Discard inappropriate metadata elements during entity registration

See ukf/ukf-meta#228 for details
InCommon · Sep 24, 2020 · 9832a83 · 9832a83
1 parent c98bafa
commit 9832a83
Show file tree

Hide file tree

Showing 4 changed files with 385 additions and 0 deletions.
diff --git a/mdx/uk/import.xsl b/mdx/uk/import.xsl
@@ -127,6 +127,8 @@
 
                 <!--
                     Dummy elements to include for IdPs only.
+
+                    Any incoming mdattr:EntityAttributes are discarded by a rule below
                 -->
                 <xsl:if test="md:IDPSSODescriptor">
                     <xsl:comment> *** VERIFY OR REMOVE THE FOLLOWING ELEMENT *** </xsl:comment>
@@ -311,6 +313,33 @@
     -->
     <xsl:template match="mdrpi:RegistrationInfo"/>
 
+    <!--
+        *******************************************
+        ***                                     ***
+        ***   M D A T T R   N A M E S P A C E   ***
+        ***                                     ***
+        *******************************************
+    -->
+
+    <!--
+        Remove all EntityAttributes on import
+    -->
+    <xsl:template match="mdattr:EntityAttributes"/>
+
+
+    <!--
+        ***************************************************
+        ***                                             ***
+        ***   U K F E D L A B E L   N A M E S P A C E   ***
+        ***                                             ***
+        ***************************************************
+    -->
+
+    <!--
+        Remove elements that may have been copied from published metadata
+    -->
+    <xsl:template match="ukfedlabel:UKFederationMember"/>
+    <xsl:template match="ukfedlabel:AccountableUsers"/>
 
     <!--
         *************************************

diff --git a/tests/manual/ukf-meta-228/README.md b/tests/manual/ukf-meta-228/README.md
@@ -0,0 +1,8 @@
+# Tests for discarding inappropriate metadata on entity registration
+
+sp.xml and idp.xml have EntityAttribute elements that we wish to discard on import
+because most Entity Attributes require some checking by the helpdesk.
+
+sp.xml and idp.xml also include elements in the ukfedlabel namespace that
+have been seen on import, presumably they have been cut-and-pasted into
+the EntityDescriptor by the entity operator
diff --git a/tests/manual/ukf-meta-228/idp.xml b/tests/manual/ukf-meta-228/idp.xml
@@ -0,0 +1,244 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+     This is example metadata only. Do *NOT* supply it as is without review,
+     and do *NOT* provide it in real time to your partners.
+
+     This metadata is not dynamic - it will not change as your configuration changes.
+-->
+<EntityDescriptor  xmlns="urn:oasis:names:tc:SAML:2.0:metadata" 
+      xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
+    xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+    xmlns:init="urn:oasis:names:tc:SAML:profiles:SSO:request-init"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+    xmlns:remd="http://refeds.org/metadata"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+
+xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:shibmd="urn:mace:shibboleth:metadata:1.0" xmlns:xml="http://www.w3.org/XML/1998/namespace" xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui" entityID="https://test-idp.ukfederation.org.uk/idp/shibboleth">
+
+<Extensions>
+<ukfedlabel:UKFederationMember orgID="bogus"/>
+<ukfedlabel:AccountableUsers/>
+        <mdattr:EntityAttributes>
+            <saml:Attribute Name="urn:oasis:names:tc:SAML:attribute:assurance-certification" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>https://refeds.org/sirtfi</saml:AttributeValue>
+            </saml:Attribute>
+            <saml:Attribute Name="http://macedir.org/entity-category-support"
+                NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
+                <saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+</Extensions>
+
+    <IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:mace:shibboleth:1.0">
+
+        <Extensions>
+            <shibmd:Scope regexp="false">test.ukfederation.org.uk</shibmd:Scope>
+<!--
+    Fill in the details for your IdP here 
+
+            <mdui:UIInfo>
+                <mdui:DisplayName xml:lang="en">A Name for the IdP at test-idp.ukfederation.org.uk</mdui:DisplayName>
+                <mdui:Description xml:lang="en">Enter a description of your IdP at test-idp.ukfederation.org.uk</mdui:Description>
+                <mdui:Logo height="80" width="80">https://test-idp.ukfederation.org.uk/Path/To/Logo.png</mdui:Logo>
+            </mdui:UIInfo>
+-->
+        </Extensions>
+
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>
+MIIDXDCCAkSgAwIBAgIVAKMdq76ICtGOUPeE1oS5vZ2/J8pjMA0GCSqGSIb3DQEB
+CwUAMCcxJTAjBgNVBAMMHHRlc3QtaWRwLnVrZmVkZXJhdGlvbi5vcmcudWswHhcN
+MTYwNjAyMTYyNzU4WhcNMzYwNjAyMTYyNzU4WjAnMSUwIwYDVQQDDBx0ZXN0LWlk
+cC51a2ZlZGVyYXRpb24ub3JnLnVrMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAp6PVhKcs4wDoMuVSWn73E2L+WgZipw4rAIluvgvdu97zpbjjerbL1OWL
+Px3BNz6tP+IU8ivXDY8sDDTeGOquxW5E3JZKOvTkPTd+V0dFpX1ogb342w/UMgwd
+n4wMjLtZQvdJbWhtdxRFdd4YTv2ooeFWmr2Nc1qrBS9As1HdZnD0CvP0R1gxjAij
+Vu6/Kg4rJcVjOGka3dGKqdCwUfFm0KuEp8GrHkyTdQ1qDwa181FdlNA5qW6djLlj
+xGuLI9gKOzt1EgCi4RKsRgHEn3RMRx29TMusOAwQTMz/w0PX7B4LnoYxO/Z+njwX
+GVtc/Vpr9paIBgXn3Dv16DmfmpDt5QIDAQABo38wfTAdBgNVHQ4EFgQUea1/62BW
+cTima/4+VczPTQQPZjQwXAYDVR0RBFUwU4IcdGVzdC1pZHAudWtmZWRlcmF0aW9u
+Lm9yZy51a4YzaHR0cHM6Ly90ZXN0LWlkcC51a2ZlZGVyYXRpb24ub3JnLnVrL2lk
+cC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQA0JLH2MA22gwQMdsK1mI+g
+Jr2CYIEts7ry3oi6SyD8tTFCmypTKzvKz2s0bOpHvYyTbEDVs9ffCrJUVdvVwHF0
+sX4YsnJuOKQLr5Sl3YZPvPg7AsOMW+Tn+JL5l2Xnvfz77Ki3FiS4rQH32REFGccl
+Gs7fJunyxZzB3Jvv9Cly5vfdKGJfyCviDSMWX5W1slUkg1fWUsppZy9Ifiygb+Au
+IaP69qz6dqVwZJldG3Wn/x5WpI1x7Meax2Wa9bIbqWXCeNfhrhAnL//dbKPfA0EB
+AlxhhLIxWxf/Um12z22EJyuH3EYWyTlVaGlOcHzg2r1Mn/1LNXpBMVhOPZouksPx
+                        </ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>
+MIIDWzCCAkOgAwIBAgIUOMCC6dkddEwkgPACu9HJ3SaiMjkwDQYJKoZIhvcNAQEL
+BQAwJzElMCMGA1UEAwwcdGVzdC1pZHAudWtmZWRlcmF0aW9uLm9yZy51azAeFw0x
+NjA2MDIxNjI3NTZaFw0zNjA2MDIxNjI3NTZaMCcxJTAjBgNVBAMMHHRlc3QtaWRw
+LnVrZmVkZXJhdGlvbi5vcmcudWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCYrePj+6qI0agRWDNXr2N0pvxdBA9fzXUiNkFPv1syUcY40LGtYUvyEyrn
+VZ9OkvLswTYArvOGwHGGseKy1lDxt/O37hcXTTd6bAg6nIqdD08Y044pMpXfms2n
+BwUHq/sGUUyIVV+xP00lfyFxwQNRI9D0L4W8OSx0vMoPM4hp+gsZrzTklUgjhRU/
+5n5XGSseS9tb60wz4URx306HxuEkZpF7pWhJRAgfeyone9vYMAotXBfxrvssuyYw
+rabGvfWRIJiXXmLjm2hllAF2Tj25xlzjAwDhLbvKjZZa5afx3EYMYSf53uOGYJG/
+zGebYZpvKZB+bLjNwaA41LzeskMdAgMBAAGjfzB9MB0GA1UdDgQWBBQUUMcdr4uu
+bY7bn88mdk67e20UDzBcBgNVHREEVTBTghx0ZXN0LWlkcC51a2ZlZGVyYXRpb24u
+b3JnLnVrhjNodHRwczovL3Rlc3QtaWRwLnVrZmVkZXJhdGlvbi5vcmcudWsvaWRw
+L3NoaWJib2xldGgwDQYJKoZIhvcNAQELBQADggEBAJMjdRtSlf9IYMIUqvGQxn/v
+u8CixcHcimK2WBp/Dv4lAphOTzmF+zF7cB2CMalAcgJnoP4BJNq/7bwDOHDFbpbN
+cKh4FWRzURChBbZ2Xa1C2vrm0+oPQl8WsChxQgqUPDTleg2k3/PEi2dDymJlu8Cg
+0kqWwQ1G0tal6B0lDf+3PKdwdp5LAnB8TUFCTrfuI5DiHOce8r5+AjfkhJsSYu39
+NpJGsdn/IzQE4RsAFbz1UEb1sz9+vtTFMvC2mr82TcYWC3PDqyHpvqCHAwQqAzQW
+thDEbFnZ8ckGnGLfkn+Lqt8/A3D85vsoQvvYZ+6UOKzBnl2SeVyGcFykoSoZcGA=
+                        </ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+        <KeyDescriptor use="encryption">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>
+MIIDXDCCAkSgAwIBAgIVAN/3uTodbwagOO8HxJ/wK9pD9F6DMA0GCSqGSIb3DQEB
+CwUAMCcxJTAjBgNVBAMMHHRlc3QtaWRwLnVrZmVkZXJhdGlvbi5vcmcudWswHhcN
+MTYwNjAyMTYyNzU3WhcNMzYwNjAyMTYyNzU3WjAnMSUwIwYDVQQDDBx0ZXN0LWlk
+cC51a2ZlZGVyYXRpb24ub3JnLnVrMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAl5mKiHP7qGWRM2IkPvh5RuVJaOJkBRFhDdX1FInSYtyPRDxQ6Fl9g5Pt
+3C65HA9YVMjhijph50DZJRAroyU17WdaSfTUrqK7LqdVk7rVHRekJIH+J3hh/UVq
+2Q0N1tlyBOblR6DA4na3kNYwTZh+jYrp6cbNqyqcvtFLCezDOkNnLbXxSK6vqqJN
+dRTLUoN6PmRlj5DBZNpOkSGdI32WIhNczUHkBZzHVRlvfF4uQKH+0ASYWpI+WJGs
+Mrdg1eSkQkKLYo/6LmLj/L4kiJzWEC1V1pod1r54wgMsfFRPeoLC1kYU3Q8OFgX8
+WdUodwaRtFrpmURBEQgMK1uDLGJhkwIDAQABo38wfTAdBgNVHQ4EFgQUdsJMwfkG
+pPHTByrcDXj2+cm+G2AwXAYDVR0RBFUwU4IcdGVzdC1pZHAudWtmZWRlcmF0aW9u
+Lm9yZy51a4YzaHR0cHM6Ly90ZXN0LWlkcC51a2ZlZGVyYXRpb24ub3JnLnVrL2lk
+cC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQBOVDjHi2Mrj3nDb/pTZ9Lz
+/OizJNEZ+uklJbX//W9Jr1VE2NND96R/D2T/lvR/rKbXh0HJl7VYLRHkPJPQ6X+T
+7TzZW9MKhX6nLzhXdtOZb4AEQn0mpOtZSfpY9eUc13xRw1jGl6y09WVnO/IP/0HX
+U7uWTDt0jgAC4VR3hpFOevxU3nXu5XLtgBcnASeoeJbNfAr+MhrHCt4nAYFmf/+S
+MLg/0bPQDCVJ0j4yvSCCFkrWeFEkzqQ2QF/VFSA47VfRDALiMzTpFFgTxyj1p4T7
+Ycbh0vb/OVKx+DN9cvlWlzf2e2JXGg8/gP7hpwVV6ndskANQ67NUOZ5jXWsK5GnD
+                        </ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+
+        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://test-idp.ukfederation.org.uk:8443/idp/profile/SAML1/SOAP/ArtifactResolution" index="1"/>
+        <ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://test-idp.ukfederation.org.uk:8443/idp/profile/SAML2/SOAP/ArtifactResolution" index="2"/>
+
+        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://test-idp.ukfederation.org.uk/idp/profile/SAML2/Redirect/SLO"/>
+        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://test-idp.ukfederation.org.uk/idp/profile/SAML2/POST/SLO"/>
+        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://test-idp.ukfederation.org.uk/idp/profile/SAML2/POST-SimpleSign/SLO"/>
+        <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://test-idp.ukfederation.org.uk:8443/idp/profile/SAML2/SOAP/SLO"/>
+
+        <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+
+        <SingleSignOnService Binding="urn:mace:shibboleth:1.0:profiles:AuthnRequest" Location="https://test-idp.ukfederation.org.uk/idp/profile/Shibboleth/SSO"/>
+        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://test-idp.ukfederation.org.uk/idp/profile/SAML2/POST/SSO"/>
+        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://test-idp.ukfederation.org.uk/idp/profile/SAML2/POST-SimpleSign/SSO"/>
+        <SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://test-idp.ukfederation.org.uk/idp/profile/SAML2/Redirect/SSO"/>
+
+    </IDPSSODescriptor>
+
+
+    <AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:1.1:protocol">
+
+        <Extensions>
+            <shibmd:Scope regexp="false">test.ukfederation.org.uk</shibmd:Scope>
+        </Extensions>
+
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>
+MIIDXDCCAkSgAwIBAgIVAKMdq76ICtGOUPeE1oS5vZ2/J8pjMA0GCSqGSIb3DQEB
+CwUAMCcxJTAjBgNVBAMMHHRlc3QtaWRwLnVrZmVkZXJhdGlvbi5vcmcudWswHhcN
+MTYwNjAyMTYyNzU4WhcNMzYwNjAyMTYyNzU4WjAnMSUwIwYDVQQDDBx0ZXN0LWlk
+cC51a2ZlZGVyYXRpb24ub3JnLnVrMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAp6PVhKcs4wDoMuVSWn73E2L+WgZipw4rAIluvgvdu97zpbjjerbL1OWL
+Px3BNz6tP+IU8ivXDY8sDDTeGOquxW5E3JZKOvTkPTd+V0dFpX1ogb342w/UMgwd
+n4wMjLtZQvdJbWhtdxRFdd4YTv2ooeFWmr2Nc1qrBS9As1HdZnD0CvP0R1gxjAij
+Vu6/Kg4rJcVjOGka3dGKqdCwUfFm0KuEp8GrHkyTdQ1qDwa181FdlNA5qW6djLlj
+xGuLI9gKOzt1EgCi4RKsRgHEn3RMRx29TMusOAwQTMz/w0PX7B4LnoYxO/Z+njwX
+GVtc/Vpr9paIBgXn3Dv16DmfmpDt5QIDAQABo38wfTAdBgNVHQ4EFgQUea1/62BW
+cTima/4+VczPTQQPZjQwXAYDVR0RBFUwU4IcdGVzdC1pZHAudWtmZWRlcmF0aW9u
+Lm9yZy51a4YzaHR0cHM6Ly90ZXN0LWlkcC51a2ZlZGVyYXRpb24ub3JnLnVrL2lk
+cC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQA0JLH2MA22gwQMdsK1mI+g
+Jr2CYIEts7ry3oi6SyD8tTFCmypTKzvKz2s0bOpHvYyTbEDVs9ffCrJUVdvVwHF0
+sX4YsnJuOKQLr5Sl3YZPvPg7AsOMW+Tn+JL5l2Xnvfz77Ki3FiS4rQH32REFGccl
+Gs7fJunyxZzB3Jvv9Cly5vfdKGJfyCviDSMWX5W1slUkg1fWUsppZy9Ifiygb+Au
+IaP69qz6dqVwZJldG3Wn/x5WpI1x7Meax2Wa9bIbqWXCeNfhrhAnL//dbKPfA0EB
+AlxhhLIxWxf/Um12z22EJyuH3EYWyTlVaGlOcHzg2r1Mn/1LNXpBMVhOPZouksPx
+                        </ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>
+MIIDWzCCAkOgAwIBAgIUOMCC6dkddEwkgPACu9HJ3SaiMjkwDQYJKoZIhvcNAQEL
+BQAwJzElMCMGA1UEAwwcdGVzdC1pZHAudWtmZWRlcmF0aW9uLm9yZy51azAeFw0x
+NjA2MDIxNjI3NTZaFw0zNjA2MDIxNjI3NTZaMCcxJTAjBgNVBAMMHHRlc3QtaWRw
+LnVrZmVkZXJhdGlvbi5vcmcudWswggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK
+AoIBAQCYrePj+6qI0agRWDNXr2N0pvxdBA9fzXUiNkFPv1syUcY40LGtYUvyEyrn
+VZ9OkvLswTYArvOGwHGGseKy1lDxt/O37hcXTTd6bAg6nIqdD08Y044pMpXfms2n
+BwUHq/sGUUyIVV+xP00lfyFxwQNRI9D0L4W8OSx0vMoPM4hp+gsZrzTklUgjhRU/
+5n5XGSseS9tb60wz4URx306HxuEkZpF7pWhJRAgfeyone9vYMAotXBfxrvssuyYw
+rabGvfWRIJiXXmLjm2hllAF2Tj25xlzjAwDhLbvKjZZa5afx3EYMYSf53uOGYJG/
+zGebYZpvKZB+bLjNwaA41LzeskMdAgMBAAGjfzB9MB0GA1UdDgQWBBQUUMcdr4uu
+bY7bn88mdk67e20UDzBcBgNVHREEVTBTghx0ZXN0LWlkcC51a2ZlZGVyYXRpb24u
+b3JnLnVrhjNodHRwczovL3Rlc3QtaWRwLnVrZmVkZXJhdGlvbi5vcmcudWsvaWRw
+L3NoaWJib2xldGgwDQYJKoZIhvcNAQELBQADggEBAJMjdRtSlf9IYMIUqvGQxn/v
+u8CixcHcimK2WBp/Dv4lAphOTzmF+zF7cB2CMalAcgJnoP4BJNq/7bwDOHDFbpbN
+cKh4FWRzURChBbZ2Xa1C2vrm0+oPQl8WsChxQgqUPDTleg2k3/PEi2dDymJlu8Cg
+0kqWwQ1G0tal6B0lDf+3PKdwdp5LAnB8TUFCTrfuI5DiHOce8r5+AjfkhJsSYu39
+NpJGsdn/IzQE4RsAFbz1UEb1sz9+vtTFMvC2mr82TcYWC3PDqyHpvqCHAwQqAzQW
+thDEbFnZ8ckGnGLfkn+Lqt8/A3D85vsoQvvYZ+6UOKzBnl2SeVyGcFykoSoZcGA=
+                        </ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+        <KeyDescriptor use="encryption">
+            <ds:KeyInfo>
+                    <ds:X509Data>
+                        <ds:X509Certificate>
+MIIDXDCCAkSgAwIBAgIVAN/3uTodbwagOO8HxJ/wK9pD9F6DMA0GCSqGSIb3DQEB
+CwUAMCcxJTAjBgNVBAMMHHRlc3QtaWRwLnVrZmVkZXJhdGlvbi5vcmcudWswHhcN
+MTYwNjAyMTYyNzU3WhcNMzYwNjAyMTYyNzU3WjAnMSUwIwYDVQQDDBx0ZXN0LWlk
+cC51a2ZlZGVyYXRpb24ub3JnLnVrMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEAl5mKiHP7qGWRM2IkPvh5RuVJaOJkBRFhDdX1FInSYtyPRDxQ6Fl9g5Pt
+3C65HA9YVMjhijph50DZJRAroyU17WdaSfTUrqK7LqdVk7rVHRekJIH+J3hh/UVq
+2Q0N1tlyBOblR6DA4na3kNYwTZh+jYrp6cbNqyqcvtFLCezDOkNnLbXxSK6vqqJN
+dRTLUoN6PmRlj5DBZNpOkSGdI32WIhNczUHkBZzHVRlvfF4uQKH+0ASYWpI+WJGs
+Mrdg1eSkQkKLYo/6LmLj/L4kiJzWEC1V1pod1r54wgMsfFRPeoLC1kYU3Q8OFgX8
+WdUodwaRtFrpmURBEQgMK1uDLGJhkwIDAQABo38wfTAdBgNVHQ4EFgQUdsJMwfkG
+pPHTByrcDXj2+cm+G2AwXAYDVR0RBFUwU4IcdGVzdC1pZHAudWtmZWRlcmF0aW9u
+Lm9yZy51a4YzaHR0cHM6Ly90ZXN0LWlkcC51a2ZlZGVyYXRpb24ub3JnLnVrL2lk
+cC9zaGliYm9sZXRoMA0GCSqGSIb3DQEBCwUAA4IBAQBOVDjHi2Mrj3nDb/pTZ9Lz
+/OizJNEZ+uklJbX//W9Jr1VE2NND96R/D2T/lvR/rKbXh0HJl7VYLRHkPJPQ6X+T
+7TzZW9MKhX6nLzhXdtOZb4AEQn0mpOtZSfpY9eUc13xRw1jGl6y09WVnO/IP/0HX
+U7uWTDt0jgAC4VR3hpFOevxU3nXu5XLtgBcnASeoeJbNfAr+MhrHCt4nAYFmf/+S
+MLg/0bPQDCVJ0j4yvSCCFkrWeFEkzqQ2QF/VFSA47VfRDALiMzTpFFgTxyj1p4T7
+Ycbh0vb/OVKx+DN9cvlWlzf2e2JXGg8/gP7hpwVV6ndskANQ67NUOZ5jXWsK5GnD
+                        </ds:X509Certificate>
+                    </ds:X509Data>
+            </ds:KeyInfo>
+
+        </KeyDescriptor>
+
+        <AttributeService Binding="urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding" Location="https://test-idp.ukfederation.org.uk:8443/idp/profile/SAML1/SOAP/AttributeQuery"/>
+        <!-- <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="https://test-idp.ukfederation.org.uk:8443/idp/profile/SAML2/SOAP/AttributeQuery"/> -->
+        <!-- If you uncomment the above you should add urn:oasis:names:tc:SAML:2.0:protocol to the protocolSupportEnumeration above -->
+
+    </AttributeAuthorityDescriptor>
+
+</EntityDescriptor>