From 3ecf61c537bca9b3befdd022d912936ea915e53a Mon Sep 17 00:00:00 2001
From: Alex Stuart <alex.stuart@jisc.ac.uk>
Date: Fri, 22 Jul 2022 11:07:20 +0100
Subject: [PATCH] Add metadata checks for conformance with Sirtfi version 2.0
 specification

See ukf/ukf-meta#352 for details
---
 mdx/_rules/check_sirtfi2.xsl                  | 86 +++++++++++++++++++
 tests/manual/ukf-meta-352/README.md           |  8 ++
 .../both-entity-attributes-as-spec.xml        | 15 ++++
 ...-entity-attributes-separate-attributes.xml | 17 ++++
 .../ukf-meta-352/correctly-specified.xml      | 20 +++++
 .../entity-attribute-contact-with-email.xml   | 18 ++++
 ...ntity-attribute-contact-with-givenname.xml | 18 ++++
 tests/manual/ukf-meta-352/no-sirtfi-v1.xml    | 19 ++++
 .../ukf-meta-352/only-entity-attribute.xml    | 14 +++
 9 files changed, 215 insertions(+)
 create mode 100644 mdx/_rules/check_sirtfi2.xsl
 create mode 100644 tests/manual/ukf-meta-352/README.md
 create mode 100644 tests/manual/ukf-meta-352/both-entity-attributes-as-spec.xml
 create mode 100644 tests/manual/ukf-meta-352/both-entity-attributes-separate-attributes.xml
 create mode 100644 tests/manual/ukf-meta-352/correctly-specified.xml
 create mode 100644 tests/manual/ukf-meta-352/entity-attribute-contact-with-email.xml
 create mode 100644 tests/manual/ukf-meta-352/entity-attribute-contact-with-givenname.xml
 create mode 100644 tests/manual/ukf-meta-352/no-sirtfi-v1.xml
 create mode 100644 tests/manual/ukf-meta-352/only-entity-attribute.xml

diff --git a/mdx/_rules/check_sirtfi2.xsl b/mdx/_rules/check_sirtfi2.xsl
new file mode 100644
index 00000000..ca01e9b5
--- /dev/null
+++ b/mdx/_rules/check_sirtfi2.xsl
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    check_sirtfi2.xsl
+
+    Checking ruleset containing rules associated with the Sirtfi version 2.0 specification,
+    as described on the REFEDS page https://refeds.org/sirtfi and with specifcation at:
+
+        https://refeds.org/wp-content/uploads/2022/08/Sirtfi-v2.pdf
+
+-->
+<xsl:stylesheet version="1.0"
+    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:remd="http://refeds.org/metadata"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+    xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+    <!--
+        Common support functions.
+    -->
+    <xsl:import href="check_framework.xsl"/>
+
+    <!--
+        Process only entities claiming Sirtfi version 2 compliance.
+    -->
+    <xsl:template match="md:EntityDescriptor[
+            md:Extensions/mdattr:EntityAttributes/saml:Attribute[@NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:uri']
+                [@Name='urn:oasis:names:tc:SAML:attribute:assurance-certification']
+            /saml:AttributeValue[.='https://refeds.org/sirtfi2']
+        ]">
+
+        <!--
+            Collect the REFEDS security contacts for this entity.
+        -->
+        <xsl:variable name="securityContacts"
+            select="md:ContactPerson
+            [@contactType='other']
+            [@remd:contactType='http://refeds.org/metadata/contactType/security']"/>
+
+        <!--
+            There must be at least one REFEDS security contact.
+        -->
+        <xsl:if test="count($securityContacts) = 0">
+            <xsl:call-template name="error">
+                <xsl:with-param name="m">Sirtfi version 2 requires a REFEDS security contact</xsl:with-param>
+            </xsl:call-template>
+        </xsl:if>
+
+        <!--
+            REFEDS security contacts used in Sirtfi version 2 compliant entities need to have
+            GivenName and EmailAddress attributes.
+        -->
+        <xsl:for-each select="$securityContacts">
+            <xsl:if test="not(md:GivenName)">
+                <xsl:call-template name="error">
+                    <xsl:with-param name="m">Sirtfi version 2 requires a REFEDS security contact to have a GivenName</xsl:with-param>
+                </xsl:call-template>
+            </xsl:if>
+            <xsl:if test="not(md:EmailAddress)">
+                <xsl:call-template name="error">
+                    <xsl:with-param name="m">Sirtfi version 2 requires a REFEDS security contact to have an EmailAddress</xsl:with-param>
+                </xsl:call-template>
+            </xsl:if>
+        </xsl:for-each>
+
+        <!--
+            Sirtfi version 2 requires that the entity also asserts the original Sirtfi entity attribute
+        -->
+        <xsl:if test="not(
+                ./md:Extensions/mdattr:EntityAttributes/saml:Attribute
+                [@NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:uri']
+                [@Name='urn:oasis:names:tc:SAML:attribute:assurance-certification']
+                /saml:AttributeValue[.='https://refeds.org/sirtfi'])
+            ">
+            <xsl:call-template name="error">
+                <xsl:with-param name="m">Sirtfi version 2 requires the entity to also support the original Sirtfi entity attribute</xsl:with-param>
+            </xsl:call-template>
+        </xsl:if>
+
+    </xsl:template>
+
+</xsl:stylesheet>
diff --git a/tests/manual/ukf-meta-352/README.md b/tests/manual/ukf-meta-352/README.md
new file mode 100644
index 00000000..b1636678
--- /dev/null
+++ b/tests/manual/ukf-meta-352/README.md
@@ -0,0 +1,8 @@
+
+Manual tests for checking Sirtfi version 2 conformance
+
+Run the following bash command in this directory to see the thrown errors
+
+```bash
+for i in *.xml; do echo $i; xsltproc ../../../mdx/_rules/check_sirtfi2.xsl $i; done
+```
diff --git a/tests/manual/ukf-meta-352/both-entity-attributes-as-spec.xml b/tests/manual/ukf-meta-352/both-entity-attributes-as-spec.xml
new file mode 100644
index 00000000..9dfb6ece
--- /dev/null
+++ b/tests/manual/ukf-meta-352/both-entity-attributes-as-spec.xml
@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:remd="http://refeds.org/metadata"
+    entityID="https://example.ac.uk/both-entity-attributes-as-spec">
+    <Extensions>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi2</saml:AttributeValue>
+                <saml:AttributeValue>https://refeds.org/sirtfi</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-352/both-entity-attributes-separate-attributes.xml b/tests/manual/ukf-meta-352/both-entity-attributes-separate-attributes.xml
new file mode 100644
index 00000000..b659e1cf
--- /dev/null
+++ b/tests/manual/ukf-meta-352/both-entity-attributes-separate-attributes.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:remd="http://refeds.org/metadata"
+    entityID="https://example.ac.uk/both-entity-attributes-separate-attributes">
+    <Extensions>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi2</saml:AttributeValue>
+            </saml:Attribute>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-352/correctly-specified.xml b/tests/manual/ukf-meta-352/correctly-specified.xml
new file mode 100644
index 00000000..8f94a096
--- /dev/null
+++ b/tests/manual/ukf-meta-352/correctly-specified.xml
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:remd="http://refeds.org/metadata"
+    entityID="https://example.ac.uk/correctly-specified">
+    <Extensions>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi2</saml:AttributeValue>
+                <saml:AttributeValue>https://refeds.org/sirtfi</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+    <ContactPerson contactType="other"
+        remd:contactType="http://refeds.org/metadata/contactType/security">
+       <GivenName>Name of the security contact</GivenName>
+       <EmailAddress>mailto:csirt@example.ac.uk</EmailAddress>
+    </ContactPerson>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-352/entity-attribute-contact-with-email.xml b/tests/manual/ukf-meta-352/entity-attribute-contact-with-email.xml
new file mode 100644
index 00000000..c4e31921
--- /dev/null
+++ b/tests/manual/ukf-meta-352/entity-attribute-contact-with-email.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:remd="http://refeds.org/metadata"
+    entityID="https://example.ac.uk/entity-attribute-contact-with-email">
+    <Extensions>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi2</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+    <ContactPerson contactType="other"
+        remd:contactType="http://refeds.org/metadata/contactType/security">
+       <EmailAddress>mailto:csirt@example.ac.uk</EmailAddress>
+    </ContactPerson>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-352/entity-attribute-contact-with-givenname.xml b/tests/manual/ukf-meta-352/entity-attribute-contact-with-givenname.xml
new file mode 100644
index 00000000..4463e155
--- /dev/null
+++ b/tests/manual/ukf-meta-352/entity-attribute-contact-with-givenname.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:remd="http://refeds.org/metadata"
+    entityID="https://example.ac.uk/entity-attribute-contact-with-givenname">
+    <Extensions>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi2</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+    <ContactPerson contactType="other"
+        remd:contactType="http://refeds.org/metadata/contactType/security">
+       <GivenName>Name of the security contact</GivenName>
+    </ContactPerson>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-352/no-sirtfi-v1.xml b/tests/manual/ukf-meta-352/no-sirtfi-v1.xml
new file mode 100644
index 00000000..5cc6f845
--- /dev/null
+++ b/tests/manual/ukf-meta-352/no-sirtfi-v1.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:remd="http://refeds.org/metadata"
+    entityID="https://example.ac.uk/no-sirtfi-v1">
+    <Extensions>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi2</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+    <ContactPerson contactType="other"
+        remd:contactType="http://refeds.org/metadata/contactType/security">
+       <GivenName>Name of the security contact</GivenName>
+       <EmailAddress>mailto:csirt@example.ac.uk</EmailAddress>
+    </ContactPerson>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-352/only-entity-attribute.xml b/tests/manual/ukf-meta-352/only-entity-attribute.xml
new file mode 100644
index 00000000..9b140613
--- /dev/null
+++ b/tests/manual/ukf-meta-352/only-entity-attribute.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:remd="http://refeds.org/metadata"
+    entityID="https://example.ac.uk/only-entity-attribute">
+    <Extensions>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi2</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+</EntityDescriptor>