From 39957e942576780548abe59aa501cd4db39751a5 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 15 Mar 2012 15:04:24 +0000
Subject: [PATCH] Extend the saml2int IdP transient identifier test to the
 attribute authority (if present).

---
 build/check_saml2int.xsl | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/build/check_saml2int.xsl b/build/check_saml2int.xsl
index 5b442cdf..1295f0f8 100644
--- a/build/check_saml2int.xsl
+++ b/build/check_saml2int.xsl
@@ -61,6 +61,14 @@
 			<xsl:with-param name="m">SAML 2.0 IDPSSODescriptor excludes SAML 2 transient name identifier format</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[md:NameIDFormat]
+		[not(md:NameIDFormat[.='urn:oasis:names:tc:SAML:2.0:nameid-format:transient'])]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 AttributeAuthorityDescriptor excludes SAML 2 transient name identifier format</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
 	
 	<!--
 		Section 7.