From 45c05591c3adc6ac12d807ad6f6f292eb1df7902 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 25 Jun 2009 11:56:50 +0000
Subject: [PATCH] Add checks for role descriptors lacking KeyDescriptor
 elements.

---
 build/check.xsl | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/build/check.xsl b/build/check.xsl
index 27dcd4a0..ad7e9f4f 100644
--- a/build/check.xsl
+++ b/build/check.xsl
@@ -121,6 +121,29 @@
 		</xsl:call-template>
 	</xsl:template>
 	
+
+	<!--
+		Check for role descriptors with missing KeyDescriptor elements.
+	-->
+	
+	<xsl:template match="md:IDPSSODescriptor[not(md:KeyDescriptor)]">
+		<xsl:call-template name="fatal">
+			<xsl:with-param name="m">IdP SSO Descriptor lacking KeyDescriptor</xsl:with-param>
+		</xsl:call-template>	
+	</xsl:template>
+
+	<xsl:template match="md:SPSSODescriptor[not(md:KeyDescriptor)]">
+		<xsl:call-template name="fatal">
+			<xsl:with-param name="m">SP SSO Descriptor lacking KeyDescriptor</xsl:with-param>
+		</xsl:call-template>	
+	</xsl:template>
+	
+	<xsl:template match="md:AttributeAuthorityDescriptor[not(md:KeyDescriptor)]">
+		<xsl:call-template name="fatal">
+			<xsl:with-param name="m">IdP AA Descriptor lacking KeyDescriptor</xsl:with-param>
+		</xsl:call-template>	
+	</xsl:template>
+	
 	
 	<!--
 		Check for a construct which is known to cause the Shibboleth 1.3 SP to dump core.