The SP does this automatically, it's just part of the operation of the software. The samlsign command line program that's part of OpenSAML exposes a certain amount of the logic that happens when it does that. -- Scott