Update README.md

README.md

@@ -77,6 +77,13 @@ app.get('/login',
 Additional config values supported:
 * `samlFallback`: if set to `getAuthorizeUrl`, will initiate a redirect to identity provider on authentication failure
 
+### generateServiceProviderMetadata( decryptionCert )
+
+As a convenience, the strategy object exposes a `generateServiceProviderMetadata` method which will generate a service provider metadata document suitable for supplying to an identity provider.  This method will only work on strategies which are configured with a `callbackUrl` (since the relative path for the callback is not sufficient information to generate a complete metadata document).
+
+The `decryptionCert` argument should be a certificate matching the `decryptionPvk` and is required if the strategy is configured with a `decryptionPvk`.
+
+
 ## Security and signatures
 
 Passport-SAML uses the HTTP Redirect Binding for its `AuthnRequest`s, and expects to receive the messages back via the HTTP POST binding.