From 59fc6950c19bad0fbf091f2c3311c942cb71e28b Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 17 May 2012 10:27:05 +0000
Subject: [PATCH] "Future" check looking for a signing certificate on SAML 2.0
 IdP roles, as some SAML 2.0 SP software does not support PKIX.

---
 mdx/check_future_0.xsl | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/mdx/check_future_0.xsl b/mdx/check_future_0.xsl
index e2732140..b3da4982 100644
--- a/mdx/check_future_0.xsl
+++ b/mdx/check_future_0.xsl
@@ -29,5 +29,21 @@
 	-->
 	<xsl:import href="../build/check_framework.xsl"/>
 
-	
+	<xsl:template match="md:IDPSSODescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][@use='signing'])]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][not(@use)])]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 IdP has no signing key</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][@use='signing'])]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][not(@use)])]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 AttributeAuthority has no signing key</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+		
 </xsl:stylesheet>