Check that an IdP with a SAML 2.0 AttributeAuthority has an Attribute…

…Service with an appropriate Binding.
InCommon · Mar 15, 2012 · 8d9757f · 8d9757f
1 parent 39957e9
commit 8d9757f
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/build/check_saml2.xsl b/build/check_saml2.xsl
@@ -42,4 +42,16 @@
 		</xsl:call-template>
 	</xsl:template> 
 
+	<!--
+        A SAML 2.0 IdP with an AttributeAuthority needs an AttributeService with an appropriate Binding.
+    -->
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[not(md:AttributeService[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:SOAP'])]
+		">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 AttributeAuthority missing appropriately bound AttributeService</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+
 </xsl:stylesheet>