From 2bc864fb1b502d278080862f546654c63c7fa63d Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 18 May 2010 16:12:43 +0000
Subject: [PATCH] Check that an IdP registered by the UK federation has at
 least one Scope element.

---
 build/check_imported.xsl | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/build/check_imported.xsl b/build/check_imported.xsl
index 926c53b3..8ac86eb7 100644
--- a/build/check_imported.xsl
+++ b/build/check_imported.xsl
@@ -26,10 +26,14 @@
 	<xsl:import href="check_framework.xsl"/>
 
 	<!--
-		Look for IdPs which have either attribute authority or artifact resolution locations
-		on the same host:port combination as any of the SSO locations.
+		Checks for IdPs.
 	-->
 	<xsl:template match="md:EntityDescriptor[md:IDPSSODescriptor]">
+		<!--
+			Look for IdPs which have either attribute authority or artifact resolution locations
+			on the same host:port combination as any of the SSO locations.
+		-->
+		
 		<!-- XPath expression to evaluate to extract host:port strings from locations -->
 		<xsl:variable name="extract">substring-before(substring-after(concat(., '/'), 'https://'), '/')</xsl:variable>
 		
@@ -52,6 +56,15 @@
 				<xsl:with-param name="m">at least one SOAP location on same vhost as an SSO location</xsl:with-param>
 			</xsl:call-template>
 		</xsl:if>
+		
+		<!--
+			IdPs registered with the UK federation are expected to have at least one scope.
+		-->
+		<xsl:if test="not(descendant::shibmd:Scope)">
+			<xsl:call-template name="fatal">
+				<xsl:with-param name="m">this IdP does not have any Scope elements</xsl:with-param>
+			</xsl:call-template>
+		</xsl:if>		
 	</xsl:template>
 	
 </xsl:stylesheet>