From 3343bd66551b3ca12dee3081d8e5f72c370e4e20 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 11 Jul 2012 09:59:12 +0000
Subject: [PATCH] Look for SAML 2.0 IdPs which have PKIX-style KeyDescriptors.

---
 mdx/check_future_0.xsl | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/mdx/check_future_0.xsl b/mdx/check_future_0.xsl
index 807ebacb..4b1b613e 100644
--- a/mdx/check_future_0.xsl
+++ b/mdx/check_future_0.xsl
@@ -29,4 +29,22 @@
 	-->
 	<xsl:import href="../build/check_framework.xsl"/>
 
+	<!--
+		Look for SAML 2.0 IdPs whose metadata includes pure PKIX KeyDescriptor elements.
+	-->
+	<xsl:template match="md:IDPSSODescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[md:KeyDescriptor[not(descendant::ds:X509Data)]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 IdP has KeyDescriptor without embedded key</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[md:KeyDescriptor[not(descendant::ds:X509Data)]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 AttributeAuthority has KeyDescriptor without embedded key</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+
 </xsl:stylesheet>