code: func (connection *VSphereConnection) Signer(ctx context.Context, client *vim25.Client) (*sts.Signer, error) {
  	// TODO: Add separate fields for certificate and private-key.
  	// For now we can leave the config structs and validation as-is and
  	// decide to use LoginByToken if the username value is PEM encoded.
  	b, _ := pem.Decode([]byte(connection.Username))
  	if b == nil {
  		return nil, nil
  	}
  
  	cert, err := tls.X509KeyPair([]byte(connection.Username), []byte(connection.Password))
  	if err != nil {
  		klog.Errorf("Failed to load X509 key pair. err: %+v", err)
  		return nil, err
  	}
  
  	tokens, err := sts.NewClient(ctx, client)
  	if err != nil {
  		klog.Errorf("Failed to create STS client. err: %+v", err)
  		return nil, err
  	}
  
  	req := sts.TokenRequest{
  		Certificate: &cert,
  	}
  
  	signer, err := tokens.Issue(ctx, req)
  	if err != nil {
  		klog.Errorf("Failed to issue SAML token. err: %+v", err)
  		return nil, err
  	}
  
  	return signer, nil
  }
docs: // Signer returns an sts.Signer for use with SAML token auth if connection is configured for such.
  // Returns nil if username/password auth is configured for the connection.