From 18ffcd56a4cddda5eedd701957949e5fe32f3b84 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Thu, 28 Aug 2014 10:11:07 +0000 Subject: [PATCH 01/56] Add default exclusion rules to the export preview aggregate. ExportOptOut always opts an entity out. ExportOptIn always opts an entity in. If an entity has neither label, it is included in the export preview aggregate unless it falls into one of these categories: * IdPs lacking SAML 2.0 support * aggregated schools sector IdPs * IdPs with Scope elements with regexp="true" --- mdx/common-beans.xml | 6 ++++ mdx/uk/generate.xml | 86 +++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 88 insertions(+), 4 deletions(-) diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml index 37e99e1f..e2dc16df 100644 --- a/mdx/common-beans.xml +++ b/mdx/common-beans.xml @@ -261,6 +261,12 @@ + + + + diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 91b25280..388e3463 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -361,7 +361,7 @@ *************************************** --> - + @@ -479,7 +479,7 @@ Entities in the CDSALL aggregate are restricted to those entities registered by the UK federation plus all identity providers from whatever source. --> - + @@ -674,7 +674,7 @@ - + @@ -731,7 +731,7 @@ *********************************************************** --> - + @@ -740,6 +740,84 @@ p:id="uk_exportPreviewPipeline"> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + https://idp.glowscotland.org.uk/shibboleth + + + + + + + + + + + + From d10270ab0fb50087a0ca66902ed32928e5130b8a Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 8 Sep 2014 14:43:43 +0000 Subject: [PATCH 02/56] Permit entity attributes in fallback aggregate. --- mdx/uk/generate.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 388e3463..98b6f57d 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -569,7 +569,6 @@ - From be5c8bbbab05bad020b9bdc92f6dcc08e81f852c Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 10 Sep 2014 13:13:13 +0000 Subject: [PATCH 03/56] Display export opt outs as well as opt ins. --- mdx/uk/statistics.xsl | 69 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 62 insertions(+), 7 deletions(-) diff --git a/mdx/uk/statistics.xsl b/mdx/uk/statistics.xsl index 195941e2..9c2ab72d 100644 --- a/mdx/uk/statistics.xsl +++ b/mdx/uk/statistics.xsl @@ -138,7 +138,8 @@

  • Members Lacking Deployment

  • Shibboleth 1.3 Remnants

  • Entities with mdui:UIInfo support

    • -

  • Entities in Export Aggregate

    • +

  • Export Aggregate: Entities Opted In

    • +

  • Export Preview Aggregate: Entities Opted Out

  • Entities Without SAML 2.0 Support

    • @@ -1117,14 +1118,14 @@ -

    Entities in Export Aggregate

    +

    Export Aggregate: Entities Opted In

    @@ -1170,6 +1171,60 @@ + + +

    Export Preview Aggregate: Entities Opted Out

    + + + +
      + +
    • + + : + + [IdP] + + + [SP] + + + [RqA] + + + [!RqA] + + + + + + + + + ( + + ) + + + +
        +
      • + No SAML 2.0 support +
        • +
      +       +
      • +       +
    +     + - -

    Entities with mdui:UIInfo support

    - - - -
      - -
    • - - : - - [IdP] - - - [SP] - - - - - - - ( - - ) - - -
      • -       -
    -     - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + MIIDyTCCArGgAwIBAgIJANzhVoorjiDkMA0GCSqGSIb3DQEBCwUAMHsxCzAJBgNV + BAYTAkdCMUMwQQYDVQQKDDpVSyBBY2Nlc3MgTWFuYWdlbWVudCBGZWRlcmF0aW9u + IGZvciBFZHVjYXRpb24gYW5kIFJlc2VhcmNoMScwJQYDVQQDDB5VSyBGZWRlcmF0 + aW9uIER1bW15IFRydXN0IFJvb3QwHhcNMTQwOTExMTExMjQ2WhcNMzcxMjMxMTEx + MjQ2WjB7MQswCQYDVQQGEwJHQjFDMEEGA1UECgw6VUsgQWNjZXNzIE1hbmFnZW1l + bnQgRmVkZXJhdGlvbiBmb3IgRWR1Y2F0aW9uIGFuZCBSZXNlYXJjaDEnMCUGA1UE + AwweVUsgRmVkZXJhdGlvbiBEdW1teSBUcnVzdCBSb290MIIBIjANBgkqhkiG9w0B + AQEFAAOCAQ8AMIIBCgKCAQEAveglhNmpxkFYOK3eDy5klZFRONJOojXnrbNftFQc + 9FLZdKfC2dEj4DoOl34dc0x958NO5xNr2TpVrjbrW0rC2WV0b3J9e1essclcazFy + BECiKyvKBQRlwDQDaO24b5UCSmmdpuEk5bj0PDDArox06xDDEc3xiKH46EX2yrvS + mvQSBPR7l2vJGMbUkL6SkD9K2VbBP6rqoK7FdN/zpV/U5cM3fFcpIZGUfVPkP55P + F+/pUQ9RhL5SZfo5hWgYKecVRimLmK7hIIQ6ykzJwOk95NwuNXFhinZMkjV+ECr4 + uoUNDnBPZdoVy8TxuYVqqs+orQ94yrp/BdKj5paQTZwNZwIDAQABo1AwTjAdBgNV + HQ4EFgQUD2aE2xpdeqknmgnSY+JCXJ4187kwHwYDVR0jBBgwFoAUD2aE2xpdeqkn + mgnSY+JCXJ4187kwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAKjoq + 8ORqQF8W4ZuEMaQsTOJxfgeRHgk1DvY1YzCt0VqMPnvbsMLI2vC1YIGVKEuds6ZA + VxIt+yng7WZOcAmHDdUjUczXRxoYrwJt1QpF+kFCnjHOD+Ra4GjryIIkCHYU5wDp + o8EVbWM5KiwUhkekjBeL/WyIyk3tHLWwr9qz0Idye0w3FczOLqkb4NgXC54miXeS + pLfExLaTc4OvsJy/DYeda8GAars4m3Q7agQxdd+0F3xiKWB60L+xoOQ3xgW4QYwS + uBMMvnRdg8I5SHquBAFXHcXhKeC/onN9J8sZIRD/vUWWasiyMNGQeh4dWcbz7PM6 + h0ok321gwSmdcL+svA== + + + + + + + + + + + + + + + + From ecea7a4878ffa0dfbaf31126ca0e2d7c2eda2a7f Mon Sep 17 00:00:00 2001 From: Ian Young Date: Thu, 11 Sep 2014 11:30:00 +0000 Subject: [PATCH 06/56] Add registrar URI for Japanese GakuNin federation. --- mdx/common-beans.xml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml index e2dc16df..a64deb1f 100644 --- a/mdx/common-beans.xml +++ b/mdx/common-beans.xml @@ -463,6 +463,7 @@ --> + + @@ -1030,6 +1031,7 @@ p:id="trimImportElementWhitespace"> + From b9e5da7306a9e39b411141b358879ecddbf92f9e Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 24 Sep 2014 14:30:50 +0000 Subject: [PATCH 08/56] Include a dummy trust root in the test aggregate. --- mdx/uk/generate.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 98b6f57d..80fc3cbc 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -634,6 +634,7 @@ + From 558b15d647485c951a098b5b176adc6263a59699 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 29 Sep 2014 15:52:51 +0000 Subject: [PATCH 09/56] Bugzilla 1153: remove an entity from Jenkins' courtesy check on AT federation metadata. --- mdx/at_aconet/verbs.xml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/mdx/at_aconet/verbs.xml b/mdx/at_aconet/verbs.xml index f731c821..0a7547ff 100644 --- a/mdx/at_aconet/verbs.xml +++ b/mdx/at_aconet/verbs.xml @@ -92,6 +92,21 @@     + + + + + + https://zididp.uni-graz.at/idp/shibboleth + + + From c83a1ac9a8ab443df3c85502978c25632800a72e Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 21 Oct 2014 10:30:57 +0000 Subject: [PATCH 10/56] Remove dummy trust root from the test aggregate again. --- mdx/uk/generate.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 80fc3cbc..98b6f57d 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -634,7 +634,6 @@ - From 2bbf90d3c9276825dbc0a362b9de5e0b50128c62 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 21 Oct 2014 10:51:49 +0000 Subject: [PATCH 11/56] Simplify by removing almost everything to do with KeyName. --- build/check_embedded.pl | 54 +++-------------------------------------- 1 file changed, 3 insertions(+), 51 deletions(-) diff --git a/build/check_embedded.pl b/build/check_embedded.pl index 8268a246..a0515531 100755 --- a/build/check_embedded.pl +++ b/build/check_embedded.pl @@ -147,14 +147,12 @@ sub comment { # # Output header line. # - $oline = "Entity $entity "; + $oline = "Entity $entity"; $hasKeyName = !($keyname eq '(none)'); + push(@olines, $oline); if ($hasKeyName) { - $oline .= "has KeyName $keyname"; - } else { - $oline .= "has no KeyName"; + error("descriptor has unexpected KeyName $keyname"); } - push(@olines, $oline); # # Start building a new blob. @@ -280,7 +278,6 @@ sub comment { # if ($notAfter =~ /(\d\d\d\d)/) { my $year = $1; - $expiryYear = $year; if ($year > $maxYear) { $maxYear = $year; } @@ -362,14 +359,6 @@ sub comment { } - # - # Check KeyName if one has been supplied. - # - if ($hasKeyName && !defined($names{lc $keyname})) { - my $nameList = join ", ", sort keys %names; - error("KeyName mismatch: $keyname not in {$nameList}"); - } - # # Use openssl to ask whether this matches our trust fabric or not. # @@ -427,25 +416,6 @@ sub comment { } elsif ($clientOK) { # $error = "certificate matches trust fabric; add KeyName?"; } - } else { - # - # If a KeyName is present, we must match the trust fabric. - # - if ($error eq 'self signed certificate') { - $error = 'self signed certificate: remove KeyName?'; - } elsif ($error eq 'unable to get local issuer certificate') { - $error = "non trust fabric issuer: $issuerCN: remove KeyName?"; - } - - # - # KeyName with an expired certificate indicates some kind of misconfiguration. - # Either the KeyDescriptor isn't working, or the expired certificate is still - # in use (in which case the KeyName is superfluous) or a different certificate - # is in use via PKIX (which means we have the wrong one). - # - if ($days < 0) { - error("expired certificate has KeyName; acquire/ensure correct certificate and remove KeyName"); - } } if ($error eq 'certificate has expired' && $days < 0) { @@ -478,13 +448,6 @@ sub comment { warning("issuer '$issuerCN' suspect; verify"); } } - if ($hasKeyName && ($issuerCN =~ /(Global|Veri)Sign/)) { - warning("issuer \"$issuerCN\" to be retired; certificate expires $notAfter; remove KeyName?"); - $issuerMark{$issuerCN} = '*'; - } - if ($hasKeyName && ($expiryYear > 2014)) { - warning("expires $notAfter, which is later than 2014"); - } # # Count issuers. @@ -497,9 +460,6 @@ sub comment { } else { $issuers{$issuerCN}++; } - if ($hasKeyName) { - $knIssuers{$issuerCN}++; - } } # @@ -544,14 +504,6 @@ sub comment { } print "\n"; - print "KeyName certificate issuers:\n"; - foreach $issuer (sort keys %knIssuers) { - my $count = $knIssuers{$issuer}; - my $mark = $issuerMark{$issuer} ? $issuerMark{$issuer}: ' '; - print " $mark $issuer: $count\n"; - } - print "\n"; - my $first = 1; foreach $fingerprint (sort keys %expiry_whitelist) { if ($expiry_whitelist{$fingerprint} eq 'unused') { From 9779aade50a201a7130967472465f0e7119a0be1 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 21 Oct 2014 12:06:29 +0000 Subject: [PATCH 12/56] Tidier display of entity IDs. --- build/check_embedded.pl | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/build/check_embedded.pl b/build/check_embedded.pl index a0515531..3fe5485e 100755 --- a/build/check_embedded.pl +++ b/build/check_embedded.pl @@ -143,6 +143,13 @@ sub comment { @args = split; $entity = $args[1]; $keyname = $args[3]; + + # + # Tidy entity ID if it includes a UK ID as well. + # + if ($entity =~ /^\[(.+)\](.+)$/) { + $entity = $2 . ' (' . $1 . ')'; + } # # Output header line. @@ -439,6 +446,14 @@ sub comment { # close $fh; + #if ($issuer eq $subject) { + # # self-signed + #} elsif ($issuerCN eq 'TERENA SSL CA') { + # # this one we know about + #} else { + # warning("issuer is '$issuerCN'"); + #} + # # Add a warning for certain issuers. # From d189bb52e17cd2eba0cd59b77550dae5b7d79c04 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 21 Oct 2014 13:00:55 +0000 Subject: [PATCH 13/56] Add some more federation registrar URIs. --- mdx/common-beans.xml | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml index 24e66b1a..a3307c98 100644 --- a/mdx/common-beans.xml +++ b/mdx/common-beans.xml @@ -461,9 +461,15 @@ - - + + + + + + + + - - - + + + + + + From 1b5b0d0a427322642cba7bdea636d20c38c26b3b Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 21 Oct 2014 13:32:48 +0000 Subject: [PATCH 14/56] Pull up declarations of some registrar URIs into common-beans so that they only appear once. --- mdx/at_aconet/beans.xml | 9 --------- mdx/cl_cofre/beans.xml | 9 --------- mdx/common-beans.xml | 42 +++++++++++++++++++++++---------------- mdx/fr_renater/beans.xml | 9 --------- mdx/hu_eduid/beans.xml | 9 --------- mdx/ie_edugate/beans.xml | 9 --------- mdx/pl_pionier/beans.xml | 9 --------- mdx/se_swamid/beans.xml | 9 --------- mdx/us_incommon/beans.xml | 12 ----------- 9 files changed, 25 insertions(+), 92 deletions(-) diff --git a/mdx/at_aconet/beans.xml b/mdx/at_aconet/beans.xml index 4fcf3c37..57c1d42d 100644 --- a/mdx/at_aconet/beans.xml +++ b/mdx/at_aconet/beans.xml @@ -73,15 +73,6 @@ - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + - + - + - + - - + + - + - + - + diff --git a/mdx/fr_renater/beans.xml b/mdx/fr_renater/beans.xml index 4a9fbec8..209af1e8 100644 --- a/mdx/fr_renater/beans.xml +++ b/mdx/fr_renater/beans.xml @@ -104,15 +104,6 @@ - - - - - - - - - - - - - - - - - - - - - - - - - + + + + mdui:Logo contains line break + + + - - - - - mdui: - - ' - - ' is not a valid URL: - - - - + + + + + + mdui: + + ' + + ' is not a valid URL: + + + + + - + + + + + + - - - + + - - - - - - - + From 0c37a5b345228967f50a9d26503481ce2a1e85bd Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 12 Nov 2014 09:59:43 +0000 Subject: [PATCH 17/56] Switch over to using the 2014 certificate for verification. This is a nominal change, as the key embedded in the signing certificate has not changed. --- build.xml | 4 ++-- mdx/uk/beans.xml | 2 +- mdx/uk/ukfederation-2012.jks | Bin 1040 -> 0 bytes mdx/uk/ukfederation-2012.pem | 23 ----------------------- 4 files changed, 3 insertions(+), 26 deletions(-) delete mode 100644 mdx/uk/ukfederation-2012.jks delete mode 100644 mdx/uk/ukfederation-2012.pem diff --git a/build.xml b/build.xml index 9dbc2387..1ce4089d 100644 --- a/build.xml +++ b/build.xml @@ -609,7 +609,7 @@ @@ -702,7 +702,7 @@ - + diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml index ef90c323..6d9aa598 100644 --- a/mdx/uk/beans.xml +++ b/mdx/uk/beans.xml @@ -74,7 +74,7 @@ - + diff --git a/mdx/uk/ukfederation-2012.jks b/mdx/uk/ukfederation-2012.jks deleted file mode 100644 index 6f3fff5ae1c48e8af3fa30579621918c9d0d8c08..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1040 zcmezO_TO6u1_mY|W(3nbrP*nzDXB$?C7JnoKtU^iH|r7x)(AaQ14{-5=F=?Ob8?D%KqYTL=qbMfe@ zxvtDbon1mAakE_aZJ)E|?FQ)yD^D#bojJc}%JLsQ%Y_XRJYsa0OtEi0wNX~(K%({P zi!)}PT_$0^P{h4Rl799`27owfTqW!v`MPub;i zuFIfAYr%;c$DQ}ryT}%w*uv!?_*hl;+3l$E)MvFF*H?bZ{&X*^W6HNhRU2b|9K9Q| z)qPDh*R#Z+1vb2$30@idGGAY>7M_!>lcndJ|1o8aZ?AfbMcKCViD#7N9@Y5k`gz^$ z{-UUV(~Df1tn>MeU$e{PYrE`kV9Cx|^K+XYH_uLqO?LcRF{0j2nV1cW=6*U z$YBmlp1?3?WRRKpOl)G?et{KQHoVDOSFxr9O}=>b{SmSF&EadmSDpMRF~?(qedXS@ z-pBr1uq7Szv2WR0d)dnCdf_4ND<7sz$n3u_n$vzi?c7lpsr1X-K6)R%F`p0B4`$&m zvam{IID03v;fkwR)7?4x2P>TW-(>ZuOze1jnYGRNOK&^pv1qQ0hY^$Kb(C+oq5X{c z__UtGQchn@K5oqyPdhESWc|KBCwzjwOR;eGH_ppDuw>5qyRzM1e-(0mR2J@zzqfUf zC({?Nb8%ZIyMJ4`;oZTR??t~fueviy|Mk=Uyi5OIyR1H8&2OKOx|2QmyORCOjH#Qm tj^&h{P`)(bWZp}&%MwLrM0fFjn)@(#{i28nvnni diff --git a/mdx/uk/ukfederation-2012.pem b/mdx/uk/ukfederation-2012.pem deleted file mode 100644 index a1f3a57a..00000000 --- a/mdx/uk/ukfederation-2012.pem +++ /dev/null @@ -1,23 +0,0 @@ ------BEGIN CERTIFICATE----- -MIIDxzCCAq+gAwIBAgIJANixLkdCTNtvMA0GCSqGSIb3DQEBBQUAMHoxCzAJBgNV -BAYTAkdCMUMwQQYDVQQKDDpVSyBBY2Nlc3MgTWFuYWdlbWVudCBGZWRlcmF0aW9u -IGZvciBFZHVjYXRpb24gYW5kIFJlc2VhcmNoMSYwJAYDVQQDDB1VSyBGZWRlcmF0 -aW9uIE1ldGFkYXRhIFNpZ25lcjAeFw0xMjEwMTEwNzA4MThaFw0xNDExMTYwNzA4 -MThaMHoxCzAJBgNVBAYTAkdCMUMwQQYDVQQKDDpVSyBBY2Nlc3MgTWFuYWdlbWVu -dCBGZWRlcmF0aW9uIGZvciBFZHVjYXRpb24gYW5kIFJlc2VhcmNoMSYwJAYDVQQD -DB1VSyBGZWRlcmF0aW9uIE1ldGFkYXRhIFNpZ25lcjCCASIwDQYJKoZIhvcNAQEB -BQADggEPADCCAQoCggEBAOqtfMvCmBuQudC4/jZFPYkHDNHFyp1FA3KJihIUXppF -vrecrO2wG5CpyqB1mZ+MlKf4jKcTMGBIXC2klD+FyrEdJMBhO6vRmJnNphg3uNZM -ks0NqIaZmtgc7e8435nMhqLHV95UK2oCLcT4gZrTaXa2vt9kukTOijB0KqDIfEG5 -369EHXPItApAEeMlHebbWndl5n2I16nya/LeaoiU9qJ6sVz4xd1UtUesewrmYVKg -PA2JYEpovmnr13sTnGssai5Db/FkrE2NJ4Q4drbPYcwincUo/UXzrtuPclr+l3JE -gjtvDzPrBxxvK0S/gARrbKz5tk4LDLkYsj4PKlwVS+UCAwEAAaNQME4wHQYDVR0O -BBYEFE9HhBuMxrzBYOj1Kj/3gtzAgtUEMB8GA1UdIwQYMBaAFE9HhBuMxrzBYOj1 -Kj/3gtzAgtUEMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggEBAByZ5haR -hr8QqCo8DWO1qgVkUpPR1e/EFl+zV633esn5GJxIkD95va1Lxv84BmLBTD+EtX3T -OkrXccIL1PCUkGmP3xVsh99mzsVEGmfTC0wu8PYDz1UvUwQLcjg6YQDN3GmA1EUW -gt2cL8F4Q4/saowkkYjt0wWGQ/SNhwnGWwpo4ViTnoh3sNgr5gPHlozDGkL1NPG1 -bxdmyxmkr778yExS9xoEC4+Bnm7ApJyv3R2L9fpxCfEjE4tf3rWiSQL0Ss5etZNH -9qmw7sGZ7xX0g6rcki/r5Y9u0v/rRKvIOw8/YGW5B2P3Ij/paJWzasZsdsgj0pDJ -buk20xhyzBW6D/I= ------END CERTIFICATE----- From 2855ed2ebc71758650de56758e10ed540d9bc596 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 12 Nov 2014 14:06:22 +0000 Subject: [PATCH 18/56] Add REFEDS "Hide from Discovery" entity category to IdPs marked with HideFromWAYF. --- mdx/uk/add_hide_category.xsl | 66 ++++++++++++++++++++++++++++++++++++ mdx/uk/beans.xml | 12 +++++++ mdx/uk/check_uk_mdattr.xsl | 1 + 3 files changed, 79 insertions(+) create mode 100644 mdx/uk/add_hide_category.xsl diff --git a/mdx/uk/add_hide_category.xsl b/mdx/uk/add_hide_category.xsl new file mode 100644 index 00000000..164ffd88 --- /dev/null +++ b/mdx/uk/add_hide_category.xsl @@ -0,0 +1,66 @@ + + + + + + + + + + + + + + + + http://macedir.org/entity-category + urn:oasis:names:tc:SAML:2.0:attrname-format:uri + + + + http://refeds.org/category/hide-from-discovery + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml index 6d9aa598..24e8febf 100644 --- a/mdx/uk/beans.xml +++ b/mdx/uk/beans.xml @@ -458,6 +458,18 @@ + + + + + + + + + diff --git a/mdx/uk/check_uk_mdattr.xsl b/mdx/uk/check_uk_mdattr.xsl index 47a257bc..df524d4f 100644 --- a/mdx/uk/check_uk_mdattr.xsl +++ b/mdx/uk/check_uk_mdattr.xsl @@ -77,6 +77,7 @@ --> From 20d53211282502b07fc8fdd855e07248098b8342 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 12 Nov 2014 15:45:57 +0000 Subject: [PATCH 19/56] Add HideFromWAYF marker to IdPs marked as members of the REFEDS "Hide from Discovery" entity category. --- mdx/uk/add_hide_element.xsl | 50 +++++++++++++++++++++++++++++++++++++ mdx/uk/generate.xml | 12 +++++++++ 2 files changed, 62 insertions(+) create mode 100644 mdx/uk/add_hide_element.xsl diff --git a/mdx/uk/add_hide_element.xsl b/mdx/uk/add_hide_element.xsl new file mode 100644 index 00000000..2b8010b6 --- /dev/null +++ b/mdx/uk/add_hide_element.xsl @@ -0,0 +1,50 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index e4e7531e..06b09848 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -239,6 +239,18 @@ + + + + + + + + + (Q;Jd~AEcsFRI`iT$ruv*;$l35-@G)u6kvYC}&0kVqZxYBsq9+&o%uwf> z+Fy6rqkbARwZvExXV*|1V=-AxTL?6VkUxc#{J6(Z(`LL=S4m?`ce~mA;fk-#g(GqX zK7=^YFHtd~hK|xQ1GUZU&cU}I2a#${2~Ht5Vvt@|;!FCCjyf32Dedx!c8NpHghTBn zzOUBsM!z|Qk3V=`tURk`5xRj8K1edOVOAv@oO%6yccFzhkrMo6r07EngLJ&X-WcG* z=JxM4ACwKqRIus#sz>Y+Vq4>OfBs~CJ8tGo`{u)&qOm?exN1ZRR?R(d^%Uz*gT3{`bqEG}mjgzQ z$Usmqq7A{P5q&OQnycAfzkPsK2z#XffB?Eo5Wv7u41x)~I%-X1Ug^-(c-k@KWbC)z z+nW@=)=IG;kx1K33N8&yuXrjBq_M4C7ZMTs&a729$llN)QR@AQ&+Pgu&Kg2>>#deZ z>NocYH)*y(ob;lC#J(P`JCn_U1MEE~Lvbv}Z=Ym|??~9vLaQIm9vj@y@c1hL)$~Bs z2*)!{F+vQOI5;0BvPQ>|bt<~!Es?*;!{XGE&E1Y5-*K{0MJ@U7be8E-64UY`;FPbp z-0$3f{^RyX?WLXoE}_DG4O_x0d&IN$UEXJZ3R%WFOQ3ReOnFF1>W11T4*bqObwgLs zXV%{%<8Ry-E!2gG%hnHqZeYr#{3uMVC33oD&qPNgM(k7hi3kf1myzJPZlvN~#E)^$ zsV>>OWE;W(hFxJ;U;KscGbEl`91BbdIT7Go0 z@*C&v@i!WnGbt99#4}I4&g=U2THsO`&-dvLtftWB?R`es#%y*qpGrIHuX&rt>)maW z)#XQ|T^0^zo+Q?tcDCZx^jT@aQq`Zyi5oW6uzI}d#!qy`aZ*|tS^h2 zPA$4G@I$o(gBw&XydlOHYbVQRw>xZHy+I~w_@vONFh{0srKn1G*sY-~d{-yc#fN|V z!a`AH;INoL%M^>GAFpT9=1}mvzg5m>+8^jDa=Ez6KRT{rwRr5C0s6A#F%wayg;GH0 zO8(&6K5Qk)ZLQYjd13`A=R@Uz_fiZj^rzCjt@{>eJK-wbtzd&!K8jbaA`mJGigrQY zIF8~8c;!i~sT{Vir@vC=b>(ZN8IU}o3O&0RiqcNg4w_L8?YtWxi6RF<6Gah%^*^qI zlSd#+^rQg<4O4<3WfIn5rmP|B_d;{s zrP;J{Xf`YG`Db=9`o}R}D}49`?W4qr27n{~cNELJgf62A4}o#3+&jX*YRKy+Xu@1t z8-MseLi|&ja6j1dMOu_TGsv}OxieV+o0YsDZABRo05JTI zCZl<0vcfg_9bu!ZUa=l+)lJ%}8vhac^zR6T*2ST{>8=YR8Q#)t`@p5)J+%F?i9_ek z|BC{4|8v0!{Qms{Y+4tAp7Tjs^vVe6Iw6I#GDRSHQ2(A={|TXi>^~Ruc>E|WKn^^= z!OrsM`wk{=@FFAWc13V>WB0!=-wMrsXM$$e_YO(78)i*q%2uNmWJ%hZ;T}ssp)24lOjuEM5RQE z>_%BC%D!eq$P)dHd#hj1f1YRN{mePv^Sm4{{_KehC$G=0Mrjh@R~l6 zLzIr4I;y79u~A2|0Gc}P2;d*a?J>Yp{(_&I{GVW|2;5C`U?&PRrcr_bPoo9{trRFs z%M8xYut0`Y8eIsqX%GLB9D<;h_6Rq1z7JUBJL64y05}GKd^agSwv(=60{|WBt>y!BvzWoU zTl?`RPgx@kkz0HWpo|K87<`@XMl zwFqCA@+_6!R7)}h)6smPrMbB@`|J@nE%VVdk{fX_ z7Mt0NW6;oOd!_g>ij?{m$MMZq_Dyr%EsZj~ld&Fah2OY0`}|N8|AF)Q({{Y`9{urN z{PV4ojK1MgIVmcdZ!Be-&Yo9i!qE3UjCyu8D(dh#LPqh+=FUaO!R3t(J+<;IQtn)d;%OV%ArEl$0XL zqB+wdl?7uxIl_@EEQp1J4lda}^5 zL?oZx3gUWN{j2wBMO&AXDU9vx27+O2%{&iAHR2dAIdHbNK4_1Q;$nD-A`I2~rj;r- z?81omv9h6)vNBTQ-W-a>22P65WF#k)cz@F(89on}B4T|~pNWx)?j)&Z8!oqrm*9rkx;^%Gq8f0cTrCw<_At;|&VuB;=-HSUGu#8hWNnZ?MkJBgzVL|2g?IRAee z9D59$djm4Ns+y06_gBi?FO_?I+ielOUoZ5r4~oOcltokK9I3c2%x>V~E!Olx;sexiy!`BkB}bJUR`%j+T9C^ z+UB?+od-?2XHV=wlVW*#JSw~-LQI+pR!!=M%1!*V4k_jgEUHZ}+-!>Q>pfoKQjcGb z)_!6*kA0#N5PpE`UxGY3>Sval<(P|ZleI8X@8_Mk!d2U*gHz_Xkt=?d_3z#`dy9P2 zN#{+_vMo*bDIe2R0voG8p;}I}guZT}ljNjW`Iu)vne91c706gzaN>HuV3q07bzS8f z-epBf=QX08#4)a7mlr&FM<=uLJg+3-rz8qlhuTIFg&ztHy6g*zyLpo)>q|;*b1Sc{ zt(8PY+|T}SNw=q=ET-+=;+)Z3zjjS{TE@7ij-)AhPNE0hZ~E5Ysw>jM!{cjtm>e3d z*g07d+URBd$-KbgQGaN5VLT@Mt!3DqWP{gJt^3MGg2W8(G*Em&5K^z4bV+M}(TBS>JP~%!Tqc@+6ok2W@^eBsdoE}LbfP3P&34M#C102kG0%_Uh^8Z6rV_(gb8o_XyuG1|W&PYA&~ zSdv#GLw>ixn$GK``<#%dpLwoET3I!awfyLnr@o9c;2|%6D{p^du{?RpaSV^q^V3fc zON&%By4WHtr$+8w7RnveKRuu0{vdyY6`4 zkj9am!8$SGA%kxxDl^0jusqN4ZVFNS%^lzpe}qj=Ly*noH|oak*luo=5iJt}L!~&= zq}2P0>Fk=!^lyakYs`3skyp4 zv=$=LZD8D$*kP)5k;GjpblY3fNW-zYG`G^ijIUYs$zg*BN%Z$bU6mrHd3bLg8|8hq zMgObRGXc~RM$*YphHFi5RtH>7j^%W)L$!v#R1mH@+Le#ss`LG630$TN>e}GS7Sx%- zuv0h>G$L`HGyuT0T|8C))Std3B+0rrfQF9Rn}A(?Xb3j@4nv^bZ@?59w5I=2jr|1} z-)}~P1PA&p@b`np1O#lyrc3ix*C!?#YeJlGl7@y&Tc3B!+asK>THnINhUjzb;{1Wg zKH`@~RJeQ^1a?srQb zy>u7%t}?hRC=!XePl{eo;X9QYg|DextSUD#LWN`#w6%25=IV_seK%Ech>@P;+}?rf zojVdv0$kx{XlNn&Fbx;<4kVdlx}LmDquvKwtw zV)Io8E-<5po5>5lL)9Lx&m1?$=n}-bnbq>${l$9{xl*GqxLb^eO(oQ6vi$IMNfJm5 z$8d{viqRK;yx2Qtr&oFJ)$NXvB;kZeOnu_xXdK>-bU-RTtMa=e?`q}%s+*CX*QKak zcY5-5I{A&St=w_H%vSGvE*Ur{r&>YPd8NjGe;N$|Taw#|$l7L-T&iK92-b&8W%i{qYB_&*_^pI7Ag zl6a}z>izZf@uw{w*gfMe!DT85l-huI@2k(>NO1IxA*!-gH2#==?DZ!7xv4DD)l$BW zUahvFFW8C_CdybZDSdZWbiheK_@#x1r(4n~!-pYf%09ieZu)0{g#Rc`$3$(81vefC zgC(CGB&6HT6_l(LR30fQJXBITfn(v={;!}iERB(q?r7^IsdkaNl!rmZp@Y!l>NTXi z(_MpihO~EH6mWb<4g%D$A_SOW*mZ4K7qYw^J_>=r2nGVL5eo=jj+p*(@qu!q@Dxs? zW{|aNG!O!XF;@uE#@v~y@9*=(1aupyIKc}Fjl=D?#7tVx=IUF@?k#LmJR%B&|8W%mUZcYJ}< zK+nO6rOd&rGgBNPu{Y%`ygJ1M0+D$a2(He%L$ES`4g$xo_B(y}pQaaV`wGV^F7VL~ zr2lS!aSI|s)ce&+kWGl$-k-?ZZM(vM4nz3_9;nMoUz+jk z-xHQC?gO!lf>0v3MLycZ~KKxMo_+H4`}uk zI&FHo`x7#dn6f_fBX0)Fl3rM3B_FdTiYW$_q1MOB!80d$n#{U6&Rgtg& From 6029f5e8a7c73f62765067bd237330f6318303df Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 17 Nov 2014 15:09:02 +0000 Subject: [PATCH 21/56] Apply the same rules to generate the export aggregate as we have been using for the export preview aggregate. --- mdx/uk/generate.xml | 79 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 78 insertions(+), 1 deletion(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 06b09848..d346dc5b 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -689,7 +689,7 @@ - + @@ -706,6 +706,83 @@ p:id="uk_exportPipeline"> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + https://idp.glowscotland.org.uk/shibboleth + + + + + + + + + + + + From e949cf897c91c4aede73448f3a2c968ed384a6fb Mon Sep 17 00:00:00 2001 From: Ian Young Date: Fri, 21 Nov 2014 14:51:19 +0000 Subject: [PATCH 22/56] Disable InCommon pilot import pipeline now that all entities involved are available through eduGAIN. --- mdx/uk/generate.xml | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index d346dc5b..666fa9a4 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -26,7 +26,6 @@ - @@ -298,23 +297,6 @@ - - - - - - - - - - - - - - - + From 2337c2a08268426074fbcc603dbd52895659b0f8 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Fri, 21 Nov 2014 15:46:46 +0000 Subject: [PATCH 23/56] Simplify by removing the member/non-member owner distinction, now that all owners are members. --- mdx/uk/statistics.xsl | 34 ++-------------------------------- 1 file changed, 2 insertions(+), 32 deletions(-) diff --git a/mdx/uk/statistics.xsl b/mdx/uk/statistics.xsl index ef784dab..422023f1 100644 --- a/mdx/uk/statistics.xsl +++ b/mdx/uk/statistics.xsl @@ -42,20 +42,12 @@ - - - - - - - @@ -404,28 +396,6 @@ -

    Additional Non-member Entity Owners

    -

    - In addition, the UK federation operator maintains agreements with certain - other organisations so that metadata for entities belonging to those - organisations can be published within the UK federation metadata for the - benefit of UK federation members. -

    -

    Number of non-member relationships:

    - - - - - - - - - - - - -
    Non-member agreementEntitiesIdPsSPsOSrcScope
    - -

    Export Aggregate: Entities Opted In

    - - - +

    Export Aggregate: Entities Opted Out

    + + +
      - +
    • : @@ -1102,19 +1102,19 @@ -

      Export Preview Aggregate: Entities Opted Out

      - - - +

      Export Aggregate: Entities Explicitly Opted In

      + + +
        - +
      • : From 511f73260576b477236ec2e869efb10e8a4fd153 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 9 Dec 2014 18:18:08 +0000 Subject: [PATCH 25/56] Override timeouts on HTTP fetches. Resolves #1 from GitHub. --- mdx/common-beans.xml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml index 669ca938..4f0cbf0b 100644 --- a/mdx/common-beans.xml +++ b/mdx/common-beans.xml @@ -836,10 +836,22 @@ httpClientBuilder Factory for the httpClient bean below. + + Sets the option to ignore validation of a server's TLS credentials. + + Sets socket and connection timeouts explicitly (to 100s) to + override the tight defaults in java-support, see: + + https://github.com/ukf/ukf-meta/issues/1 + https://issues.shibboleth.net/jira/browse/JSPT-48 + + These options can be removed once the underlying issue has been resolved. --> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - From 81d42be85047a2ac9f1d841e6ed14f447bec7c68 Mon Sep 17 00:00:00 2001 From: Alex Stuart Date: Mon, 15 Dec 2014 08:32:02 +0000 Subject: [PATCH 27/56] Increased metadata validity interval to 21 days for the Christmas and New Year holiday period. --- mdx/uk/final_tweak.xsl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdx/uk/final_tweak.xsl b/mdx/uk/final_tweak.xsl index f27f7e9a..86e4e700 100644 --- a/mdx/uk/final_tweak.xsl +++ b/mdx/uk/final_tweak.xsl @@ -44,7 +44,7 @@ This parameter determines the number of days between the aggregation instant and the end of validity of the signed metadata. --> - + From 6019b4ebc250bca5b4b1af48cc0a253bea95e000 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 15 Dec 2014 11:34:23 +0000 Subject: [PATCH 28/56] Pivot to make hide from discovery entity category primary. We still use the legacy marker in fragment files, but all decisions are made on the basis of the entity category. --- mdx/uk/generate.xml | 13 ++++++++++++- mdx/uk/statistics.xsl | 33 ++++++++++++++++++++++++--------- 2 files changed, 36 insertions(+), 10 deletions(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 666fa9a4..f7c586d7 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -358,8 +358,19 @@ *************************************** --> + - + diff --git a/mdx/uk/statistics.xsl b/mdx/uk/statistics.xsl index d58a0d1c..a5909989 100644 --- a/mdx/uk/statistics.xsl +++ b/mdx/uk/statistics.xsl @@ -15,17 +15,18 @@ xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" + xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" + xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:members="http://ukfederation.org.uk/2007/01/members" - xmlns:wayf="http://sdss.ac.uk/2006/06/WAYF" xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label" xmlns:math="http://exslt.org/math" xmlns:date="http://exslt.org/dates-and-times" xmlns:dyn="http://exslt.org/dynamic" xmlns:set="http://exslt.org/sets" xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol" - exclude-result-prefixes="xsl alg ds init md mdui xsi members wayf ukfedlabel math date dyn set idpdisc" + exclude-result-prefixes="xsl alg ds init md mdattr mdui saml xsi members ukfedlabel math date dyn set idpdisc" version="1.0"> @@ -72,9 +73,6 @@ - - @@ -547,10 +545,18 @@

        Of these:

        • -

          Hidden from main WAYF: + +

          Hidden from main CDS: ().

        • +

          Asserting user accountability: ().

          • @@ -614,7 +620,10 @@
        • : - [H] + [H]
          • @@ -952,7 +961,10 @@

            + [not(md:Extensions/mdattr:EntityAttributes/saml:Attribute + [@Name = 'http://macedir.org/entity-category'] + [@NameFormat = 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri'] + [saml:AttributeValue[.='http://refeds.org/category/hide-from-discovery']])]">
          • : @@ -1322,7 +1334,10 @@ : [not-M] [IdP] - [H] + [H] [SP] [UIInfo] From 4053e53a21b2805328101821a0718eb7ef80bd4b Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 15 Dec 2014 11:49:30 +0000 Subject: [PATCH 29/56] Remove a couple of redundant stages. We have removed all KeyName elements from UK federation metadata, so we no longer need to explicitly strip them on export. --- mdx/uk/generate.xml | 2 -- 1 file changed, 2 deletions(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index f7c586d7..17adf851 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -784,7 +784,6 @@ - @@ -910,7 +909,6 @@ - From 1fd204cfcbef0603632919cea7a46f16907f5a7a Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 15 Dec 2014 12:25:33 +0000 Subject: [PATCH 30/56] Remove HideFromWAYF element and wayf namespace from test aggregate. --- mdx/uk/generate.xml | 1 + mdx/uk/ns_norm_test.xsl | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 17adf851..a31c63fc 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -641,6 +641,7 @@ + diff --git a/mdx/uk/ns_norm_test.xsl b/mdx/uk/ns_norm_test.xsl index 536de548..0b30b813 100644 --- a/mdx/uk/ns_norm_test.xsl +++ b/mdx/uk/ns_norm_test.xsl @@ -39,7 +39,7 @@ xmlns:wayf="http://sdss.ac.uk/2006/06/WAYF" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" - exclude-result-prefixes="alg md mdattr saml xenc" + exclude-result-prefixes="alg md mdattr saml wayf xenc" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"> From 1a75f3f288a2d2e6d2e31d45bfa8f253afe2bca9 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 15 Dec 2014 15:13:29 +0000 Subject: [PATCH 31/56] Hoist mdattr and saml namespace prefixes in the test aggregate. --- mdx/uk/ns_norm_test.xsl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdx/uk/ns_norm_test.xsl b/mdx/uk/ns_norm_test.xsl index 0b30b813..23b6bdac 100644 --- a/mdx/uk/ns_norm_test.xsl +++ b/mdx/uk/ns_norm_test.xsl @@ -39,7 +39,7 @@ xmlns:wayf="http://sdss.ac.uk/2006/06/WAYF" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" - exclude-result-prefixes="alg md mdattr saml wayf xenc" + exclude-result-prefixes="alg md wayf xenc" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"> From 02f70b86fbdaf87daf8bd4505dd87d65c3e8aa43 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 16 Dec 2014 12:07:20 +0000 Subject: [PATCH 32/56] Remove md:RoleDescriptor elements from imported metadata. These elements require additional schema definitions to be useful, and if those are not present at consuming entities schema validation errors will occur. We therefore strip them out entirely. This will mainly affect ADFS entities, but won't immediately allow those to be accepted as they also tend to have invalid AssertionConsumerService bindings. --- mdx/clean-import.xsl | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mdx/clean-import.xsl b/mdx/clean-import.xsl index f1a0095c..17a112a5 100644 --- a/mdx/clean-import.xsl +++ b/mdx/clean-import.xsl @@ -22,6 +22,9 @@ + + + From 95446e3efde97ed9e0ba3698d35a53bffc5a12e0 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Fri, 16 Jan 2015 15:35:54 +0000 Subject: [PATCH 33/56] Permit REFEDS R&S category support on UKf-registered entities. --- mdx/uk/check_uk_mdattr.xsl | 1 + 1 file changed, 1 insertion(+) diff --git a/mdx/uk/check_uk_mdattr.xsl b/mdx/uk/check_uk_mdattr.xsl index df524d4f..a8a0dbcd 100644 --- a/mdx/uk/check_uk_mdattr.xsl +++ b/mdx/uk/check_uk_mdattr.xsl @@ -93,6 +93,7 @@ --> From adbe5102a4a6db15be8a5b45530c9c65c9705370 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Thu, 22 Jan 2015 17:02:14 +0000 Subject: [PATCH 34/56] Validate cryptographic algorithms in metadata. Covers EncryptionMethod, SigningMethod and DigestMethod elements. --- mdx/_rules/check_uk_algorithms.xsl | 195 +++++++++++++++++++++++++++++ mdx/validation-beans.xml | 13 ++ 2 files changed, 208 insertions(+) create mode 100644 mdx/_rules/check_uk_algorithms.xsl diff --git a/mdx/_rules/check_uk_algorithms.xsl b/mdx/_rules/check_uk_algorithms.xsl new file mode 100644 index 00000000..10db2ce2 --- /dev/null +++ b/mdx/_rules/check_uk_algorithms.xsl @@ -0,0 +1,195 @@ + + + + + + + + + + + + + + insecure algorithm in SigningMethod: ' + + ' + + + + + + + + + + + + + + unknown algorithm in SigningMethod: ' + + ' + + + + + + + + + + + insecure algorithm in DigestMethod: ' + + ' + + + + + + + + + + + + + + unknown algorithm in DigestMethod: ' + + ' + + + + + + + + + + + insecure algorithm in EncryptionMethod: ' + + ' + + + + + + + + + + + + + + unknown algorithm in EncryptionMethod: ' + + ' + + + + + diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml index c6b9b4d4..294a2836 100644 --- a/mdx/validation-beans.xml +++ b/mdx/validation-beans.xml @@ -652,6 +652,18 @@ ******************************************************************* --> + + + + + + + + + @@ -804,6 +816,7 @@ + From 442c8705cc1f2a0e37e835ecd50e3e17cf58b9ce Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 26 Jan 2015 10:12:30 +0000 Subject: [PATCH 35/56] Update to ukf-mda 0.8.6 to get access to EntityAttributeAddingStage. --- .../{ukf-mda-0.8.5.jar => ukf-mda-0.8.6.jar} | Bin 63151 -> 78674 bytes 1 file changed, 0 insertions(+), 0 deletions(-) rename tools/ukf-mda/{ukf-mda-0.8.5.jar => ukf-mda-0.8.6.jar} (63%) diff --git a/tools/ukf-mda/ukf-mda-0.8.5.jar b/tools/ukf-mda/ukf-mda-0.8.6.jar similarity index 63% rename from tools/ukf-mda/ukf-mda-0.8.5.jar rename to tools/ukf-mda/ukf-mda-0.8.6.jar index c3892cf21bed3a1affcef2ec974a0609b6d85409..10840649fc46966aca2d3f3136a29b9d6d631e8c 100644 GIT binary patch delta 22688 zcmZU)190Tuw*DR4wrx9^*tTukNl$FswrzGY@q`oGn3xm3^SkHV_ug~=UDdr;b*xvjBWnds6H&7rT@*pXsN5n16;M-vTmDGX?H3ajoXc?&k@?TLB z20G|}?IbB=g%tn?0m1wGUm5?|Ndypca&$MbakOxyU}ZA1H*s@|)6i2}6vp^WHw>mE z!RpQR*_`d$pFjKy>W?W|_j@c_7MC%VGP zT$27ZXaN3p+u@aEuXQ$ugy9K(q z7mm;JeMmo1wK97wL>NW2R?3Odh_m+e(ryoCRBRIfV(c6SxgahX*G>b?3-8a zdiVt|LUH1Bz3vKM&dP6`{Cj}7+IV9&3r*N`dnXxucubT6n`h4cP<|0E)CLnjNSJdO zI{cqk{Lgqjq6|bkO7(jCM9=!Z9t>>$uLQZcq#s=;NeElz+HT+(wjZhV+ZaX4i>j|C z@+p)43{M~1`#mICa=1SE@lE?ulUVolS4(q_Oc`yk9^Q)U`NSxB5~u*jm-r~u*lh3b zHsL@&+*$F|9%TduD^n;=^p;F^)`SQsqAcw}GjJvOr6y}rnI4@VYUr~!xh4WCK^_m7 zwo=1tK$iE2{kvCu6Sbmi3ikMf_0|Jr-Bbc(i34z;v=RsYgu?2XHf*1qkio|aI&31qUN~{JQX1MKw+s>tmQQ@4^6hcW@J|4N?xEdlpnf^9KM@v6p zTM@Y*+DD(5kfh(9d!s#NrGCwRzzK)ZsZQiTTw8s=3ZukHjw8~1rk4haCsEM6AORot zu)76`IuE(wTXd}>c6VBLQhq)coM2AY!5N{rp*`uRReNII z3qnXa-k93$Bywk}FS%}zwCf8CXJM!6( zy&9eU16@kNdkMi#IVS3bJYPyc&p^Pl-`nfKNrn?hc~kO`Nv!2uoImvsW#t~1Hk`c7 z!P4P!4tcA@AJ%y6(T1ukfQ(;P(cv}c&I&*eL}{k2UxvEoDB;63HF z^kTH7<*?_}2L4b2+8!z|%`U4NH+cCMe9sV2gjX@zFfCW_5>l9nv=9a0W3^=CA4%=u zgZ@j|5=$4LtDWRTnh-Vk_PBZy=?r5{s|i0=$hc$*eLCjsax3mI;6A<*_6(aGk20l- z?^!x{&(u7rbj`h~q0T0}zI+l(SVgBEm!snY5H;QAoQ!LTRO+-cQoYqkTcFfAW;cwz zU7K1@+$~x~KsRu7{o)sL9V9uL#^y}0kf`GVK8x{euMu}82pCI)(Qq-$j^Ajs@DO>y zuP-aXmh#vfc0lw3xKHob$0v&(vo!4G$G>?O9*`2TBG4d)11)}O-wG}`a~Ix(jSaH# z5tY=Mf!_1cX`Ay9(?(6cqLm4lTCqI5-@t&TU{R zK)OyHctrE$yeZlEZ44e7XuQPenL9W(%#9&cu43mB=x_4o!8B$S!+k{NNZis07TQJM8QEDA13 z2s8%o(@;JQOlfIU61t|IThvWHs|goxe@-YN5MnqJtJ9H0{HxoQkE`4Jw?{+}cAjaH zS>s@qR9Qx&HWe6ml~z3y1IqPFcv@G$g56ZHrYenIOqm5UXG#us(@B7)=UrS;_UbIN z-!M#t5~H8NVvFO$`do>7GnJC#kbOV|Ck*wdWd8&*saJ7l$8;U5iD-Xw9sQXmzG&u^ zrI7?h2<@;(gWk{XF>G0zdQBmBmB%RO_XfWH17U_Zdpx)k!cmQ3>G~0%uUMJ56wh@V zyM(Yb2_6#4lQGKqhq6L)VyViNKbX!*1Pc;tL}c793E>Cme;(w=aMO()EC|Q|E(i$y z|2fEi9om-mn;X6s=4XBD)8xV{Dy0iqg+uP{E2*4@VXH@SxeH;1M>UVl?`{f#VcqrB zoYSyYTYJN!U)VN2SnJ{3t)W_^Hl`Kza`35K%0xf}mca!1pdi3^;!I)QlPh0~sXOhI zX?L7=;8u^WVh>sKyl}2zXa#|%4nsR zJs_>4(8NrI_jyIY>LJhyOgm)O^*$51;NW)l?UpAWW>+Q`X&3&5jN3@{_6VduxS{$b zJG$X*K3GlQ03THRRvkp?AgA{Mq310<+Ucz+Xe;c7(6Rqw>=|$q8-4vY?|ASU6x|Z& zzQ%l_E>N@IJ2=_z!k+e9fof)YH8E|4(ac^|7=PS6*562$86!3r1Om(t8VM1R__D{0 zq+iNds@Iz=eI{WvnmQg=CL}#;O`aid$!x-&Z#iQ|yITfooepP*6opTHTHA6RhZX+V zdh&F}yg9v9xE`RpKlbSN7?pX2^aH9TOP)2YIPBBg304f4|Jm2)H5QS8gm866On?P5 zS=N-Aj~kQ3eJ3M#4l6&jz`h)rPlpFqoy4{v`2$Ux&{1whiSp3eJ&>Y1WWh6>xEJ9V28^!WIr)%(FoGO?CAB98Sd8@ z_G%d|6^{WPqV44^c2U+U@Zp^H^3DPtOhuWL-&PLq#1#fNCPE&?((`$mjAnU7e-V~^ zT(`Jvt>G#qCN$Z5GFXgM=1|d<_zp!9PUFk4i;P)IY5gLl9q%5qN7uFh((78%aT(tx zGXS&}yVGz^3|2dP^@5JWHUzSAHqP@cw61Gu_UZwIbWDjLV#nH&9nn5)oZY=3a%x1w! z+rkYxWq^*3ug=22I?wCIa3cGaMsWVBZ5qJJNjuqPa?%P*Tnt`55P`XfOxvdH8{({) zIFP}x@M61R&oQ?0r6?Tx7Hx|XFEEsNk+5cu+FJxT^+Jo8i7Bpm8y&9YBD4EieMmxI z=2y;LutNQ(dH#l7e<5*bR-^aFQ{WJ@4q{(toNPT>!*&;3$G3u6w5E;&LV zPMv`X&($+8B|fb!qB8!X*4rO1S2WdSlB_3CpIN#xM7;^yd{5>ZiQ`Wk%~}@6_;^dT za89P7taKX;(*?_-%qfd|O?$Gu>=-}{sb3@pK0AZW+#g}C4J;z9C-o}XyR3SOnLGoz zr6LF~Wz9)hNg=Ge*5}CMHl_^6F5mGZ)f5ZNF0=2PH>w__#_BnBbYHTSd=m9WR5S3c zTEjX~er7iEpIp?uHg*c8SNT-01}2#BtHJ}f&`J@0LFbgxr zPE_upkesS(5n!;Bh@!%s%$m)1x85PnQ45=%h@x%G56_GQ&bp&o;cJD%qy^lzkB285 zLA$dxy#B~+=VuICU=nTR-YJGSPpP~JY=mw3E-!V`RoN3?<J z*8!OAYK>Sz{VQA!U*-64_rXygYcQs4kgFsS;C{_; z+N%T4Z()2&hf*~A04N2p3KxgfB)-mIhDB%-c)>UlzbDyQMAap&K`nLuEgecUH&Nmw zHwk{kg)Q->!B3hOb9KN&zGU{ zf}%f8z-tdrMt{f_Y~WHo&Yc8siL= z{w&Ebv2gOCuow{b-b~c7n1Z?_F^n;=;;Rw}@yUCgx!lEav1z6oK~SbQOXl>L-;5!8 zl+Xgr%l5+s>o?NuE?)vdl`{uh+@sYNN_vEpH!4arK1Z(A2?#`zln59M9|%|~HS%O4 z9VFsxbETD>sy@+SAJ5r$|2zbj!jS@r3mXnkBT-{4d>Vi`SHF3JI98naNnB`8#clef zth5hi8|jff4_cn29<92$Ds~MDM$J4`wo3`j9@f05#UbBA%%fvxA|S(c6BhA`)hFRM zs}J+2KRK0kJ{zM27?G0%~z&e^U7b$=M*@QlQOQZhCr z&T;=2>(SBT=uvl!Z^z{qJrq=h0hFSPou3@)M+g|#KCM5C^MZ>H1o*7xCHiiB+%vSf zd9-%nx__)BrI9c6R|Il@1ef>~R0s->^9*>Smif_sg|G8Xk|$nmT%G{_PqkKO&c8MA zw-a;-2?E0OuWC)g-onAc(OtpB&cgNIRj#_88agYEppD#0Ivqx84Op?TP0)955fMwA z(D^JlTioqM2WxE47KCn?^*jru$=OrO<{WabIplOBqJK)@HMG3sox zv@uzbU8X!)e3ha(OP)9uFF3o5>nvU-`yk>p`v@S_nF8n>XhaZ&9=N|MaI;iBocex= zg_wa0wev?-FMhMlR&zexPPR+edP;*cyy&LXn(t3~O{&v|J4?SQty}|JtT_{D<~Aka zg=3Vv`w=5$hkpf4AEAgkf}qa|##8-GtuYawS+^;w7uPkh^9sG&m$6cM=}MuOY;cBt zgcD$OAxU-s3wnW^kuV}od2ANyUefz;d4V5YBcf9C@)@BfOOAHgpbV1sDZS!;sQf^p zC5_LxP5svjf|}NdNv3^i^oD5KA5Ryf?Cd$_P8>4odlBFDS_(K#9oS1hjH|s-M4uFz zsd~M3%8DW}(dc5TKjjV6!poDGZS9CYX)k~j$dzaLE*r=;*^XrsCKRzttmWM_KHEjr ztQba%?#Tzi1mhRQ(Uf9!6hBwqFeZl5xhQow}Te1fE@xEJqPqX9%ipf@y0%AXXJ~)nyZ2 zX&d?z@+uw}YAv&WcAb)}U7`jiM6%w_&e z4_z``?Yco5@o1Y%e|wUUV~f@D96@gyd)6iDNN;4+pBT`iPU`*9pWt7j>naykeLSJD zgB;63cOw=qwVKsg~`IB5)KhE+yh<<$p5h@E|Gj1FxPXx?H1=VZ=t>OY9RIOMPG zy~6qXIRxyhbs29;ZSKZtlyE7?Nj)K@vz)Hy8f`}}^_+LUlj z66e{>lkop8)5+N*|@;*bex5KWc1{ce`CXdH{>@!TH8+L74JYDI&YrW1W1-AW4pZ{68 zlY5(>TF^&8${NYz)zUNjcI~tFaWGo|0BsEQgY}O*q9|`n9)u8DxOG8O(FbUaAhxBZ z))I`J^DN)U5O8~_Cyy{+bf%5)IbN(9OS{dc9LHZr@%?oi-Vk&F&s$!I{6(OTl3=g?&2-fk&;$k@)J|#mXP35TcO!xxCOS? zYi=EP^WkdDQb_sr>wEN*qo@y+w|;nc*aZL^)A>=Sy3PD@Ra45sssXCL-AiyU`01xG z8|3;?%SCW$m#O{gc>6Y|A$!vUo&5rwnori<#AnMCz>8b{wvglc!vKMpg4rs9wYGzyR8WD4Vs$!WcNhKQq+=OW&@c#BRSGaM88d0~=|CSJ^{*hB&hH;s$t6_u_Z}DPxN+(W&H=^5fJf?t&I>F-S_F27 zy=>Lix4yEsvphITYBwDmO?!L5I%#zbof4&B>I+3VXK=j0+T#*Bl7GicA<#i0Hzz z^XuD`0udM{rT_dqhKG(^iDpO{|B75yl9m)1;X(CHc*$>V1#t+s|BfHpCC)k(YU}}G z(VoB-LqD$4iX(%aNNooxX=Nfq4^bj)1!w<03Id8jD{sD2>b`}GuZ0%S|ZdTXx&%WoL zoxT>p=i|jS2$lud+M3N)OTBXqF&=u!>`%Tk_iUl@$x$Burlx2G+1~i*5N|A= zw}okxJJ0?;HrpdSk_xfoM}IHaopG~~c<2S>QVf%%EGm*=R7FZA2mtu69$vm`s;gZl zu`7jsmGJQ>lb6RR)6BQo%{J3AeRw^_S?Wr$(YUy`4yV8-mDg(B+Eg4xsf0o??xW6D zy@@&pi42o@Kq+ZKi^nh@b`_b%yuob*uBJ4roKs$aX%Bh zs)g+m>Q>Mo-+;PLtGUDbV4QY*r_>+rG3Q;J3AX8lu3W?oQwHS!T#x}G<9l2?>b;d003)@HE?XaCr=de!W04O?_|scNI*DlWoh^Y5B>sb zh4`LHJrf*MaHlg$)}%e;&|3#F+4ArN$tqcm^L$!+#+K7V#J_?hBT+p}hni`e5*Q21gVnHeFD1A7X5p8h79}%hg|3-y@)h zZDCgAAY>gCN_d9@YU-Iai=V0!5ee&2p^%=l^}BTyQ*k|JDOuouS#QA|W@FavU^0^S zc&{@$wgtCi-nCn;@#EFsdXU0e??`rh40Z4S^o{e{?-fr29rpIO`daBcbSMhl6cH!B zcJJN6{fYeq*+lRXt)}Ga(p{ZLG|ku4zaQ0pgK09sd##THPz0DVh4(TOQSe4CA(sk0 z3ax2rUBgSE#v0ItFCAy)^~|+AF!LI+b-Rlo(-|R?okdR7=L46B9)6xOAVi>}HN4>a z)vB00+V7(QsBjbm(drP~3R;w)=%|b(CYR@%{7!2vl!+8Hh3hJ=1ByNXtPP;pv6ICboh`# z$klx7DXgT4#vptYl1oqJ=l^)z!meVeDkTO+?k#-7@eZ1H(mVCjVEBmpZRRR-0RI}V z3RZ{!zOzqa=^RQlNxLBLxtMr`g0h1&hSFckpXW4@$aa$^0=f=^Qwty4-zo{4tLI+s zk!ETGfS0V(e}`YQI#nuqm)gvfWWn&8RyA{5+V$7}u;#AT3cwhJ?@p0sf>By9=0GZy^#5!>{93x=@n41hP zIjcy)Wu&_35Y9e`jXm>OvR3RxD~_?_)t|qBezWcTQP|OCFJ$9Pje!9CRpB3#gXG0M zo&Dh86+%XJ6<*)EQEUSJ)J@K?@<@@hI5VTM z9YvR-jCYKyNUX8T_3Wc3y+@oxHp5SN!YkIVtU(Z%Wh2>$Db*TA-+);Ka8PhZJbzow ze13TG`KYq?WJlk?PEe$NVttt5&eNVY7m=x0>78?m&S_V*yju-tuH?hRLSWeM4q|1% z#TlY;`3BLr9bdoymfsK@4dsgSx16a!)Yhi5L8#qjKzz-##5opn!ozdKsobR!J2Qhc z&E$zPIsNb(alT4{uwAwVv|)Mjho#&V6gQn{Mz+Mk0SVcA9t zx{T3uqHve7z!3)r2p_PVvO}ZcXx@VYvCS>438BL8Y#Yrh#)*Ic9*H~>xrOY)$BPB{ zMsNy4lCBW_Ka{UulINeG3t#Dz0Fo9dQklauL3zmUWE`n1L2Tt`4eTP+2U~2JBN!-` z{joIu5^n^nc5t%Rnaks#xusHO2Br_?ei(~BIExb*lhAXXiHcY0fl}q~)UP;CNn4k< zIHj1Kp+frQJL{V^`~-J`NIw1{?5q(KnSl^q<7AsHty-P%td8yKpUAI5uU_PY_f3I? zT*#o!g5MeXN4*ZO#eyi#(zE0CWhzl|-f&if(qA#F4xOa00+iKI<;YnZOL@}By#65m zCwnc|xDw$1y7%%BPJ{o~R9)r8X*U5p2#7NQ2#EAQJkq5IlOhBDd*Z;v%Hm&**gkDo zZ+#8SPb0Q0ZgwAq^;C%RFf`ewGk08BJ!|SVHU)H8ip7Oc(HdyL`%X5$ z@-OoNIT4?JV|gIy()}Q0FTJtM5YD{)r&5^xhro=koim_T=a(&r5fF1z{|u-Bsvl=( zu73es@wvkn@=tlYux)~0S=oo$9G_8ObF{o;1m!UGV(bsQu-Md%A#qG;qWK1#B=nZ*Y>l?h)r{j#zs-iP*(4nQNB1)^q7fw<`Q4^>nVhYAUo=wFt*G#f|Uz zveJoMtUm4r9p@v^9CE|I>pQcMs1?|=7KR_P$}eBl_23&?T0@Dn2;)2-pHF4PJeskh z3|VP`vPJ0*a{GG_b@oa&HZ#t;T1kN1tUqR6czRO=0?QWGimOC(Z?Ds-#|WV<@%amc z1}#9*Fi)-&R>lftRu@xu1`Y096+($O!kKdp_lh=U#;tP_;-|`}MlbU?9(aoKnUp%6 zwKPJ6d)Stc4_(m~SLp><4T6pt4uWB^dX^$AyfM8g&d~?c?!n&%Rf{&7Nwa{q=?#*h zMN6u2xJQFlDTbV@#ahEO4BA}Q`f{$y^q&U;^9Km0rE8qfVfHm=7|7Po&ird*Yp8^f zXqb*m2bD6OAyqOnQSr}LV!Fp^_t#aP6O%vE7sB?1!!z>*g~*nxu#zTH4+Ki9a0abG zI54ld`A}KlpcdiQ?vvPNn92aZ>}MVky9pVi$l1Up7ThiAv+i5%_sRdzyh3!1EMt&! zb%EZVv<)#4T`f3Nq?NsH{X#p|Jheote&98a1oO#5V&?W?+LfhvRAAgr!QkGu^E8(f zw33)#m+i|Z^oQe>_ixmjfze^hPi$;{=}ntLkCw^2+-U1mmTy#6&&dMF+H}oX%&gcA z0}MP>Tidth5pq5%68Xy0!K%5(6g27ad(4ft<`>W`F{$b9)YJB*EM_WrZ*RI;t!s~) z6Db+^D=VYeZM<}X=y%dvHR{|`{`%Pl?e4P+lne(}Y=KM%T5N#|OiTTO^%mj~lP__h z9!HN~p3jyow6G~^?e&22hZatgOHRBaj}-ZNuAjXBBlIE9AN z>TQ8|uH=xj2eYZL81Im9-aGJ;>v7wzCFIN@V2;%7}jQ0>oCFTPtw$G|v ziT9Yex8&Fi%y&S}=qI!RoZ(OnoFVXnZCm+*xoM0K}`HizSHj{eVK|UuKG5eW*v}4>g zyF|p`Xq9$0U|oEeJ!?4LFUGcJ&AmzBYG4i0IuQ7hffU+_QLQwCsTfVmtEANC0ah8H?>7lvO;~alW9L5~2Vm%Ie*frB z8rPaDEtAg-?b9*KDYK+WkUxBJB--0(<5%)9h$RB)n#$8Bbv(m$*#_!PrsL|D zD{@Fc>9N>QnL(KGcNENT5M7+<<6o?85?(s+R|N=eEgeKwuvE2|xCJO(AGfFQ^(;$U z*U1CekD4KEYPc+#1MkyUHG(Lq0u%?p1=93V5Ur@KWsb16^YfN@0Va@#Cd`}n59|a3R zaWOzXuVjtS03Y_{G^sqjq|9e*U#KhbpU+RQR1c;}K8lGn%HoClD2~DAh6+?S=F9>-WzLnN1!2iB#DSdmzrkywM@Wg^+G{$#mg1?U8;en6SyJ|#7Dsa(ab zG(~`!*j>?R{NjK^ao{FAY78#X7xYavw%-e!-fhT2Rhnx-j<_EA13lNtdW!o4H7VP8 zhG=>{g#5YChdDmlJ7ilhvkw{|)iUEbtaNBVvOtiZ8p4*8uomMb;a^nfgyZH_oJ5l! zj^+9DBU3BRfc)f0bDlZ%pVe)byna zb=vev0DREUwMn@`9G41k!dy@^Pf7OG(y=2PZNj`E{tVLN@d2Lc3KGM`6&m64+n@+s zyEjRVhx&&J0k?QM|948r(lRj^R2$rs^9YxB6pKV~9@206LZN@`f7+V-Tr0)dm016x zT-vvoBy1>zY*@&9#oJPDSVX*$6xno|tXV^QS1s{Nlvpx6H#DzMIbm)#mNs=qJ4nKT z!$uHDYNd?k5lyQJcs5^>4 zN}#5Si5%T%sv}*zeeq}6H!rq=AuDaHWqrN$Kl=?_eEIDFoVpMPMO6rYnEJ~D%S`mc zr=|dVz%gJaSV5vwL280h*sYDfq>vE)aGHsJ*sRSjxDq5k zpt`>s%p2X`!6;t07=6DQg3tENn>-Z96gR+5-QeYF(Vm~`$@9?z@}vv&6~Y12CgZnj z*geCpuYS09ln!aV>y?}D-@heYVOQG7S-qKciSI<^m^z$&2D10alVr|NPv;Jnwk!O= zB2VwA6R(|_T+5}qZhch?&zsE#)BB;o-9EZFp$*{MDqu15S14C&A|ki?v1~qLNbd+( zwKUTUbd#r>cDiEso2fO?(@*)$Y1+4$#hwiN$7EwoTW+%bw}XOzo9|uwTCU>Sabcf5 z?-$Ie9yG&-ymDDuG2%W!P_rbx#oCmO=0`3fSkSRMGpc5X4s8p0!Ee?U14*S}^`{?k zBT(da6HZnv#>mc&ri3=I*;m6`$8P}5M$sVD@ z%7_fei70&JE(qf>;QB8PQ?o61vT|uGx>+Se)eC>{k`rwhQ{1`Br={WdgtCqSP!RC5 zHA2C(~6C{Kt- zJ2`T*(P47DOYg$`w215M`}v#t60%9b$B!hh3?&Hi(Sdd`{s^izKi_@071}gbD9qP8ned)4W>57-kqd|atBi^y`LVM<$^qB ztgaf`HFUDth&q?qsDMJbG#6>maunh>6apoo>Nj;#Hv=-1y5~)!Zk=-JG}h*MnN&Px zO5KIV18_^`jp_8^X4-tdRl8Uf61C>-zy|jf_eRmC&GQLu z;ah@bR_PbX|B4OT7_yXtv4B))7M{N^*|12s#h{vmpZ0#_cn#VgN;MWZ|AzalYjRfT*_LbRH>2eyP^%i%0(qw*xAS(R!aYpFhW!D) zr~7GI2*af&*qpx&EI?q8&6O;BRuR2^)h0PuHcYdX0>)7{4RDbU;lWyTQ6ds6#?>HH zA}s!LmBIOe2l7BJhRI!}DvFLUW868G$d|4$FqH^hyXuFQT~G=#ojR<3io)28e!Sl1 zJ9Z}Dr)5+0C4Zj9diuS+HVzt3e}AP62X(A|eBZ=@BHL(9JYf8;YMj>n81rCm@>jY; zR#)bF?vxeVSuNv%K#C%3B+Z1+1%o^+hjxIX2diHXRP$NgRYp(y_z1gP_O*xxozI_6 z#*J`#Rm^tu+J4P#69#gVylWbx0@-rEIw24C8wls+FXX{rD$&NbMHBm@^U*0isnag> z63dfy`cmuZTL5KanI~ka(DliMGH{36jp@@z#}BT5 zPr5K}ZrLtfnmzPYLJ;wYw(9lCBuzN{6>E^yf2l|X)2cF8#Aia`44<@}=13VKN$1#p zg5ExQ&jgx#D><>>RGnQ!xfcqHJ6aGtKigDs&&<{M z=0ec}-x1=9z^0 zYt!5{{|F%RW{01|X}a*TKAn2T>33(3)k3Ywkt~ic**?)a+`0GFR7 zucxK6wuyr!=YK`&{E*B#N>2mp(yTSGhs$5Eo}Jd!cB-sIbV+Za-!0VOaCT~YxxRXt zy>Pbbx-WvP#daz+8Bgy-M{BGUWmSg&Zy+~MxCeNEy>f((rgDm>`|GkM9Z5yJI&o%Q z5nW|*1R{(LMvQ{IS0;_=_5V4Xzyh0E@+1GcO`Lj$i@#N$u|gkMcGbV}l5{5)e{g;Y z-`$B3c83}2qltlf65XhS$o*l32mCaj>EpALXHu$W;lP6sI0{Z#- zq6d%*BK@RK;93fePSu1vGL zU;#LXg18{d2nmr=AyI6_XnfHp!?L6H6LN+&P0VH8IWWNBJW9kbcU3 z*Qobl7l64qar@53U4)hsGhOXEQ(ZhUg$d|qs`WA-Bj^>`|K%AEZigL&$Y<(*r+;bR zA7rHZ=x_6zrCNGq(?lI!KZ^W?O=j1VV41bS1cy^79ul0tVe2c^$QG7{u`Ly@7g}mx zboz%MEA%x`U%$3hvg=s-JdmC%d7Z^_pP*L(mt%+1T4-BQRO&-r`%AI@T9f=!3k9(3 ze5Jxn3+BV-mFtc<@cy1BVIFZW6g~KYC+vbMcnd4j-1#A{*Wjo@q+DGa)#U3fc7PMYb~P z`3m1+B8MMmYXm>)#QW759;-h#>@0{5pay@Hl$>O`>&K`4J*2rAdf%kQnhq#}rSD`5 zqHr*Z^F5kyt#3G3KYDnU$yIX8`%&DY@~2-O@6xrG@We&4vV)=QrISB~VCP*t+4whA zlndV4&qZ(%Zb>+DJsvWjZ%CgX>V-C|)h5co_M`#uSo~d!+KeXh0F^U0_Iv-Mq)T$5 zy^ocK!L~)nmeb&PA4q5jGEl%6Xv|^G!FOX0G>U^3@*&ctow%y#BVJ(S>$r<^=s}MZ zZ@x_UU>)h^&}kR?y)!b_p5dJvab0&oA(3(}6Lq8xkLE4f2*on}M0V_|XGWW6@03a1 zmI>oX7W{bPjzuL)^XNpe?TgW9DHy37lCUJmwIx=~CK~m<*1iH;2Oc0APV`w?B$NIu zOKX=5C9ebd9=AD2FcNW(kAIYSS_`)7sPwZv{o6RmX z?4(MN=Yrx$IMqo}2}1y`MS~{n)rssPqnu2}A;r|{sG?4?jFI+EMRaJc-?x))4MEEw z)6={+HiU`a(5aYU#O~395icH58)Eo*M0oLVYwXV^^VZOns?7zIlP6hF%ou5xje70y zY~NxNDt8h-k^i$HuT7i-2K9FY`u(pVCI$l1;>@i6?`gDgR+fK9@9bV+NdG*G+X_MX zF!?vx1TrOvOBA4Pr-UwoA*d&7lp3Ki6kWVqgJB{8QR*N~m%ciuX>UhfkbUM!1HYxy zoG0z#usIl493I|cQ!;j(zwvB7siw|k`i%m|H8gaw;qr|hi4jQ;5qofh0fSVMyS@h zfCsf=Kc6H&j%U}C``d8PlD8xOtI&i)tNOS`&ja$cpd_q7L2f!5*OUYk|Vz%PZ~E|U(Yy{yB&=hrcx0;Aq3;_}{WIWVVus8klEK9g~% z^a7#7u@C{o~L_XT`uodJzl5U|^bB&H33~ zV`FRMSmBBV@?0~;N8H+hk{!}(;p7h9T;60-12G`#EF0=8dy8Te2pLV+r5VDnv25-3 zOJKwJ63^a`GAtkopAwFqI*phPBUsjq_Z5|VrI!Z}S$xybGiKvx)FCDKvp|oZM;{xk`R4qHD zvI!VeNV^NBJm)MOFKq($HD;*9n#QUd(Aq0OZvE&CAN@LqhVtdaG7!Ix_kTvz^)KGd|9@><2RxPE8^5kw_Ka}t z8M3Y!k&wOOQpuJXq9Q4}8Ih9WCArrsD-m+7l--gU3Xzd_@fWOW1-n4^K|ya_ZNBiFstO@Mvm)x5x6yzoUqfw$!HJYk3$Na0kT3 z@KL5!$#l4wYC0l3GKWf$(y}J$z^^i=U<4|ElRZQbX3F^WcjyqJUiWq~SbI*~mwEcp z-7bm0gG@-jSK=Z%=gECl>idh~?;wG~H`DgE3vBg~A{b$NDv>u$q8zOB8{l@a0e-S< zgl$%78JbS^skp0|1X8{>@Utk3BX?I+3T?#i#+dns|cpYm1f+_$c@gf9#xQ%2QSvTJfX zCtuQti@2Mo3=dphNye$-#s>bZ)}X5Q%iKTDGV)6#`m;vR-AKnwibYCKI8S6Ol^}}q zU4R+wkUp&Y0nNzu(gM#9x+jk#?l^jhwq!@-n7!%K)DL_7xH+9;QnUK3Jp1=G-1@$5 zO#g+62tUbJFPdda#(Ppn%kmeprP=qB|7bB6!CZeQlPr~J_)^z;%&7E{lrwuaG@5)P z{d1T10Q0~xrCWbX^sJ#6^YM>G=x?H|sE)CzQ=fX8^T&!`HlK@lAy;IeQsWQhXj47x zc1PzzhPy?h+pK=}8<`ZPl!pVp$vVi15^v=)yOGp(C0ny{BPq*@+l~reQo)H=rK>s} zh36~iHp&B$g@8-8*xCArO?lyR*JA1_@1UjyD)N0W9hbZ=7er0f zj~V2aPpLW_zm?cueCt&Z|BDdTrm|6SEtG(jBjs~te*=FZQ#de&FLb z@GF)>uUq7@ardoYjO)?I<}1L_l>zlCm*&;CURS7j6u1Tzw7-}qaLtOhCsS(z19eTk z($`MvzczmB=hYct`|+&wd}U}iUA5rDa}{B2VqdMI6fB&6k@>A04DL2j?#I5iK>2o< zcNmEYn|JCmT61nnzW;UW7^k+VUrEke_Q}e%ujPv^Z-kYCibJI* zyg71|3>#ntBUNw&c+Ge3farBmFo_1nS-Lw)0O1HBOg7s&G!zs>d#ULz5Ym$Zy( z6z>ui<;cf#P5BS?X?DAgoWBrR6Ng$AWgOxJ!;GjRbYijWs9!%rdSvcF2GM?1ea9k{ z%ri$a`#AaIUklxBE&QFh`J)R>?SNcnt)JyV(IK-H2N~WA>fYvYDiVCJveb@lScmxTJv_z#&VuR;+o1CIm&bqFWX2~(O`4y4!ZOYd z66}EmfSPGutb=wkaYwyapNZtUhSdz9CvLLm+s~1<+f&a45MAV8IWG9^C&tG5<-v%d z6sv)eBe7gfX(izd(pu?= zEL_idNPNdiN=X{4mH8wmJ2|z@B%1@;6896nyi)I2d_6&r1We%97d!^fKL!WVQ>cLM zWftt|FaBgOyk{Yxy<3bJ*yvUx29EV;Q(Y}OqBA>{V%h;j_o$<+eEJm`Z>$zN+=FP} z)hkZ1ld*WLoeb3(QPlhXL?f+&`E=8xC$PBUDypTyqeA{CyA3#x-U}NSo*q_ec&XR= zfSM+@M)-whImgHnuHl~fTMtI(Uua)mwj%?K>TDhh-`nmE9o_t(u2S-$(^{W%xuxYE z>c^WQlbD#8uo~&q8Wi*$?e%!WTY*OO42hcNKBeW{=;5(U%TV=FGIS*RL}E?G6@l1@KTmhwN9TOH9Er8bP?tMzEk6QS3#;&YWeUW2i* zSxZ1t7(`?_#F_|Gp(O=ehlm&}o>K))#Zjpk6aWJt<`gK!t$#j8z%+JO2GqF7f z!kK)vi$MQpO0)6KD)6+wZO07i0p4cGZM^Pr8qxvy4FB=nPI$GF= zufEk|evas@>_T1H2NPtjcWAB;#Cn>^`jvjL-lh?g3^@o zzBT$WYAmow4;v~QYD2rE%Jzl!=QrhQvEM(PxO%ziFj(Hwrq74nHQ2|Tg9_!N=c@g? z`pV%Cq8%@uc%guzDSo#;S>e@;t}>Qjb+M4H-KSXnw!0^9r79|HNHC!zvQAu@jPYD< zNh$VYzEh8CK~;I<=f&04LL+}>`vVW(TX?fgbZQ>T`0D|sURsxLL-sg#G7FR(@1|Co zFPWphPDYB(RF0z5`=mvly8Fy&-B$`#$hg zQCs0%p-?BCL8goImCilI-6P&!Pt>~fkrGM&ve&jq_SS_~ ze&x|v6}Qo+McgPGVfXr&YRR&?JbIWY7wwPbCB>Pt2U7b^h25#EI}=rNr=;2M&sfSN zwvR%06#AQ9{W0{b<1KA!e+Of=@X)HZBU1L`!b1LjGnawpRWeTB}f2ZNMSDRosvJDayo<#`TS)e%yXc;xp0D96}CW@C>_a z;TpU});0%V+Ql4qDSic3IQFjgVA8G^==F$Y&E>)U#p@%Z9(r2n6{Yd=MEALhqf;*Z zZHvJiuDSAY4T|C}e=U-H+Cl$$1u||#UAGY2eG|5vS?@ZU*Owx|Rl{L~^ls}Y6;b{) zA8=s>damb1IC-lpEN=8?gn=`YeUshUTD@F*cZ(RIu2V3zyBv~28og8+aiSXwf@ZC~ zUvzQQ8nIDVV?^z-%;NUuH8VC757NzY&>}2m!c^9O!kjObq}`6f$iETCgCI5b<_abhtxTJ@UQ(G#ZhwXFKpJox~Z$G@UgL~c<`v%Nj z+|Wr9aN;N&u4(w48XwqQ=4tNB+L8DuN9Z^1jrxss;{$Gn{S6CiZx)wk5VR|lf}&@hee2-Zf2EnbzlqJ5eWqN>t?f7JiVttbl~nS`zH9y|IJ<92 zII|xx-k%KNH?kIF?hllmzuelnFRL$14f`ivoOT6KekVTbLys7uw4ncn15;hChr#E` zxk8R0KF*Z$imM$~>Tg+3sB%*$T*}zo%woN!!l?3Y&|q+0>ux&YM|vKH3t54)M4w>s z(Y0G?!HMG@p)!;La~Wn=ekAONPDU#SyM_InnOVPY&zoUrVyu(<{O_GHE6ufMER!O% zDnlO1i3yVq%4DuHBR$fEl{1N9h5MEbhh8NEl+SLBmjj||)7+ueF-mE-Crm4zgzdi4 zjPDPtP3?6&!8@Hk;7=L+8Eac;0IvrP4zIMdAr}mqkutJKnW7R|g(6u6OW##GGZ|SK z`7v=rN%7X^HmpKBwq0%nKny7nyHc+qIfCClAYKD@zueFN>*UE{{W+hFK%^Va0 zs%L14a*1&`^fH1VcO56@YVTdet>o|}a$6QZ4W`|Fb8*|uy?38>Yu!@BYXN=Z0)#Ty zxlI9qsO;cC`pYVKAk#Me*4>KjH1?kJ-qFnrIeZMSO21bXUm}Dg?=Z?d90Z4)mkItM zck9(?fO_J9FE|fV+qTl|vt?5!nBW4KWpD*>`^gNkbtd9Df$3#x0b&!XQBGz%03tcSwGM-AEdF)J zx)RZ>K6I8 znIR*-An**auF_4zp-?}9V&idv?PA-zP_tV(;wlIhgyENMfPrN;QigYCT>oZ*JQ#R9 ztxrsB4oqzBCfG3GfT+G0V7%2}Y-iw5@+g8_&Ft__Luv)(=tP1XHp@@QRpVWCeQxku z6~qRC9N)1EEZJxb0cbxfPXH#|meV>2)=h4@e`^UvHUX$U#|~IsU;)-Xi~HW z3-&O`uDFL8l}}O-CuYNY4i1%iL6T7dzJY9j?HrNBb-W9p0Z9zO1ulU-B%4@*0_FTc zf_X=IXY~IBz}CFLL{QYL2EvNGj6=2gsmqt#Pu@?%nqDfAQq5Qx>kcLm|{LB1Y)v<1pj7+ z9O>R>E?nXSOqO_v=KC(eq10o$;z(WV5Ga?J*_QMEAiW*qA8_c{(ze{EgaVL$MKFNK z_X>*!c1h@ZTgluk3gQ(4)LO}2^?SGJm_aG%0@kj~D-F@x$ z{2hFaEyDOE)tx6Z#Gjy{PT>7_z_W$R3`t}o1MF8c>2)AFkP$cpV#N-=O342JL=Y{^ delta 8041 zcmZvB1y~ec)IPIxclQDkOQ$qQBVD3^NJ@i*k}e=hqp-k&q=dAjfOK~wASE3NlA?eh z-@@Ye`}jZqeV*Al&pGdT@40u*%-l0)Y#pui2P%QiT~st2l*^xypNmo~0SlVpM966rh0UwE*IP>(BtWux$Vf zsW}GjAO#ta^goOwQfLCn5nmF{XpwE?f>2QQFi=o5V8oV;@DVxy3+_q>5Lc?8c7d+Y zmBbjWNXp7df*N$BE|!cGKuX%YWY^MTK8kCPAOYfQ-JrY@DiTMbG;l518CU~X!?Uyg zJPgA_LFr^bLAi?_UJM)o7)2csol`O9z%_vb_Y{j(93k_=sN^WKP*KsHAR#{6SC3F z376IV6`BI{Wj^36JD9RCF5oQAFf~PQ3Hz&jIB`Mu+%9bSU1lQFRJw#oP8H2)^hoBH z-51)9qvKdpj~D*ixR%^5c$qbz@p9R~CY-sD6x3R!=NGqCHES^3Oi*et_etm8Eoq5A zhrg&dKQGTQ_`aSBqQ~cEHp5qw>6`Gtr=?(?!JDH{8;3v{c*JL5+Hs)>wZSi zOt>sB#VUJ2)WW#76AIbG+JS$NEnLzDJ=p5=(o9J)K`(q;O*I?kHlV85Uh;HCT@j8Q zWt^sA?Zjf?Drk9MKT|j{sxPp@)Fvs-_8e1&vY`880!w)5`u5*2@nn5_8w@_?4b|4nSoKa{x{P~M4Q3{}su>!J z$}43(BSj=z#zEyiNuo1)j(WE|?K^fTZlC;k%Q~{}(h>GCBAjfxZb-GjU}P_;g={D{ zI&9uj8QV{5yRUdYK|>!J))M^oeTaRikeQL6pP=oGnZ?0GCRkya$Xs-`i1n1Jqqar2 z-IY9FHAT1JZiT_4(XxJcQE**=h2qI9kMo9)M{*?*gQp}8^2DvzDqwoFVj8SJhx$|*7p>yBV@Gk`s z-}?ahk6$s!w&33$e0#9STB6JjHnYX7pRJzjsjU)AP^LQBsSKul=oUp+9LOnK#L@J1 zy{L3YVEx^JtfYwxrl!-TLFkonTMuv>B7cX_zi@ zmTbTJW5mRe=?T+AM-4${HI;jWoa{Ea#s{Rf-sHIH-+wA>_?C$zYpSfa$|devyv9Au z5tGnrEdb%~_5h0Q=AKgFd7h~uFp)FE?u9b7ZuR1^(ZG*1>CnmjXJ-oCLdWby84}xu zd1Jlt$<=;^E6Um;)5h~IM*T(~mhRIJFPZ1GJo4Q-7E7Pn2R*b7nA|5B8r^4X;MNJK zrFgeO-cY#G?5+9eWVRrP=Hb*6BG*lCeFxbv1qtmJ!Fz<(g}myD1ufXqo>?;X*2NkD z!5+!Jl6ri@{YOyTb^3dJ%n8{Zk`sxiPGFcIi&37<(=v*0ZR|FuIT~iiO35+8N&G^u z$dh}CG!r-zAee?Yns#+qVeS+Zgugby90?`jdf=)D`vwC)U2<6y@<;ZcI~nnCr_U+B zGRUY=Ag$w74pTRaBFpZ1{wyPgA+;!SG)w(aR()$!o@yjCNNG+&nbc}JF0}u)SyX$! z1h>;@hqsvq5vd6ASSPE%{cfe(_ZBxn=r3)wDD^uGH0g3z1e0k#s-!0t+jQnJ84b26 zx4&!q%3Sud%r`#f=$m!NfOTyrk2Z)DXIIa0S_5Wpl;EEJ%0ppQQ}bc}19}$yFN)GG z7Ap;Xsl_`u(9*g4tE(W#HHZG{0S#m4A#42t>zPFRB=uXWeCqCBA9(14yo~bn&jwy&*Rigt&KOpt#%Xr}U z1r*hkzLSDmM(}7vIIjW7KV-4q_)QI4w@%$^cY zW*SkHSD^`czPz6FHPOic8WNVYRUt6DjGcjzdaBjCtQ1;}qw%}142&lN8D|nw^ZmLR zKA`9mdIXhWCFmNHK8{(A2^z0FrR^A?;o~Kv_w^97-6$*Eh@@5z2|Z;~d1Wp3Cv@C( zPLMyD>)x~bMTMxW_X*kpd20No1`Zq&tgR_^X_BIDLl5`%1YhTI8B?NK`OlCM*HjD(;4r^LHR zr81(=W?G)KF7$qEB>HHjQ^A<~XR&CW@Ioej;`EpNY!O;&*JJVt;O>bOb^@7TOm?0m zm=mOF+-)9Yn;N9Y))d*yc1Euq1pI}RmK5PYcT_rmjBq|w=N*L2wLOM_zNq%5#INpu znvbzQseUN_v2}t=WwO?#+D$fd-!59zrcW8CFS!Ecjx*NhuYnckROQ`XMHD~>KXiT;R6ctUbtGx2zPdj>-4JQ6cO>=AiIK}^Ds4P876iA#G53ydqR&p*m^^w{ z7-IE&VP}g#TDQ)G_`9%8X2$Sq3$CY@6hqxkrh($MI`$=NZwo%315_cRVfJ<^isHh< zUUm!;kJdXmYnotN*$z2BnSyERVth4$9w@AaGzW5Q*td{e<%CyCPvytbr8eGucl_LP zICV@$gX7&%YEo_YM={KwlvsP6Rp%rc9l3pz-&2LBJ|utX|XECPIF^G-07mFGaS+}gL1V(iq7I}cUNs_Xu{mbo{s zT70&X@TpgQegck9+)Q=!JU7;`_NVR{LP@!H+qd;T_Xd2_$k-zIF|(!Y0Av$x=W2_M z>^@8^O}Ve@V!`cV#l7>$eO^s;Ua4XCJt^iM^ITDx+Gx1pZD6DP3wmvZvOsa_R?#P0 z9-rEH8&}NzG5)mdIGD|tGvy#X!P|o$?eThT^P)0sHF^(7x>ZhY_1lLum@EDL?Ew`N ztAMePoLlMohT#a~Z#W*;zQR4d(2gB$+4{mE&XX;W)lou4S(s${nUPfLZo*itE%ghD zu1p^nUQpAU;qVsl$+}{TIqd=IfjINU^8x8VY@BtU04z9>HB`0-6GJXtIV=!!bMb}7 zLTFM9p_KrGg^G9l;cMbI-Q@WYyG|&#FH6wAm9S)Z$Y36qiLBG$aR{nOC9Vmoj2hyt z5$4V!nf8+*d`ygABD5!td1P-%|Jak)wL|Z(y5EY%>B<4u#QI-#5%ac6rqGwAPhI#Z z;wqcAo}4}Bj>~DpJakmBVTSTig!Yjsc5{Sj=@6-L@iAAgmiwC(w$xR;iPeS*4ryCp zq}!(Xy?P|w|Lc^_?yd@()gKwLjx1%|M%f9tS&N^S^)o zd=2`qG{Zu}sAcdys zX}XTf5e1~=gp=y&wcS&Am%BDng=vJv%vy5?hfOthjLCttAkSgNY25jTSJlINYmb=; z66BUK_p*tstRi$e(M=A98j^inZKW5W{wElV;_1SRi}Lso0tN~1&vMvBUZ2a1+E-{M zslWem^=*Q>2_I0+wCg|N_2&2)RRY(8{;z@>F$};s}w~?}N2h!q|gDddnx>zQ++j`O=21 ztkmYG@!Re+FLf4RubLzjohKX%(*|OQt9~?$rQ7sK;Bd&y^K$YKaL6)=;`|`T&>^83 z9XsQG(V;4E)KNZXzkKTfUK;c(PWw}bD%wazHWvmD=SAPf^LMmr5Id43+wpug2Tq>? zZL{gujSH%A*iOQu9pLuJi#lpB^!#vmK~u{{Zp8NYDcDq{y31QRWpyMyVMLxDpMS2W zQSjumfeXCiZf1{O)9a{*k1YO>Z0j>LDJ?ibg1ijMf<*5Rnyb}DOL|Jw`YDyEiBFH8 zMvPh1&wVhpToNjzChspO^!dg`{I&nvuGJ?w$rkPZCugLc%FvL-@xB}Fb#YAO8F;ND z4%oQXodptK7vRLUS}hImCCiwxV8=x ziKA$-xc2bt^1CkCPrIY9aghTbuC3DJLLh?6Jns+UjtW6!@+c~7go^2V zt0rQu-Ib??@R8(HYYf-JNNj(^xNS;dLZH zLE&V8F)1N!Uyk7fS2s|Txk8}=;v>ZgJ_?EiENFtYCI=I+MFv+xKmgPMXqR7C-~)sJ zCsH~g1f-FY1QDQwEswCa7%O#;!o!FFS?H|GoG4Mi?|Ws+fmupM6=@hec!qYwd4Z#~ z_;Iy%BkUhKCIsJe1m!rn2A}zb=J0+tqm_()vCg)&l)N;jI`js|J+_f0_D&7w%E3l^ ziQY-UZr<@*H^PnEGbDVZ;TH$PxEGkaJ(3btJ>w>7jz0$nqn{miENaEX#GE(tJ#2tt zbdi;Ez;O=4=opxeF{Sdx@EUr+#dckk8ev^THGcd|-;!+juy8sHtQm*o~k z{(;SL5u>AsN513};}m$xIF1U?vO-imoBbdGTHtivdbtmhHlr`dfrjhFr3UTE4JmXk z|CPmk)avp4hjetg9gdn~?E(pR8!UTerNwo;&%5=s7n@2ghtx@RbW^>Mo`oNCVI-&T z_Xu^67uoSj50@m}Ng}Iix*CpA%|>x={VO}oaD}u^h&&Yl52k;Dxm0Isrb8iVzuU^S zC;o{ihY*LW#~|h9*l?ssb}V$I>OuPIZTPH4ujqUfam-Xy#}bB6$=##JCV{d{%zL5S zsbcjcUeD^yy2WS+#4|mQ@@5w(N5o|JW|MVFhEn&E_VV9RpNbWcbB_t)m^3PcTMVIZ!Pe`x7`;oNU!f?#a}bw-S>VidWM+_A|auF9B4hqVtIBTHj4zBUW4 zsrhRfQ|Nv)$<#)rk3QYN=IA+$o-hTfNsNnsHuTB4l9B>K)a)HD^5_}x@)mv zT1Kn}OsX^Io(5G&>nZ%NH)n715 zrHC@!_y<<{XUk^q)DamUabaLuvHj(W15f;z`mT{N&u|+|I`Yh0fP91i!cCHo3i-}V zwr$pBaUuv|DrmRbRrzAOy=#$~)(Yxh2#7qxhGi;oSnaWaS#ae=4c`2T#5-O@kAD@3 zs<+g9t5hV?EqS4b2O5s!+##njih=jqWW0JrH$;b|%@#7~k~>a9R)e|{rH0YickCS< zBmtT7%KR(NJD5RS!>Z=sWR%~a^Y~3*tbLTkH{xTnma19_tcV;Tir;&OZtWGj7XsNrO zZEPOxrPby{q-FS4)TNOv9S`OoBuh_rX{9~Ww^2uR*E$YTe_Sj_1@Xwt{h{V#WUiE* zsJx!u^eIo~oFSQ%PAN%XGtA1Py24ERtFm>$r~1%1@lGk_)2?C1*11`{>?!DHtnA=8IZnnbqO+CV5?M>lH=m9q+q*VpR z-f14m$5YEM!SZDgczZW^j5L^4_jE}mE2=Urbcj3{OuCP!+hl=m(3Iml{b__*{)Lu^ zCP$V!N%g*O@3NgN38|QUnBfrWnyo0Km^sz_8#_w*teo4>;nvKP=)A9XF+VC-R(C3@ zzTi73@fI^st~LG{xMe+m=>I+-$?|?}{nOg#*&4*l~{r$<1h`I9~eK5_UozE{S48IWKRlW(AZ+Oy@>jXP% zk+=4Ko4_j{2S6)p2z5<{gU+2B8-_eecLomgeS!(=G4Isqc_*p3>VFj9_!d0&qcwfn zOr09zPm+mppPuz`!n+G!$GBhdAQUR5Fm~f!9$2 zYLKUpK7+k}K7D>+U4G$@f`XNT0!D7X@pbtH`GuFb?(%RA4GdR`j8u*Yt-*Pz05Rn2 z)Se0ux@uv-GpPWXt2aG-nF`=RN~F|)08&z={%4J#zV1Z8N2md1q?L#kpn(h1`~%z5 z0D4G6GYz2mzmU5~$($C@K}wahz*D5eLkHL(r9?Ww4k>}?fqPfm1wGidLLXwX(ukc3 zKiq*H;DNg`0+{g6i~uzfy3YvEfGQ~9x{LrD>@6QXT$>5NLz>K)5T*et*gH`MScw2J zT$3KaW4he?L=f>OE+D!k9+%w`1pB{VPS6rHT!0PWf@vvX!wBxs!kfVV$cDfOGA{am zX2vVi727UKnivKmzHG#y_>T&4&IvkYx`gvzHA7&f2KaD#y6XsTG)!*zSc3oaxon^? zU5#PPm;%B;M0|#*I}~o<_4zLGw_)m*`2U5ZJ7L&AjtFND;c^pRCvXYZy&`QEPo*S9 zAgIw$P}Fab?g(9?WMSL3|A+KO?Q;WeFM0{*x~zp5ub7!>AN|xvu>MB$gl>*sb{h#T zxdpIaLE(%U+%xk52@?;8{GUX6a%o97 zzp{+L$>9y0|FUA>((=aYiU`C72qWnwxDZ-g7kDfLpo7W2=Ypql{c|Y3G`;ZrXQF^R zFaRV-FCqxSBTsB0)+(ldosT;meVlI)e;x1bF zBHwlP>PuuZ$|B-XM6^SNZ=m;HU!fsAr2nDqpMiSy5qFv!V#_ao1056(58?r|uOh&W z{hG6kh~PIO0w}{0Fj|0t}Y4|%KsKzh*=J@p`Zxfh{xy3L->Zr|L<+} f&nYM9?ZV|40&qbgfP_E-k*U%YC@7|jmw^8PQnHT6 From 59211f7568878252e4860362a4a5dcabe4023646 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 26 Jan 2015 10:14:03 +0000 Subject: [PATCH 36/56] Provide EntityAttributeAddingStage shorthand. --- mdx/common-beans.xml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml index 4f0cbf0b..fb504204 100644 --- a/mdx/common-beans.xml +++ b/mdx/common-beans.xml @@ -278,6 +278,9 @@ + + From e15b0403e0d8577654aee22c88b8ab00813cc078 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Mon, 26 Jan 2015 10:15:41 +0000 Subject: [PATCH 37/56] Use EntityAttributeAddingStage for hide from discovery. The old XSLT-based translation from wayf:HideFromWAYF to the new hide-from-discovery category didn't interact properly with explicit entity attributes present in the fragment files. Fix this by using EntityAttributeAddingStage instead. --- mdx/uk/add_hide_category.xsl | 66 ------------------------------------ mdx/uk/beans.xml | 42 ++++++++++++++++++++--- 2 files changed, 37 insertions(+), 71 deletions(-) delete mode 100644 mdx/uk/add_hide_category.xsl diff --git a/mdx/uk/add_hide_category.xsl b/mdx/uk/add_hide_category.xsl deleted file mode 100644 index 164ffd88..00000000 --- a/mdx/uk/add_hide_category.xsl +++ /dev/null @@ -1,66 +0,0 @@ - - - - - - - - - - - - - - - - http://macedir.org/entity-category - urn:oasis:names:tc:SAML:2.0:attrname-format:uri - - - - http://refeds.org/category/hide-from-discovery - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml index 2989b872..581c3953 100644 --- a/mdx/uk/beans.xml +++ b/mdx/uk/beans.xml @@ -444,12 +444,44 @@ Add REFEDS Hide from Discovery category as a standardised equivalent to our HideFromWAYF element. --> - - - - + + + + + + - + + + + + + + + + + + + + + + + + + + + + + From f6745bded8d23e298c5b3e76d0368c6aabfd908e Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 28 Jan 2015 16:59:48 +0000 Subject: [PATCH 38/56] Classify and report Shibboleth 3.x entities. --- mdx/uk/statistics.xsl | 29 +++++++++++++++++++++++------ 1 file changed, 23 insertions(+), 6 deletions(-) diff --git a/mdx/uk/statistics.xsl b/mdx/uk/statistics.xsl index a5909989..2caa9d1c 100644 --- a/mdx/uk/statistics.xsl +++ b/mdx/uk/statistics.xsl @@ -1734,10 +1734,21 @@ + + + + + - + - - Shibboleth 1.3 + + Shibboleth 3.x - - + Shibboleth 2.x - + + + Shibboleth 1.3 + + + + + Shibboleth combined From 6b0e6bdb10be58a8b22784619697e15a004ed739 Mon Sep 17 00:00:00 2001 From: Alex Stuart Date: Tue, 10 Feb 2015 16:50:00 +0000 Subject: [PATCH 39/56] Allow encryption method agility metadata to be published in the production aggregate. --- mdx/uk/generate.xml | 2 -- 1 file changed, 2 deletions(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index a31c63fc..19fcee87 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -335,14 +335,12 @@ - - From dca957ee9146628d83008eafbe5377b36f135100 Mon Sep 17 00:00:00 2001 From: Alex Stuart Date: Fri, 13 Feb 2015 13:00:54 +0000 Subject: [PATCH 40/56] Added option to filter by OrganizationName --- build/query-entities.pl | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/build/query-entities.pl b/build/query-entities.pl index 917d4b35..1c31b422 100755 --- a/build/query-entities.pl +++ b/build/query-entities.pl @@ -14,7 +14,7 @@ sub help { print<<'EOF'; -usage: query-entities.pl [--help] [--head] [--idonly] [--idp] [--sp] [--reg ] [--notreg ] +usage: query-entities.pl [--help] [--head] [--idonly] [--idp] [--sp] [--reg ] [--notreg ] [--org ] Outputs the entityID, display name(s) and other information about entities in the given SAML metadata aggregate file. @@ -32,6 +32,8 @@ sub help { --notreg - outputs those entities NOT registered by registrationAuthority (By default the script outputs all entities; can only have one of --reg or --notreg) +--org - outputs entities with this OrganizationName (xml:lang="en" only in this version)) + Example 1: To output all SPs in the UK federation metadata which have been imported (i.e. are not registered by the UKAMF registrationAuthority http://ukfederation.org.uk), and to include a header on the CSV file: @@ -42,6 +44,11 @@ sub help { query-entities.pl --head --idp -reg http://ukfederation.org.uk ukfederation-export.xml +Example 3: +To output all entities with OrganizationName 'University of Edinburgh' + +query-entities.pl --org 'University of Edinburgh' ukfederation-metadata.xml + EOF } @@ -52,6 +59,7 @@ sub help { my $help; my $head; my $idonly; +my $org; my $result = GetOptions( "idp" => \$idp, @@ -60,7 +68,8 @@ sub help { "notreg=s" => \$notreg, "help" => \$help, "head" => \$head, - "idonly" => \$idonly + "idonly" => \$idonly, + "org=s" => \$org ); if ($help) { @@ -111,6 +120,7 @@ sub help { if ($sp) { print "sp: $sp\n"; } if ($reg) { print "reg: $reg\n"; } if ($notreg) { print "notreg: $notreg\n"; } + if ($org) { print "org: $org\n"; } } # @@ -129,7 +139,7 @@ sub help { # # print header # -if ($head) { print "# type, entityID, registrationAuthority, OrganizationDisplayName, OrganizationURL\n"; } +if ($head) { print "# type, entityID, registrationAuthority, OrganizationName, OrganizationDisplayName, OrganizationURL\n"; } # # Workhorse @@ -145,11 +155,12 @@ sub help { sub is_entity () { my ($t, $section)= @_; - my ($entityID, $ODN, $URL, $registrationAuthority, $type, $temp); + my ($entityID, $OrganizationName, $ODN, $URL, $registrationAuthority, $type, $temp); $entityID = "No entityID found"; $entityID = $section->{'att'}->{'entityID'}; + $OrganizationName = "No OrganizationName found"; $ODN = "No OrganizationDisplayName found"; $URL = "No URL found"; # Turns out the Organization element is optional @@ -159,12 +170,18 @@ () $ODN = $temp; } } + if ( $section->first_child('Organization')->first_child('OrganizationName[@xml:lang="en"]') ) { + if ( $temp = $section->first_child('Organization')->first_child('OrganizationName[@xml:lang="en"]')->text) { + $OrganizationName = $temp; + } + } if ( $section->first_child('Organization')->first_child('OrganizationURL') ) { if ( $temp = $section->first_child('Organization')->first_child('OrganizationURL')->text) { $URL = $temp; } } } + if ( $org && $org ne $OrganizationName ) { return; } $registrationAuthority = "No registrationAuthority found"; # Even though eduGAIN Metadata profile says entities MUST have MDRPI, turns out the eduGAIN aggregate does not enforce this rule. However, the eduGAIN site allows people to validate federations' incoming aggregates. See http://www.edugain.org/technical/status.php and go to countries' entry 'validate this metadata set' @@ -176,8 +193,7 @@ () } } } - } - + } if ( $notreg && $notreg eq $registrationAuthority ) { return; } if ( $reg && $reg ne $registrationAuthority ) { return; } @@ -189,7 +205,7 @@ () if ($idonly) { print "$entityID\n"; } else { - print "$type, $entityID, $registrationAuthority, \"$ODN\", $URL\n" + print "$type, $entityID, $registrationAuthority, \"$OrganizationName\", \"$ODN\", $URL\n" } } } From c11dff38cd01cf80526b83f4d4868a9681acdca2 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 24 Feb 2015 10:42:14 +0000 Subject: [PATCH 41/56] Stop adding trust roots to fallback aggregate. --- mdx/uk/generate.xml | 1 - 1 file changed, 1 deletion(-) diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml index 19fcee87..f1ae44ef 100644 --- a/mdx/uk/generate.xml +++ b/mdx/uk/generate.xml @@ -578,7 +578,6 @@ - From fdf75836841658ce03019230e4b246a0c79bedf0 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Fri, 6 Mar 2015 16:03:43 +0000 Subject: [PATCH 42/56] Remove check authorities script and target. We no longer have any authorities. --- build.xml | 11 --- mdx/uk/check_authorities.pl | 160 ------------------------------------ 2 files changed, 171 deletions(-) delete mode 100755 mdx/uk/check_authorities.pl diff --git a/build.xml b/build.xml index 1ce4089d..94097691 100644 --- a/build.xml +++ b/build.xml @@ -1272,17 +1272,6 @@ x="${mdx.dir}/uk/extract_authorities.xsl"/> - - - Checking authority certificates - - - - - diff --git a/mdx/uk/check_authorities.pl b/mdx/uk/check_authorities.pl deleted file mode 100755 index 2d5f1ee2..00000000 --- a/mdx/uk/check_authorities.pl +++ /dev/null @@ -1,160 +0,0 @@ -#!/usr/bin/perl -w -use File::Temp qw(tempfile); -use Date::Parse; -use Digest::SHA1 qw(sha1 sha1_hex sha1_base64); - -sub error { - my($s) = @_; - print ' *** ' . $s . ' ***' . "\n"; -} - -sub warning { - my ($s) = @_; - print ' ' . $s . "\n"; -} - -sub comment { - my($s) = @_; - print ' (' . $s . ')' . "\n"; -} - -while (<>) { - - # - # Handle certificate header line. - # - if (/BEGIN CERTIFICATE/) { - - # - # Create a temporary file for this certificate in PEM format. - # - ($fh, $filename) = tempfile(UNLINK => 1); - #print "temp file is: $filename\n"; - - # do not buffer output to the temporary file - select((select($fh), $|=1)[0]); - } - - # - # Put all lines into a temporary file. - # - print $fh $_; - - # - # If this is the last line of the certificate, actually do - # something with it. - # - if (/END CERTIFICATE/) { - # - # Don't close the temporary file yet, because that would cause it - # to be deleted. We've already arranged for buffering to be - # disabled, so the file can simply be passed to other applications - # as input, perhaps multiple times. - # - - # - # Use openssl to convert the certificate to text - # - my(@lines, $issuer, $issuerCN, $subject, $subjectCN, $pubSize); - $cmd = "openssl x509 -in $filename -noout -text -nameopt RFC2253 -modulus |"; - open(SSL, $cmd) || die "could not open openssl subcommand"; - while () { - push @lines, $_; - - # - # Extract the issuer and subject names. - # - if (/^\s*Issuer:\s*(.*)$/) { - $issuer = $1; - next; - } elsif (/^\s*Subject:\s*(.*)$/) { - $subject = $1; - next; - } - - # - # Extract the public key size. This is displayed differently - # in different versions of OpenSSL. - # - if (/RSA Public Key: \((\d+) bit\)/) { # OpenSSL 0.9x - $pubSize = $1; - next; - } elsif (/^\s*Public-Key: \((\d+) bit\)/) { # OpenSSL 1.0 - $pubSize = $1; - next; - } - - # - # Extract best-before date/time. - # - if (/Not After : (.*)$/) { - $notAfter = $1; - next; - } - - # - # Extract the public key exponent. - # - if (/Exponent: (\d+)/) { - $exponent = $1; - # print " exponent: $exponent\n"; - next; - } - - } - close SSL; - #print " text lines: $#lines\n"; - - # - # Close the temporary file, which will also cause - # it to be deleted. - # - close $fh; - - # - # Print a header, distinguishing the role of the certificate. - # - if ($subject eq $issuer) { - # self-signed certificate, i.e., root - print " \n"; # force blank line in Ant output - print "Root certificate:\n"; - print " Issuer: $issuer\n"; - } else { - # not self signed, must be intermediate - print "Intermediate certificate:\n"; - print " Issuer: $issuer\n"; - print " Subject: $subject\n"; - } - - if ($pubSize < 1024) { - error('PUBLIC KEY TOO SHORT'); - } elsif ($pubSize < 2048) { - warning("short public key of $pubSize bits"); - } - - #print " not after $notAfter\n"; - $days = (str2time($notAfter)-time())/86400.0; - if ($days < 0) { - print " *** EXPIRED ***\n"; - } elsif ($days < 365) { - $days = int($days); - print " *** expires in $days days at $notAfter\n"; - } elsif ($days < (365*2)) { - $days = int($days); - print " expires in $days days at $notAfter\n"; - } - - # - # Look for reasonable public exponent values. - # - if (($exponent & 1) == 0) { - error("RSA public exponent $exponent is even"); - } elsif ($exponent <= 3) { - error("insecure RSA public exponent $exponent"); - } elsif ($exponent < 65537) { - warning("small RSA public exponent $exponent") - } - - print "\n"; - } -} From 8d186450ce18e46001db1d3c1e9c92cfb787b977 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Wed, 11 Mar 2015 11:10:59 +0000 Subject: [PATCH 43/56] Update to ukf-mda 0.8.7 to get access to SAMLStringElementCheckingStage. --- .../{ukf-mda-0.8.6.jar => ukf-mda-0.8.7.jar} | Bin 78674 -> 80091 bytes 1 file changed, 0 insertions(+), 0 deletions(-) rename tools/ukf-mda/{ukf-mda-0.8.6.jar => ukf-mda-0.8.7.jar} (82%) diff --git a/tools/ukf-mda/ukf-mda-0.8.6.jar b/tools/ukf-mda/ukf-mda-0.8.7.jar similarity index 82% rename from tools/ukf-mda/ukf-mda-0.8.6.jar rename to tools/ukf-mda/ukf-mda-0.8.7.jar index 10840649fc46966aca2d3f3136a29b9d6d631e8c..39f3d9c519de0e842c1250e8835c0b68dd24a5cf 100644 GIT binary patch delta 7908 zcmZu$2RK&Y+kcO}vw7`ouf4L#mc2#D-mAzeUL@JYi-XL}j7pR}LX;}9W^fBRQGQb;+m_n<-|3wswT zMp)oti~YF3&;r76sRf9`WjG*pQeyFeh715PW(^>K6?=dxTqcE!BNK*# z%rSB{(m2sG*o5u}7yA>Y)iSIt^$Xe`u+I2rV@rJ6!Qatbax$mv!BfTDn4a`-U2hea zlN&?(9{r%}zzN1_%}idnG!Q*{v(9=*W0QIL<7SxLx`xP|>t_Yj$a@^*GK#i}u$_71SSv7-RXQvMP3u<{{ z?YK?C3M~VTD%;*H;rd)>D#02jGQV(d*n;Wa>QE|OtLX|sZKnUll>P$Z*X%sRUn1NR zesvER7)#`p>vTss(_4cpAA>(dRUhe?1uY4@vTKpKt*ceJI!$8D=~y5tiob;UsEfXl z*7R!GN+<}UqU2i@A?Y%n*Y!2Vc*P^p=K0fot_~mN%!h9$bq1)_E;f1*yiJf}7=CFL zELqsxyD?ruWkADQ_jW!2+zsc*$uWC+E&Q@p&S*c;r;M~B2LcP#izYS6q%>hG7NV&6 zkEUJ@Ixo(#@Y6qR53He-i#1Yl2w}mXrP!i*P=V)X9_Ez(1}fJ^b1|Dzd^@s7wd<(x zZgErrF@~zs02SUNj0#WhBELuwLL*B=RI0T5+VE@poiB@@`$`9GuQqp*%s*dpoy&RNtrgWC&vbsu3hO8nvGjb6`Ergv;UT7 zUQEYad9BIf*@Fm8R-uBPE4I%+{q#U0nrUlM@!|)@>guJ!#=+p z`I=x0A`|kZJlJ!^Ca2k=iA?HsZ(miGoSE0%A79`NE4aQ|SjT}o> zo>WtU$d0HoUK_WPG}t%*NfC_w$mzIB}(vx^eAw7MDu?kg__I=WvaWE&Fo5 zQ!$oqEh)y1=0@Z_#m9Q#W9T=yiYk{Xcmkq#dtXTrY!s7GY^nNQX~feKTAAXGz3$eF z)l{SPT&S@HnE9hb& z5SMW=SA;dt)u!GCRLbPx&lIG2Z&wSK7dV6%%^J&4-4|8SBGBfP*}7HQ+bH|cIW$)l3V!uMT!2JXCubQyTIJHuLiaUhQyoO!_h~CcEBDHy~=ctDIk+}+upG$ zLUbU}j<()w?%9>w&);R#NTj%wUw@UsxSD*=tCh;T5Z#!Pa<%JR(5%slBB2^@n)|xC zuvlWdc3MiImO}OUDqfl_0WO!!&3D`0Z6Cg2mo-!HrQ-lxWI`9X2E|m{jJ?G!RvKLr zp;ma%twH%L+Q+Zcv0*`7@l3XL|IVDhRVja*-KxaXwsmce#WQnsq=H?B6+@-(nU%Rn zoWN&B&b(+ziFsPt<>wy7iEl(nhMJ639^uI+<6dd44(1#0#XS<)cbF$Kx2hSPle&|y zB-b(g()G@`V5x##Ky3~B$=&mZ;Wh@t@u~I)<-x)Y%Y`B;tVT7Dkz6x$o?_m=bdO4h z%A(}xU&zG#{N49Uu3gHQEXK&suq!92>1K1LYw*qy8YM0-uUAiY=X-bsDQN%ID^%~` zTC}AUyA!WPMIL2OQuC9^cr5!SA<5kO#`iu9%1smcM>y{KwS4O#NR}LtvM|2!)i0G( zaTYJA!+2G9Mn`n?N;u?H%9NjwO*2_$<5?vHSZU-1o`3L+*!*YY+&!C*?Hvbc>KSf& zN4yIR0yesf@?UdWgFD-_UUza?m&8(k;j&+PMeCVwKRDU$u)v77Elnn=`mq*i8Y0|+ zpT6EBn(~}3Zc|o$zTmgpLyI5bzcJIHR2E`dp#|j&VpU3~CvAi%<;l!U7dybFI9_C5 z2a=X$VIvSNcnE|PhQfgpv_1>a*3O(OI+>>tvQJM0X~mQiVL(~qM4(Y0JQ0?((8TaG zcQtiBaX)M(N&;)J9h|UW!NW=PM96aqJ`s@aY$xXOUNtx{XVZ`AL~|w}5(kbhMX+y= z3>Se&fHouQn8IK_bih@2A6IoRXK!bp097|z#<*j-Z&mQVP6(bV$ax)s3P{N%0>ZEespGREIvpP^pGT`oho!r`sef-%v2 zuKgRS&YS1=$9Br*k}|XiP%bf8q!C?=fnv6gs>iS*oLc~o57-V zt8OVP@xW)1wEJXpwz|Lt)Xw8@((7ekRI_v6WAl=bzijnoqI-6`nEO^nWL<=|`3q0} zo0AuaX0?mRnm?BKn(`+y*t~Ni042npGS5_xQ5j{3%b}-dvwxVD83%5$E~q)ODJadp zjvvpx=DCJV>0nsmZ#;pdoS59(XAfJV5o#=vPZQ93l%8)JQgWXsE5J2i&p-EConseX zy$uytw}b=@#hbQruReSmYb2i4-e*!l?PkN*Tf)Jgl?I8D$H5MfFwcM#rxZ8f`WgNd z4jpP;cNVk)Rb8!{b6p_Md_?O6e)4#&CZoY3j>2FD_E!zJB)&!t;cNRc)f83+ttwN* zB-}^m=jGJa+mv_qJ_@h6ylhn&4yMvL44`UN!nmqw-k~C}gSHD;A<14QvL^RwNH5!^ zy|&+RB)QNRp7Z3+2MK4LReFJB@f`==l?j|WAoh|#wf)%-S0{`&oVaA>rp=2_mi0HZsXo7eryn6?XGIrOs0W7rjQ7%Qwh->io3 z*a5YlniDIT#Fb6l#Faa-8n#9J;VXhF{Bh>d~Y8E$&X85!F!&QXR?gk%NvRPqmK;z*&-%=rBM;lNc&rg| zU!8MWKY=y|B@t`V;WmeN!CGR4%3{$2X_9u{_?eXQVXLY!-REaxJ^CLCLSBUiyGTo= ziWhgPeB98g8u9LF__gF$WO{`G2ie9w*NdAh)jh1v(DG}WegC=Aw>xBl-*(K$@WTB4 zKg`REHeia1J}hh`(4ikiigvLq8QZg9y0CGMB0iaBN798P(hUBHA{?b&H0RD(LFSx6 zvufbG+!yJm>O5pu>10YllHDX5>=1a?5#{I17jrkhMPLXMOSRNbYEykxV}hH+BQ&8~ zWmGbmhP;}3SZ+D(HpBzbSRj!eExF_IBGNvW| z$+JJ&$&y-TrOPCZ;uckvABQFO6q~I#!RLYB4HS)?shk9U4BJg{U52!=mc%0)+;kS< zOB0c)_IwwMO)j8Sgi1`k`_frISt9a?88+M#)lIalx_)QaQRFf)v))z)&0i3|Hc;-+ zV$ZcxjqkBA_C`j^>}Qu=YttMes45c4)ObDp{$)LETr6%qQ^~gQ@mU(cTh3d%g|uJT_W{zSi&En$^VHuYt_-9@5JZeUteUSb5at#^eJU?ksvoG`a z-D*5e$BRrxUg*K7Dp9no5M!;2FO`lua+26DGHGK|a&RZsb)tIxiwhUTJWf`rLF~G=bpA)6PM; z>gG<{s4jP`-q+JRl;aH+Tow|ujg*pWq$wV;56)f>UKmB=TM|ge{*K?g5=ks@+cmI# zHqI+Bs`UKS^@KOfJ5NLBY^HrUg+zK+*BgXHK4-*cz6?u@Vt?L+o4(f^u5^K_>q;KY zTK^aJxPr{lJ+--JAtaUBGRe@rurAZ>x6Rs__HCe8w*A(-rMo#|ooT8*fpk^6h4=im z$U=&TkTNJQG` zBlwUoihVlq1@1E!QXKQ=Yl5T48cl_T;3l zM~bdp>;zoJu`YabQRR9P>+38mXjeQTEP>Lb^x%)m>rJFhEm(_YyO0*XpThge>r0XU zt%8?o@|tOnED6(vA6yO;3eXxUH_@YtFHeoG{;m8(dd8r;TaUpZeOtLPYp{2aPGgGm zUC&)!q!1BW#4Y@T`?+k#pKA^NL6%l)F-h!n=64c4zYBArda@p(IIg(nVA;^T+Ynx) zOHq?JwK;DeX3*E-IV;K6K(xv~U_$xZf00$`@L^mn*Sh`w4S&hL+VW`zzah!XHk-^* z42!`byYzV1qbaBbCVf^(u;rG?)|V2vNp>%RwXR{!==wWGa>J2b-mOhT{*TrNw#!4J z?i}E&v>OL!YWiM!D)VVIYV7Otyy-A)8oZyGm(=@=oz~Jatt@<$9>>}(NR)gI*qb6z zyqlyidGGpaRsJFodmia6?Z(lgqZuLvW&-99z9k!bh3X@jAtRG|$$WF$C_VQ0dJf^A z%l_&91Ec8KmWkVeKYwUrM+WrdwADWk4G%o*9q(O9HNhBpRJJ>W>^l-}*H6#BWe;0gSu+*ka>8Rb#<<1453aOmxVM;``x*bk^4t}I;sw{d{3 zfHknvFFkdKZiRiJM+SQI)J>HIFM!Q-fR-Z}pB}DQ0yPOKHHltTVq&%K0QFp$Ds>_W ziC$x$aYDTK_O=)4j=;`9<51}$)16AWxWR~$ z@c@4l%0`5t4uD0C{hym?(2X9DIKGPp^XUPl;|&4$o*oc_1xh3!1`C?VKTsU<%QTU%517HFRZ47|^UtAX!Y#9L~Sa`w+1i^v;6W{{xDgNC`g9S{0 zEerz803%io6{heU3#OHt0@Py$;Nvf7eGJr69|NEs3qXWI^H3l8Lyguw6{DLnD9Qz(F#76*7%~;cf0Ycf zL%wR%{-Uh^oRxoBX<{NqApDpR2(44jBDId`BH$ekfE%uN1Cc9*2X$c)^r)SpVw?Vl zN{D%6N(wSF{b>Y>6ROzL>>mt9Z~|q^^Zd}Z$c)g>3ENv!#T@nw_^gC?UDSq|2Li|)M{>k2d09o`2zJ&Ex(~jdb*ZGzY{78&!4y6fCs9p z(jV4hv;x@So`Id5x;i=)s&Ftg<{Y#p%6hsc|K~ahRAvJhUBgxDzu z1!2byKzv?+8D?hv?#fDqdf69Z%AH~|M?p*$j6xXeznpNF7Ydmm1_BtsUS2>F?z5v~ zC3Etz5+f7G|L+a(@92gh@X}}h~KO^6N43rkYZm>{LT0G8%GAKxSwh~O?2beHQ zr6@25^@m=0jAYgPMQA|}C?&u)XZRsR>)Brf57g%eIN)}m{Y<9%{d)t zu;ovg-tIqUVyb!=!3E(z$;d>uh*b#+M-5sJBu=sM24Ob;OR9ft_aLlSCeRz~2c7Sf zPqD#KFj5dOfFmGIc~`s$MX(1&Aa#m$;mt9N7o->ZGs^!CssEkjB4*%bK}S|b*r`K- zYL^RCZ51N|p?}J$@f^hD!RRf~VN$0k!DLZ@h#mf%piv?pG}#G-OAZ}ZRZiJ(e*R;_ z{I79p^)oxx5W5Jf<@8dZu?4YF;45K(1Mc??VW{7a_8_GSYz`}JL?Gp(-H3$XI+ zaRNAXAU+iVngjs11OavsIw2#$P2N9KN>&tL#AcxSgDH^#)W;1XfltY~5Qg=J8f+2; zm|+F9#v*Z!j&NzfLNRDTU=sU7XWrl_t@joBP{pkPz delta 6613 zcmZWu2|Sc*7oT^GHDt}c@5_vR&%Q=>lI*f1gtC@QStC>iuYGHiU1KZB-i8zvBH2Y! z%`GI$_s%=+?YiI0&pc<&|9{STmNUoOV*nLWiTDj-D%_?03_-p5QPfBE+Np1Ccjh_5Fg~WDe9hA1I805f(6G!HlhbQQ z)q89KeW&w8)lN?ww094)XrlJ3RMG5yb9DkM6gOFB-Iy~H+QR>~N&OJY^mKxX&3vFyV_nVxl!cx)U93QJl!)1K5adPYDT|pWMu=vT(v=N{YR8I zxmq8FUsA1Qsi5OhsGFJRf*)!mmNYyi1ZHTwHfgGCct2{lJY!tX_2s2^go^GD zgA0z6-t^T`6MmJ0J8NxHs@anwbyf6c?|DA-9@Q;S;=E(Mwyv33bSR-dx_;tB$gh4O zavC(>@lPE$YfY)o0W6y3ajsk|GdX!nM`rZ(>gBsVJw*wc{uKY(lQ1)D=qS%w|yAv z5=Wk&{vzGGq^xwBm7A`H-AE@Y;PmmX`-!Yo6_M4`zFTEegs0*3>IA+l6uF9)IiWnV zwa~nxm)A8YvhtSjz43S1TTfyJW{OtdrP@4Ke&B#JYmix89vTW%=4_f>@@}21L%&xh zKUkEqlM!1`&!A}Lnp>&1c6Q^?dsjCJ>|crex2BGr-_#fIe&jR8oTN%CVc8jV(j!F+ zL!pp10&HBYJmZi`K1O)R)UrK|(o6k9YxGej+s`3Q-p@BVo-=!+hy6_F8jW4MU4*W$ zQm*~mubHkk1Oi&YaIjRb&$o%onjOrha$H&Q0%gY)V(QHN3GG1%11HbzPG-h-Vncm2 zC{KrZiMLC|fLeu>85>+z8DdAEO3ZSy{>(S2Tn6(SsZ9k7b_47&B1nv;^@=J&&Cjz6Z6Yr}y* zga?E#8W(i2U5ehcVM;~uDd&QDU;g=Mbc?irq-SXem-(V+n z2G!5=d3_Yvk!?=Y62zDoiyX`NgjATbMYuHIDEYl+Z4+X4ecI}}M?sv$akqqmp8lxw z1T`0a0SP`+lVyMBGC$qrBiFM_(KdO)Sx!$MU$VND@am-Ck9aCg5xv23{-S0EP8w=D z54+`23a**Q}SIQnZ< zV1{a5*-|IYPVHno&r;70{VcF1{eWf>HQjU8cc-V5j@Ib=9WwtL%TEG2P2-OzBg_tO z>&#D`{Bkv(uqk%ZCVeEtJkjnGwnX@`@rw4}dp{L|xC^(Xr%Log&jI{><^uq{L3gmk zlXhxj_Arvr&gDXa_;~86Va~896$zS@NF)iqXjXuc=^q}6CVviYE#-d!u2GQleimb&7mJx`zeq}r|vw&F9c*%u=Z zZ30_Xy$bm8lt9i~zk|auySvxUy(~y7Ue`uMcZ^Fe)3ayuq@ zi_0`wT3+JHP2;q;XUnBH?wpX!6!Uv^<9qI>4Q#0Vc*^1FX2Ys}Ep6!~sVrIUh9Q66 zUd?VQ6aZNwRA1A*|bK&lZA9GsWUV>p5bw9VfT?Y^N}aSrP=E@`cv;*#1e=h4@z=;Pdfva?q( zn|*C(SAspU>XMBX42h*(3|I!JOh@R}vDjeR1KaIQ6=M1H(LA`l)>8KHp_@RGv+KDCI19nJgK zqhKL7n41)}<=kbGruyP}k{}uTi3G7GGEu=~$@ENmSm-SHN`mkuk#K>7$5e(VLO>#Pm+VozG%`om%SG zn@D8ZjcRfjdbB+NkES`57RZ6IW-(@<6(EC(K5(7|kYt1eBe)FQ`w#*>SOHO-22|7$ zIkv2T5o2VXs?nF_Ldzkjg99Q6gglXh!3GBfVj=?r=1({VO(-+Otk=4yAq=mY+%I&M zwJS9&KpM>|o6MBy7Pl}t^yQSHGVZrg6FzDPhgpr7a%rT+Er@)cR_T6V^71;(fg9~2 z^?J=5vxLR&G@D*O2Ct30U_Lh0Nd|2;zi%^xSEn>~pJ}T%JR5d8!u4ZdAPxIh&lJ`o zJv}|HU8blV`GodDrWy1oqCd#6MOI|%M^UsWcT92dfT)4(6{pAe`VQXDNPe^ zyWg-7p?;8Q(jX7E7madY-lt$h06(6nd92zfKYO1ES&_W z+mS|Z)WVd1-n(DCYC?7CUGAKYzDYtKGf)y|k901t7SKhFGgV6*xrHBPj%N&(7`^d> zp~nB1h<7q>O{*&Q5^mgvqNF7DD7Mj2Jg&@Hj#I7fd|jCR)z-Hrz3k!n5yN5 zAHKnclcR)~y4?G_qVWFK5zXUa(UsFVWRecpN89><{$JfC`P4s`rKv2bt~uqEV&|jk zOz^StvCg!F!))(pe|}JVEV231lY5MZE+5a=*!NcIlrHgwaLH{;l5&g-cj zAqMqI2kt-FT51XC&ucT6X7#p{=^$5r+&eN_xz?5(Hzkxcl+-CH12CMt*U*T6QRO*$ zxTdZ7`P=X7>$OM2nB17NpV|eoeHzviySd|sq#)d~H~zxd71L zrRH|>9X2~U>zeKSI$+WCP2GqAwnE@e;>z@8x)x~y%#|JvoEM@=^u=_)X68Dc`1NZo4cXz zJ6B%E<1BKjEB!ILsk4$ECC*Lz*AIg7O4D@=`LVc^&d%e>?I{iYp}*$~m+<41#&gI` zdhJr=dyfP|nlN{B&G^{1K~;>~f{1Wf=*lkDc)ehYnN}qI?dh3IZ#HC}WBtDfIxnc4HJh>Fk{hxP1!ia8HPD5!FlNTrjhW(| zmKspKUpf>|=IPhUYfieCyp#;(DaTrv9q{QvAIYG|2P?$iatONzaNcx1AFs<-=j6_C=E$Qo z0c&|@7WY?MPlf{&pRSFCEUw;f7^UMf#8mOJy>0v5FY5K-uYfxjM|t zJ7GnRc8y9%{CLHOAr6Z0ex8XwESov|N;AfHa5FrJ?`C)rS_I!s)~e#W}LX@XP(%{=_DGeLiW!+4H&}%C=zdKz(yWGoA`tW*LeU8EQs?0^045-y9X8Xl5S+cd0xO6 zhGh7Fqp%Re2iU^G8$Q6|Z-@)j;Rod4Z=w8vH7q>i2O?lWPXO@w&!r96BmlVb|N97m zfyy=Xzp9B_m*ZG)uTSyf-Z3+RG#G#uX7iWGQ6GlR2Aq`tW#_RH+2AW7fEsKP1X$q6 z1A+h-Qh?(h1b3003gi&lbC%YnmPZDK?S}re_l3^o{>KCi5CTN`h&|ozs{iIsjX<<> zAP`df=)b^vAwV6DxGDritQI4hXNWO@8o~fvnu4ankiJEdq^Abcg#k8rKsLA){TGlk zO{fpD`<&`xNMuS}KAP^&4D350?K5zc*)t%XnIzyYS8Y(ABzph<$vp>N7Xjc)HgHe` z>e>}~$XEy$EYAY>8SdM=aJsv>&}2V?YB!aAp%Rq$*ayIiqI)B`x&9034zaI7Z1sKY zbLx9+YH&&v;D+aER}=~=rS)%s60{Tp*kII83_{y=Ayg8q69Z)7?yNf;%k+l=ltOE7 zye|Ni;onT^48udg@&^VEDWLcSy@*U^bbL)#zTid80=$F-T|#;0eM_dC5!Z* zO^|e9u_)K4>;%n$6y#rdpB1)>Xk`HZZ2p|h{+sw1&`K5%0!N?^c>LS4&;WMvL{n~1 zS#EFJF_(k1rY*1*SJ1`}uFCFZB;6^L4mH&4@Pi11*1q^u9pDXq$n{S-Kmv9xAP+eS zd;)86Px`n(2F1N)ze+?_o|5=|@&F&q|3cJW>?dl)apSMKKy!sXzOw>^$PAN^v{A-C z3DikMeBP2`w7)<2CkCG)gs6^?Vz?;+YH*BvqLyaBzXV(bI;l!(O0)c|HO7u z2Dr$)DFK}BvM5-r43KgO^MobXAKF?Op_8`KzL*Gla7r1_clqxj7Fw9S7XxB<_whjh zVQy%ri#}puBopWn?tMn)PfEf6|1kQSPHct#`9d`Qd=PxC0*L%83IE^X&x3?$A Date: Wed, 11 Mar 2015 12:20:36 +0000 Subject: [PATCH 44/56] Check SAML elements with string type have some non-whitespace characters. Remove similarly motivated XSLT checks. Remove an explicitly blacklisted entity which had this problem. --- build/extract_locs.pl | 2 +- mdx/_rules/check_mdui.xsl | 36 ------------------------------------ mdx/common-beans.xml | 22 +++++++++++++++++++--- mdx/validation-beans.xml | 27 +++++++++++++++++++++++++++ 4 files changed, 47 insertions(+), 40 deletions(-) diff --git a/build/extract_locs.pl b/build/extract_locs.pl index a516194d..94b360a1 100755 --- a/build/extract_locs.pl +++ b/build/extract_locs.pl @@ -2,7 +2,7 @@ use Xalan; -open(XML, xalanCall . " -IN ../mdx/uk/collected.xml -XSL extract_locs.xsl|") || die "could not open input file"; +open(XML, xalanCall . " -IN edugain.xml -XSL extract_locs.xsl|") || die "could not open input file"; while () { chop; if (/^https:\/\/([^\/:]+(:\d+)?)(\/|$)/) { diff --git a/mdx/_rules/check_mdui.xsl b/mdx/_rules/check_mdui.xsl index 47f789b1..796c1d3f 100644 --- a/mdx/_rules/check_mdui.xsl +++ b/mdx/_rules/check_mdui.xsl @@ -28,42 +28,6 @@ --> - - - - mdui:DisplayName must not be empty - - - - - mdui:Description must not be empty - - - - - mdui:Keywords must not be empty - - - - - mdui:IPHint must not be empty - - - - - mdui:DomainHint must not be empty - - - - - mdui:GeolocationHint must not be empty - - - + + + + + + + - - -
          + + + From f63653a950220ccd0c5d298a5b7f763470403ebe Mon Sep 17 00:00:00 2001 From: Ian Young Date: Tue, 19 May 2015 11:24:42 +0000 Subject: [PATCH 55/56] Add breakdown by software of non-SAML-2 IdPs. --- mdx/uk/statistics.xsl | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mdx/uk/statistics.xsl b/mdx/uk/statistics.xsl index 6485d03c..ee396fa7 100644 --- a/mdx/uk/statistics.xsl +++ b/mdx/uk/statistics.xsl @@ -1216,7 +1216,12 @@ 'urn:oasis:names:tc:SAML:2.0:protocol'))]]"/> - +

          Identity Providers Without SAML 2.0 Support

          + + + + From 63c86df3f429a6c9c4541b2b855f9b1f206b8bc8 Mon Sep 17 00:00:00 2001 From: Ian Young Date: Fri, 22 May 2015 09:08:45 +0000 Subject: [PATCH 56/56] Promote check for saml2int section 6.1. Look for metadata for a SingleSignOnService with HTTP-Redirect binding on a SAML 2 IdP. --- mdx/_rules/check_future_0.xsl | 17 ----------------- mdx/_rules/check_saml2int.xsl | 17 +++++++++++++++++ 2 files changed, 17 insertions(+), 17 deletions(-) diff --git a/mdx/_rules/check_future_0.xsl b/mdx/_rules/check_future_0.xsl index f43d4697..fe932075 100644 --- a/mdx/_rules/check_future_0.xsl +++ b/mdx/_rules/check_future_0.xsl @@ -30,21 +30,4 @@ --> - - - - SAML 2.0 IDPSSODescriptor does not support HTTP-Redirect SSO binding - - - diff --git a/mdx/_rules/check_saml2int.xsl b/mdx/_rules/check_saml2int.xsl index 8e00e073..812fe87e 100644 --- a/mdx/_rules/check_saml2int.xsl +++ b/mdx/_rules/check_saml2int.xsl @@ -61,6 +61,23 @@ + + + + SAML 2.0 IDPSSODescriptor does not support HTTP-Redirect SSO binding + + +