<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{{ metadata.entityId }}">
{% if metadata.hasIdPMetadata %}
    <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:KeyDescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" use="signing">
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>{{ metadata.idpCertificate }}</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                                Location="{{ metadata.ssoUrl }}"/>
    </md:IDPSSODescriptor>
{% endif %}
{% if metadata.hasSpMetadata %}
    <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                     Location="{{ metadata.assertionConsumerUrl }}"
                                     index="0"/>
    </md:SPSSODescriptor>
{% endif %}
</md:EntityDescriptor>

<?xml version="1.0" encoding="UTF-8"?>
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="{{ metadata.entityId }}">
{% if metadata.hasIdPMetadata %}
    <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAuthnRequestsSigned="true">
        <md:KeyDescriptor xmlns:ds="http://www.w3.org/2000/09/xmldsig#" use="signing">
            <ds:KeyInfo>
                <ds:X509Data>
                    <ds:X509Certificate>{{ metadata.idpCertificate }}</ds:X509Certificate>
                </ds:X509Data>
            </ds:KeyInfo>
        </md:KeyDescriptor>
        <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
                                Location="{{ metadata.ssoUrl }}"/>
    </md:IDPSSODescriptor>
{% endif %}
{% if metadata.hasSpMetadata %}
    <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
        <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
                                     Location="{{ metadata.assertionConsumerUrl }}"
                                     index="0"/>
    </md:SPSSODescriptor>
{% endif %}
</md:EntityDescriptor>

Add WantAuthnRequestsSigned="true" to the IDPSSODescriptor in the Metadata
Add WantAuthnRequestsSigned="true" to the IDPSSODescriptor in the Metadata

https://www.pivotaltracker.com/story/show/166266929
