Как вставить подпись в AuthNRequest для единого входа SAML 2.0 в переполнение стека

Мой IDP требует AuthNRequest со встроенным, подписанным и зашифрованным, где URL запроса выглядит так:

http://idp.example.com/SSOService.php?SAMLRequest={} Знач1

AuthNRequest со встроенной подписью (привязка HTTP-POST)

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" ID="pfx41d8ef22-e612-8c50-9960-1b16f15741b3" Version="2.0" ProviderName="SP test" IssueInstant="2014-07-16T23:52:45Z" Destination="http://idp.example.com/SSOService.php" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" AssertionConsumerServiceURL="http://sp.example.com/demo1/index.php?acs">
<saml:Issuer>http://sp.example.com/demo1/metadata.php</saml:Issuer>
<ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
<ds:Reference URI="#pfx41d8ef22-e612-8c50-9960-1b16f15741b3">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
<ds:DigestValue>yJN6cXUwQxTmMEsPesBP2NkqYFI=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>...</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>...</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature>
<samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" AllowCreate="true"/>
<samlp:RequestedAuthnContext Comparison="exact">
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

Однако мои запросы выглядят так

http://idp.example.com/SSOService.php?SAMLRequest={} Знач1&Подпись = {знач2}&SigAlg = {val3}

В OneLogin’s [php-saml] мои настройки требуют, чтобы сообщение было подписано и зашифровано

'nameIdEncrypted' => true,
'authnRequestsSigned' => true,
'logoutRequestSigned' => true,
'logoutResponseSigned' => true,
'signMetadata' => true,
'wantMessagesSigned' => true,
'wantAssertionsSigned' => true,'wantAssertionsEncrypted' => true,
'wantNameIdEncrypted' => true,
'requestedAuthnContext' => true,
'wantXMLValidation' => true,
'signatureAlgorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',

И в SimpleSAMLphp
мой конфиг idp-remote

$metadata['https:/my.idp.com/idplogin'] = array(
'name' => array(
'en' => 'my.idp.com',
'no' => 'my.idp.com',
),
'description'          => 'IDP SSO',
'sign.authnrequest' => TRUE,
'sign.logout' => TRUE,
'signature.algorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
'assertion.encryption' => TRUE,
'sharedkey' => 'SHAREDKEY.crt',
'SingleLogoutService' =>
array (
0 =>
array (
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
'Location' => 'http://iam.sp.com/module.php/saml/sp/saml2-logout.php/default-sp',
),
),
'AssertionConsumerService' =>
array (
0 =>
array (
'index' => 0,
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
'Location' => 'http://iam.sp.com/module.php/saml/sp/saml2-acs.php/default-sp',
),
1 =>
array (
'index' => 1,
'Binding' => 'urn:oasis:names:tc:SAML:1.0:profiles:browser-post',
'Location' => 'http://iam.sp.com/module.php/saml/sp/saml1-acs.php/default-sp',
),
2 =>
array (
'index' => 2,
'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact',
'Location' => 'http://iam.sp.com/module.php/saml/sp/saml2-acs.php/default-sp',
),
3 =>
array (
'index' => 3,
'Binding' => 'urn:oasis:names:tc:SAML:1.0:profiles:artifact-01',
'Location' => 'http://iam.sp.com/module.php/saml/sp/saml1-acs.php/default-sp/artifact',
),
),
'SingleSignOnService' => 'https:/my.idp.com/samljct',
'redirect.sign' => TRUE,
'redirect.validate' => TRUE,
'acs.Bindings' => array(
'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST',
'urn:oasis:names:tc:SAML:1.0:profiles:browser-post',
),
'certFingerprint'      => 'FINGERPRINTED',
'certificate'          => 'SPCERTYA.crt'
);

и мой конфиг sp

$config = array(
'admin' => array(
'core:AdminPassword',
),
'default-sp' => array(
'saml:SP',
'entityID' => null,
'idp' => null,
'discoURL' => null,
'privatekey' => 'MYSTUFF.pem',
'certificate' => 'MYSTUFF.crt',
'metadata.sign.authnrequest' => TRUE,
'metadata.sign.enable' => TRUE,
'redirect.sign' => TRUE,
'redirect.validate' => TRUE,
'assertion.encryption' => TRUE,
'IsPassive' => FALSE,
'signature.algorithm' => 'http://www.w3.org/2000/09/xmldsig#rsa-sha1',
),

В обеих этих службах я не уверен, как встроить подпись в AuthNRequest?