From 21d93201dc36950f757c90380d8843ec43f14173 Mon Sep 17 00:00:00 2001
From: Alex Stuart <alex.stuart@jisc.ac.uk>
Date: Tue, 27 Feb 2018 11:42:10 +0000
Subject: [PATCH] Add future check for multiple SLO elements with the same
 Binding.

See ukf/ukf-meta#155
---
 mdx/_rules/check_future_1.xsl | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/mdx/_rules/check_future_1.xsl b/mdx/_rules/check_future_1.xsl
index ed05b114..c6d5d479 100644
--- a/mdx/_rules/check_future_1.xsl
+++ b/mdx/_rules/check_future_1.xsl
@@ -27,4 +27,31 @@
     -->
     <xsl:import href="check_framework.xsl"/>
 
+    <!--
+
+        It does not make sense for an IdP to have more than one SingleLogoutService
+        with any of a list of SAML 2.0 front-channel bindings.
+
+        See ukf/ukf-meta#155
+
+    -->
+    <xsl:template match="md:SingleLogoutService[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'][position()>1]">
+        <xsl:call-template name="error">
+            <xsl:with-param name="m">more than one SingleLogoutService with SAML 2.0 HTTP-POST binding</xsl:with-param>
+        </xsl:call-template>
+    </xsl:template>
+
+    <xsl:template match="md:SingleLogoutService[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign'][position()>1]">
+        <xsl:call-template name="error">
+            <xsl:with-param name="m">more than one SingleLogoutService with SAML 2.0 HTTP-POST-SimpleSign binding</xsl:with-param>
+        </xsl:call-template>
+    </xsl:template>
+
+    <xsl:template match="md:SingleLogoutService[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'][position()>1]">
+        <xsl:call-template name="error">
+            <xsl:with-param name="m">more than one SingleLogoutService with SAML 2.0 HTTP-Redirect binding</xsl:with-param>
+        </xsl:call-template>
+    </xsl:template>
+
+
 </xsl:stylesheet>