From 2ab829d6d3db9b97f9d2c1f2e470998625c33bf1 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 29 Jan 2021 14:54:43 +0000
Subject: [PATCH] Accept mil.no as a non-regex scope from eduGAIN in InCommon

---
 mdx/incommon/edugain-policy.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/mdx/incommon/edugain-policy.xml b/mdx/incommon/edugain-policy.xml
index eaf4b0bc..8b7c8f10 100644
--- a/mdx/incommon/edugain-policy.xml
+++ b/mdx/incommon/edugain-policy.xml
@@ -301,6 +301,16 @@
                                 p:regex="" p:message="scope element must not be empty"/>
                             <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
                                 p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
+
+                            <!--
+                                Explicitly accept domains which, although they
+                                fall afoul of the public suffic heuristic, are
+                                nevertheless known to be legitimately used as
+                                security domains.
+                            -->
+                            <bean p:id="mil.no" parent="inc.AcceptStringValueValidator"
+                                p:value="mil.no"/>
+
                             <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
                                 p:message="scope is not a valid domain name: %s">
                                 <property name="validators">