From 6ebce1555f442aa48c8abcb9f6ab84e515b8e337 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 9 Jul 2012 16:23:22 +0000
Subject: [PATCH] Promote saml2int check that all SAML 2.0 IdPs have embedded
 key material to production.

---
 build/check_saml2int.xsl | 23 +++++++++++++++++++++++
 mdx/check_future_0.xsl   | 17 -----------------
 2 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/build/check_saml2int.xsl b/build/check_saml2int.xsl
index c4b828b2..66340acd 100644
--- a/build/check_saml2int.xsl
+++ b/build/check_saml2int.xsl
@@ -106,4 +106,27 @@
 		</xsl:call-template>
 	</xsl:template>
 	
+	<!--
+		Section 9.1
+		
+		Responses MUST be signed, so appropriate IdP roles MUST include embedded key material
+		suitable for signing those responses.
+	-->
+	<xsl:template match="md:IDPSSODescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][@use='signing'])]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][not(@use)])]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 IdP has no embedded signing key</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][@use='signing'])]
+		[not(md:KeyDescriptor[descendant::ds:X509Data][not(@use)])]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 AttributeAuthority has no embedded signing key</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
 </xsl:stylesheet>
diff --git a/mdx/check_future_0.xsl b/mdx/check_future_0.xsl
index 735c1b54..807ebacb 100644
--- a/mdx/check_future_0.xsl
+++ b/mdx/check_future_0.xsl
@@ -29,21 +29,4 @@
 	-->
 	<xsl:import href="../build/check_framework.xsl"/>
 
-	<xsl:template match="md:IDPSSODescriptor
-		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
-		[not(md:KeyDescriptor[descendant::ds:X509Data][@use='signing'])]
-		[not(md:KeyDescriptor[descendant::ds:X509Data][not(@use)])]">
-		<xsl:call-template name="error">
-			<xsl:with-param name="m">SAML 2.0 IdP has no embedded signing key</xsl:with-param>
-		</xsl:call-template>
-	</xsl:template>
-	<xsl:template match="md:AttributeAuthorityDescriptor
-		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
-		[not(md:KeyDescriptor[descendant::ds:X509Data][@use='signing'])]
-		[not(md:KeyDescriptor[descendant::ds:X509Data][not(@use)])]">
-		<xsl:call-template name="error">
-			<xsl:with-param name="m">SAML 2.0 AttributeAuthority has no embedded signing key</xsl:with-param>
-		</xsl:call-template>
-	</xsl:template>
-		
 </xsl:stylesheet>