From 0bc2383670e133cc76c741e661d89e27eab5ad61 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 30 Jul 2010 10:14:28 +0000
Subject: [PATCH] Shunt the characteristics of the current test aggregate over
 to the main production aggregate, the WAYF aggregate derived from that and
 the export aggregate.

---
 build.xml                    |  17 ++++--
 build/uk_master_export.xsl   |  90 ++++++++++++++++++++++++-----
 build/uk_master_unsigned.xsl | 109 ++++++++++++++++++++++++++++++-----
 3 files changed, 182 insertions(+), 34 deletions(-)

diff --git a/build.xml b/build.xml
index 05935fa6..68e27741 100644
--- a/build.xml
+++ b/build.xml
@@ -414,14 +414,19 @@
 		<echo>Generating unsigned UK metadata files.</echo>
 		<!-- [19] -->
 		<XALAN x="uk_master_unsigned.xsl" i="${uk.master.file}"
-			o="${md.prod.unsigned}" />
+			o="${md.prod.unsigned}" />
+		<MDNORM i="${md.prod.unsigned}"/>
+		
 		<!-- [27] -->
 		<XALAN x="uk_master_test.xsl" i="${uk.master.file}"
 			o="${md.test.unsigned}" />
-		<MDNORM i="${md.test.unsigned}"/>
+		<MDNORM i="${md.test.unsigned}"/>
+		
 		<!-- [29] -->
 		<XALAN x="uk_master_export.xsl" i="${uk.master.file}"
-			o="${md.export.unsigned}" />
+			o="${md.export.unsigned}" />
+		<MDNORM i="${md.export.unsigned}"/>
+		
 		<!-- [31] -->
 		<XALAN x="uk_master_back.xsl" i="${uk.master.file}"
 			o="${md.back.unsigned}" />
@@ -722,7 +727,7 @@
 		<attribute name="i"/>
 		<attribute name="o"/>
 		<sequential>
-			<MDT.SIGN.uk i="@{i}" o="@{o}"/>
+			<XMLSECTOOL.SIGN.uk i="@{i}" o="@{o}"/>
 		</sequential>
 	</macrodef>
 
@@ -740,7 +745,7 @@
 
 		<echo>Signing UK test metadata.</echo>
 		<!-- [28] -->
-		<XMLSECTOOL.SIGN.uk i="${md.test.unsigned}" o="${md.test.signed}"/>
+		<SIGN.uk i="${md.test.unsigned}" o="${md.test.signed}"/>
 
 		<echo>Signing UK export metadata.</echo>
 		<!-- [30] -->
@@ -748,7 +753,7 @@
 
 		<echo>Signing UK fallback metadata.</echo>
 		<!-- [32] -->
-		<SIGN.uk i="${md.back.unsigned}" o="${md.back.signed}"/>
+		<MDT.SIGN.uk i="${md.back.unsigned}" o="${md.back.signed}"/>
 		
 		<echo>Generated signed UK metadata.</echo>
 	</target>
diff --git a/build/uk_master_export.xsl b/build/uk_master_export.xsl
index 624eb7b0..689f01a9 100644
--- a/build/uk_master_export.xsl
+++ b/build/uk_master_export.xsl
@@ -13,8 +13,12 @@
 -->
 <xsl:stylesheet version="1.0"
 	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
-	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+	xmlns:elab="http://eduserv.org.uk/labels"
+	xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
 	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
+	xmlns:shibmeta="urn:mace:shibboleth:metadata:1.0"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xmlns:wayf="http://sdss.ac.uk/2006/06/WAYF"
 	xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
@@ -25,7 +29,7 @@
 	extension-element-prefixes="date exsl mdxDates"
 	
 	xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
-	exclude-result-prefixes="wayf">
+	exclude-result-prefixes="md">
 
 	<!--Force UTF-8 encoding for the output.-->
 	<xsl:output omit-xml-declaration="no" method="xml" encoding="UTF-8" indent="yes"/>
@@ -67,7 +71,7 @@
 		Document element.
 	-->
 	<xsl:template match="/md:EntitiesDescriptor">
-		<xsl:copy>
+		<EntitiesDescriptor>
 			<xsl:attribute name="validUntil">
 				<xsl:value-of select="$validUntil"/>
 			</xsl:attribute>
@@ -77,13 +81,13 @@
 			<xsl:apply-templates select="@*"/>
 			<xsl:call-template name="document.comment"/>
 			<xsl:apply-templates select="node()"/>
-		</xsl:copy>
+		</EntitiesDescriptor>
 	</xsl:template>
 
 	<!--
 		Comment to be added to the top of the document, and just inside the document element.
 	-->
-	<xsl:template name="document.comment">
+	<xsl:template name="document.comment">
 		<xsl:text>&#10;</xsl:text>
 		<xsl:comment>
 			<xsl:text>&#10;&#9;U K   F E D E R A T I O N   M E T A D A T A&#10;</xsl:text>
@@ -100,7 +104,7 @@
 			<xsl:value-of select="$validUntil"/>
 			<xsl:text>&#10;</xsl:text>
 		</xsl:comment>
-		<xsl:text>&#10;</xsl:text>
+		<xsl:text>&#10;</xsl:text>
 	</xsl:template>
 	
 	<!--
@@ -157,13 +161,19 @@
 	</xsl:template>
 	
 	<!--
-		Pass through certain ukfedlabel namespace elements.
+		Normalise and pass through certain ukfedlabel namespace elements.
 	-->
-	<xsl:template match="ukfedlabel:UKFederationMember |
-		ukfedlabel:AccountableUsers">
-		<xsl:copy>
+	
+	<xsl:template match="ukfedlabel:UKFederationMember">
+		<xsl:element name="ukfedlabel:UKFederationMember">
 			<xsl:apply-templates select="node()|@*"/>
-		</xsl:copy>
+		</xsl:element>
+	</xsl:template>
+
+	<xsl:template match="ukfedlabel:AccountableUsers">
+		<xsl:element name="ukfedlabel:AccountableUsers">
+			<xsl:apply-templates select="node()|@*"/>
+		</xsl:element>
 	</xsl:template>
 	
 	<!--
@@ -172,6 +182,42 @@
 	<xsl:template match="ukfedlabel:*">
 		<!-- do nothing -->
 	</xsl:template>
+	
+	<!--
+		Normalise namespace on IdP discovery elements.
+	-->
+	
+	<xsl:template match="idpdisc:DiscoveryResponse">
+		<idpdisc:DiscoveryResponse>
+			<xsl:apply-templates select="node()|@*"/>
+		</idpdisc:DiscoveryResponse>
+	</xsl:template>
+	
+	<!--
+		Normalise namespace on Athens PUID elements.
+	-->
+	
+	<xsl:template match="elab:AthensPUIDAuthority">
+		<elab:AthensPUIDAuthority>
+			<xsl:apply-templates select="node()|@*"/>
+		</elab:AthensPUIDAuthority>
+	</xsl:template>
+	
+	<!--
+		Normalise namespace on Shibboleth metadata elements.
+	-->
+	
+	<xsl:template match="shibmd:Scope">
+		<shibmd:Scope>
+			<xsl:apply-templates select="node()|@*"/>
+		</shibmd:Scope>
+	</xsl:template>
+	
+	<xsl:template match="shibmd:KeyAuthority">
+		<shibmd:KeyAuthority>
+			<xsl:apply-templates select="node()|@*"/>
+		</shibmd:KeyAuthority>
+	</xsl:template>
 	
 	<!--
 		Remove administrative contacts.
@@ -179,9 +225,25 @@
 	<xsl:template match="md:ContactPerson[@contactType='administrative']">
 		<!-- do nothing -->
 	</xsl:template>
-	
-	<!--By default, copy text blocks, comments and attributes unchanged.-->
-	<xsl:template match="text()|comment()|@*">
+	
+	<!--
+		Retain only certain comments.
+	-->
+	
+	<xsl:template match="md:EntityDescriptor/comment()">
+		<xsl:copy/>
+	</xsl:template>
+	
+	<xsl:template match="shibmd:KeyAuthority//comment()">
+		<xsl:copy/>
+	</xsl:template>
+	
+	<!--
+		Strip all other comments.
+	-->
+	
+	<!--By default, copy text blocks and attributes unchanged.-->
+	<xsl:template match="text()|@*">
 		<xsl:copy/>
 	</xsl:template>
 	
diff --git a/build/uk_master_unsigned.xsl b/build/uk_master_unsigned.xsl
index 9180c672..866778a0 100644
--- a/build/uk_master_unsigned.xsl
+++ b/build/uk_master_unsigned.xsl
@@ -11,8 +11,12 @@
 -->
 <xsl:stylesheet version="1.0"
 	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
-	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+	xmlns:elab="http://eduserv.org.uk/labels"
+	xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
 	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
+	xmlns:shibmeta="urn:mace:shibboleth:metadata:1.0"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xmlns:wayf="http://sdss.ac.uk/2006/06/WAYF"
 	xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
@@ -23,7 +27,7 @@
 	extension-element-prefixes="date exsl mdxDates"
 	
 	xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
-	exclude-result-prefixes="wayf">
+	exclude-result-prefixes="md">
 
 	<!--Force UTF-8 encoding for the output.-->
 	<xsl:output omit-xml-declaration="no" method="xml" encoding="UTF-8" indent="yes"/>
@@ -38,7 +42,21 @@
 	
 	<xsl:variable name="now" select="date:date-time()"/>
 	<xsl:variable name="validUntil" select="mdxDates:dateAdd($now, $validityDays)"/>
-	
+	
+	<!--
+		documentID
+		
+		This value is generated from a normalised version of the aggregation instant,
+		transformed so that it can be used as an XML ID value.
+		
+		Strict conformance to the SAML 2.0 metadata specification (section 3.1.2) requires
+		that the signature explicitly references an identifier attribute in the element
+		being signed, in this case the document element.
+	-->
+	<xsl:variable name="normalisedNow" select="mdxDates:dateAdd($now, 0)"/>
+	<xsl:variable name="documentID"
+		select="concat('uk', translate($normalisedNow, ':-', ''))"/>
+
 	<!--
 		Document root.
 	-->
@@ -51,20 +69,24 @@
 		Document element.
 	-->
 	<xsl:template match="/md:EntitiesDescriptor">
-		<xsl:copy>
+		<EntitiesDescriptor>
 			<xsl:attribute name="validUntil">
 				<xsl:value-of select="$validUntil"/>
+			</xsl:attribute>
+			<xsl:attribute name="ID">
+				<xsl:value-of select="$documentID"/>
 			</xsl:attribute>
 			<xsl:apply-templates select="@*"/>
 			<xsl:call-template name="document.comment"/>
 			<xsl:apply-templates select="node()"/>
-		</xsl:copy>
+		</EntitiesDescriptor>
 	</xsl:template>
 
 	<!--
 		Comment to be added to the top of the document, and just inside the document element.
 	-->
-	<xsl:template name="document.comment">
+	<xsl:template name="document.comment">
+		<xsl:text>&#10;</xsl:text>
 		<xsl:comment>
 			<xsl:text>&#10;&#9;U K   F E D E R A T I O N   M E T A D A T A&#10;</xsl:text>
 			<xsl:text>&#10;</xsl:text>
@@ -78,6 +100,7 @@
 			<xsl:value-of select="$validUntil"/>
 			<xsl:text>&#10;</xsl:text>
 		</xsl:comment>
+		<xsl:text>&#10;</xsl:text>
 	</xsl:template>
 	
 	<!--
@@ -103,13 +126,19 @@
 	</xsl:template>
 	
 	<!--
-		Pass through certain ukfedlabel namespace elements.
+		Normalise and pass through certain ukfedlabel namespace elements.
 	-->
-	<xsl:template match="ukfedlabel:UKFederationMember |
-		ukfedlabel:AccountableUsers">
-		<xsl:copy>
+	
+	<xsl:template match="ukfedlabel:UKFederationMember">
+		<xsl:element name="ukfedlabel:UKFederationMember">
 			<xsl:apply-templates select="node()|@*"/>
-		</xsl:copy>
+		</xsl:element>
+	</xsl:template>
+
+	<xsl:template match="ukfedlabel:AccountableUsers">
+		<xsl:element name="ukfedlabel:AccountableUsers">
+			<xsl:apply-templates select="node()|@*"/>
+		</xsl:element>
 	</xsl:template>
 	
 	<!--
@@ -118,6 +147,42 @@
 	<xsl:template match="ukfedlabel:*">
 		<!-- do nothing -->
 	</xsl:template>
+	
+	<!--
+		Normalise namespace on IdP discovery elements.
+	-->
+	
+	<xsl:template match="idpdisc:DiscoveryResponse">
+		<idpdisc:DiscoveryResponse>
+			<xsl:apply-templates select="node()|@*"/>
+		</idpdisc:DiscoveryResponse>
+	</xsl:template>
+	
+	<!--
+		Normalise namespace on Athens PUID elements.
+	-->
+	
+	<xsl:template match="elab:AthensPUIDAuthority">
+		<elab:AthensPUIDAuthority>
+			<xsl:apply-templates select="node()|@*"/>
+		</elab:AthensPUIDAuthority>
+	</xsl:template>
+	
+	<!--
+		Normalise namespace on Shibboleth metadata elements.
+	-->
+	
+	<xsl:template match="shibmd:Scope">
+		<shibmd:Scope>
+			<xsl:apply-templates select="node()|@*"/>
+		</shibmd:Scope>
+	</xsl:template>
+	
+	<xsl:template match="shibmd:KeyAuthority">
+		<shibmd:KeyAuthority>
+			<xsl:apply-templates select="node()|@*"/>
+		</shibmd:KeyAuthority>
+	</xsl:template>
 	
 	<!--
 		Remove administrative contacts.
@@ -125,9 +190,25 @@
 	<xsl:template match="md:ContactPerson[@contactType='administrative']">
 		<!-- do nothing -->
 	</xsl:template>
-	
-	<!--By default, copy text blocks, comments and attributes unchanged.-->
-	<xsl:template match="text()|comment()|@*">
+	
+	<!--
+		Retain only certain comments.
+	-->
+	
+	<xsl:template match="md:EntityDescriptor/comment()">
+		<xsl:copy/>
+	</xsl:template>
+	
+	<xsl:template match="shibmd:KeyAuthority//comment()">
+		<xsl:copy/>
+	</xsl:template>
+	
+	<!--
+		Strip all other comments.
+	-->
+	
+	<!--By default, copy text blocks and attributes unchanged.-->
+	<xsl:template match="text()|@*">
 		<xsl:copy/>
 	</xsl:template>