code: def add_x509_key_descriptors(metadata, cert=None, add_encryption=True):
          
          if cert is None or cert == '':
              return metadata
          try:
              root = OneLogin_Saml2_XML.to_etree(metadata)
          except Exception as e:
              raise Exception('Error parsing metadata. ' + str(e))
  
          assert root.tag == '{%s}EntityDescriptor' % OneLogin_Saml2_Constants.NS_MD
          try:
              sp_sso_descriptor = next(root.iterfind('.//md:SPSSODescriptor', namespaces=OneLogin_Saml2_Constants.NSMAP))
          except StopIteration:
              raise Exception('Malformed metadata.')
  
          if add_encryption:
              OneLogin_Saml2_Metadata.__add_x509_key_descriptors(sp_sso_descriptor, cert, False)
          OneLogin_Saml2_Metadata.__add_x509_key_descriptors(sp_sso_descriptor, cert, True)
          return OneLogin_Saml2_XML.to_string(root)
docs: Adds the x509 descriptors (sign/encryption) to the metadata
          The same cert will be used for sign/encrypt
  
          :param metadata: SAML Metadata XML
          :type metadata: string
  
          :param cert: x509 cert
          :type cert: string
  
          :param add_encryption: Determines if the KeyDescriptor[use="encryption"] should be added.
          :type add_encryption: boolean
  
          :returns: Metadata with KeyDescriptors
          :rtype: string