anchor.diff:              <ds:KeyInfo>
                       <ds:X509Data>
                           <ds:X509Certificate>
  -<%= @backchannel_cert %>
  +<%= @backchannel_cert -%>
                           </ds:X509Certificate>
                       </ds:X509Data>
               </ds:KeyInfo>
  
positive.code: <?xml version="1.0" encoding="UTF-8"?>
  <!--
       This is example metadata only. Do *NOT* supply it as is without review,
       and do *NOT* provide it in real time to your partners.
  
       This metadata is not dynamic - it will not change as your configuration changes.
  -->
  <EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="http://www.w3.org/XML/1998/namespace" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" entityID="<%= @entity_id %>">
  
      <IDPSSODescriptor protocolSupportEnumeration="<% if @saml2 %>urn:oasis:names:tc:SAML:2.0:protocol <% end %>urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
  
negative.code:             <ds:KeyInfo>
                      <ds:X509Data>
                          <ds:X509Certificate>
  <%= @signing_cert -%>
                          </ds:X509Certificate>
                      </ds:X509Data>
              </ds:KeyInfo>
  