code: func (s *handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
  	action := r.Header.Get("SOAPAction")
  	env := soap.Envelope{}
  	now := time.Now()
  	lifetime := &internal.Lifetime{
  		Created: now.Format(internal.Time),
  		Expires: now.Add(5 * time.Minute).Format(internal.Time),
  	}
  
  	switch path.Base(action) {
  	case "Issue":
  		body := internal.RequestSecurityTokenBody{
  			Res: &internal.RequestSecurityTokenResponseCollection{
  				RequestSecurityTokenResponse: internal.RequestSecurityTokenResponse{
  					RequestedSecurityToken: internal.RequestedSecurityToken{
  						Assertion: token,
  					},
  					Lifetime: lifetime,
  				},
  			},
  		}
  		env.Body = body
  	case "Renew":
  		body := internal.RenewSecurityTokenBody{
  			Res: &internal.RequestSecurityTokenResponse{
  				RequestedSecurityToken: internal.RequestedSecurityToken{
  					Assertion: token,
  				},
  				Lifetime: lifetime,
  			},
  		}
  		env.Body = body
  	default:
  		log.Printf("sts: unsupported action=%s", action)
  		w.WriteHeader(http.StatusNotFound)
  		return
  	}
  
  	w.WriteHeader(http.StatusOK)
  	fmt.Fprint(w, internal.Marshal(env))
  }
docs: // ServeHTTP handles STS requests.