbBKfqOaPJc39v0Y/RCSd/FzXg99h
NT5UggAWVR+vC6a1IrVSUa5eKe82yBAubbdftvGtKHG90HIAsb1iyMKK2rGnTupg
JfJIUTWhWnWuemIVwduErFCxng//jYXViyEloz730faMIp6eNSD2+2cCssVGFb6F
xhCvVuNh6tgXv4vErVSWerFk/GcIh5n/biaDy/gEtAqgK154AfOifpDP3l3ZV/ce
lj1wSwcLF90e84XaVIkzb3veTcWhqaaq
-----END CERTIFICATE-----
'
                       }
                     ],

However the BUILDARGS validates each certificate with the given cacert and, if it cannot be validated, does not include it in the
valid IdP certs

$VAR1 = [
          {
            'signing' => '-----BEGIN CERTIFICATE-----
MIIDdDCCAlygAwIBAgIGAWj+rlteMA0GCSqGSIb3DQEBCwUAMHsxFDASBgNVBAoT
C0dvb2dsZSBJbmMuMRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MQ8wDQYDVQQDEwZH
b29nbGUxGDAWBgNVBAsTD0dvb2dsZSBGb3IgV29yazELMAkGA1UEBhMCVVMxEzAR
BgNVBAgTCkNhbGlmb3JuaWEwHhcNMTkwMjE4MDMzNzQ1WhcNMjQwMjE3MDMzNzQ1
WjB7MRQwEgYDVQQKEwtHb29nbGUgSW5jLjEWMBQGA1UEBxMNTW91bnRhaW4gVmll
dzEPMA0GA1UEAxMGR29vZ2xlMRgwFgYDVQQLEw9Hb29nbGUgRm9yIFdvcmsxCzAJ
BgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAubE4/cl70Lc2f7VV+ZJyzYIzuAMj6ejlbtRnym2kgyYj
aaO0MVU/r38oRC7UqdQIXwA0/S1Eu0k6EYcCUiyTGWz3HKv/OSOSnSDpN4wEWaZb
mJYvu8SjWZQCVdcM4fx1kzrtE+LEBTOKgj0k2G1qUMNI7xaqiJONO9aIeCic5zbA
CNpc+IOZoRS4RaY5Ie7W1ZIXAJ0xWL3snVdqklaJzzU2Myt5QX6W1Sd411Hzo+Ih
i5ksq18ML1tgMTFIqLkY2Luf5JJdZFRcCgvHrFF2CQywE0ftZtSSg5wD+hp3PJpL
5bxxF1vSdyKQbUia1Buc8+Cy6NTIbmLLIrcyULyHSwIDAQABMA0GCSqGSIb3DQEB
CwUAA4IBAQAXKjWrRzhgUW1+pK3V51MGl2b/yf33Ac4fm7GQql0Ag0Neye1EmdLj
D2N9gVeFawMcfRT4GABBHtS5bu01M8QHHAGjbBKfqOaPJc39v0Y/RCSd/FzXg99h
NT5UggAWVR+vC6a1IrVSUa5eKe82yBAubbdftvGtKHG90HIAsb1iyMKK2rGnTupg
JfJIUTWhWnWuemIVwduErFCxng//jYXViyEloz730faMIp6eNSD2+2cCssVGFb6F
xhCvVuNh6tgXv4vErVSWerFk/GcIh5n/biaDy/gEtAqgK154AfOifpDP3l3ZV/ce
lj1wSwcLF90e84XaVIkzb3veTcWhqaaq
-----END CERTIFICATE-----
'
          }
        ];

This looks to be the correct approach to avoid breaking existing applications. The Redirect changes I need to go through again

[waterkip]

I would opt for a data structure ala: $certs{$use} = [ cert-text, cert-text2, .. ]. This is easier on the mind and makes it easier to get all the signing certs or all the encryption certs.

[timlegge]

now that it is working again I will do some refactoring. that is a good idea