From 3cfbc2728cf7d17f178b372d599e348ab04c7880 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 6 Jun 2012 09:44:30 +0000
Subject: [PATCH] Bug 920 - Ensure appropriate protocolSupportEnumeration
 tokens exist for all endpoints Leave one test hanging as a "future" test
 because we have one deviant entity at present.

---
 build/check_saml1.xsl  | 39 +++++++++++++++++++++++++++++++++++++++
 build/check_saml2.xsl  | 26 ++++++++++++++++++++++++++
 mdx/check_future_1.xsl | 12 ++++++++++++
 3 files changed, 77 insertions(+)

diff --git a/build/check_saml1.xsl b/build/check_saml1.xsl
index 8719a4ed..92de66c5 100644
--- a/build/check_saml1.xsl
+++ b/build/check_saml1.xsl
@@ -41,4 +41,43 @@
 		</xsl:call-template>
 	</xsl:template>
 	
+	<!--
+        Use of SAML 1.0 bindings requires SAML 1.1 in protocolSupportEnumeration.
+    -->
+	<xsl:template match="md:IDPSSODescriptor
+		[not(contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:1.1:protocol'))]
+		[md:*/@Binding[starts-with(., 'urn:oasis:names:tc:SAML:1.0:')]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>SAML 1.0 binding requires SAML 1.1 token in IDPSSODescriptor/@protocolSupportEnumeration</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<!--
+        Use of SAML 1.0 bindings requires SAML 1.1 in protocolSupportEnumeration.
+    -->
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[not(contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:1.1:protocol'))]
+		[md:*/@Binding[starts-with(., 'urn:oasis:names:tc:SAML:1.0:')]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>SAML 1.0 binding requires SAML 1.1 token in AttributeAuthorityDescriptor/@protocolSupportEnumeration</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<!--
+        Use of SAML 1.0 bindings requires SAML 1.1 in protocolSupportEnumeration.
+    -->
+	<xsl:template match="md:SPSSODescriptor
+		[not(contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:1.1:protocol'))]
+		[md:*/@Binding[starts-with(., 'urn:oasis:names:tc:SAML:1.0:')]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>SAML 1.0 binding requires SAML 1.1 token in SPSSODescriptor/@protocolSupportEnumeration</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
 </xsl:stylesheet>
diff --git a/build/check_saml2.xsl b/build/check_saml2.xsl
index d4d38b8f..942dd572 100644
--- a/build/check_saml2.xsl
+++ b/build/check_saml2.xsl
@@ -68,4 +68,30 @@
 		</xsl:call-template>
 	</xsl:template>
 	
+	<!--
+        Use of SAML 2.0 bindings requires SAML 2.0 in protocolSupportEnumeration.
+    -->
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[not(contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol'))]
+		[md:*/@Binding[starts-with(., 'urn:oasis:names:tc:SAML:2.0:bindings:')]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>SAML 2.0 binding requires SAML 2.0 token in AttributeAuthorityDescriptor/@protocolSupportEnumeration</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<!--
+        Use of SAML 2.0 bindings requires SAML 2.0 in protocolSupportEnumeration.
+    -->
+	<xsl:template match="md:SPSSODescriptor
+		[not(contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol'))]
+		[md:*/@Binding[starts-with(., 'urn:oasis:names:tc:SAML:2.0:bindings:')]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>SAML 2.0 binding requires SAML 2.0 token in SPSSODescriptor/@protocolSupportEnumeration</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
 </xsl:stylesheet>
diff --git a/mdx/check_future_1.xsl b/mdx/check_future_1.xsl
index 255e2fba..4ac9815b 100644
--- a/mdx/check_future_1.xsl
+++ b/mdx/check_future_1.xsl
@@ -29,5 +29,17 @@
 	-->
 	<xsl:import href="../build/check_framework.xsl"/>
 
+	<!--
+		Use of SAML 2.0 bindings requires SAML 2.0 in protocolSupportEnumeration.
+	-->
+	<xsl:template match="md:IDPSSODescriptor
+		[not(contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol'))]
+		[md:*/@Binding[starts-with(., 'urn:oasis:names:tc:SAML:2.0:bindings:')]]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>SAML 2.0 binding requires SAML 2.0 token in IDPSSODescriptor/@protocolSupportEnumeration</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
 	
 </xsl:stylesheet>