code: func (idp *IdentityProvider) Metadata() *Metadata {
  	cert, _ := pem.Decode([]byte(idp.Certificate))
  	if cert == nil {
  		panic("invalid IDP certificate")
  	}
  	certStr := base64.StdEncoding.EncodeToString(cert.Bytes)
  
  	return &Metadata{
  		EntityID:      idp.MetadataURL,
  		ValidUntil:    TimeNow().Add(DefaultValidDuration),
  		CacheDuration: DefaultValidDuration,
  		IDPSSODescriptor: &IDPSSODescriptor{
  			ProtocolSupportEnumeration: "urn:oasis:names:tc:SAML:2.0:protocol",
  			KeyDescriptor: []KeyDescriptor{
  				{
  					Use: "signing",
  					KeyInfo: KeyInfo{
  						Certificate: certStr,
  					},
  				},
  				{
  					Use: "encryption",
  					KeyInfo: KeyInfo{
  						Certificate: certStr,
  					},
  					EncryptionMethods: []EncryptionMethod{
  						{Algorithm: "http://www.w3.org/2001/04/xmlenc#aes128-cbc"},
  						{Algorithm: "http://www.w3.org/2001/04/xmlenc#aes192-cbc"},
  						{Algorithm: "http://www.w3.org/2001/04/xmlenc#aes256-cbc"},
  						{Algorithm: "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"},
  					},
  				},
  			},
  			NameIDFormat: []string{
  				"urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
  			},
  			SingleSignOnService: []Endpoint{
  				{
  					Binding:  HTTPRedirectBinding,
  					Location: idp.SSOURL,
  				},
  				{
  					Binding:  HTTPPostBinding,
  					Location: idp.SSOURL,
  				},
  			},
  		},
  	}
  }
docs: // Metadata returns the metadata structure for this identity provider.