From a1a2be6523f1cce5ae736578b976b56f66048844 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 11 Oct 2019 14:23:54 +0100
Subject: [PATCH] Apply scope policy to eduGAIN ingress flows

See ukf/ukf-meta#182.
---
 mdx/int_edugain/verbs.xml |  16 +++++
 mdx/uk/edugain-policy.xml | 128 ++++++++++++++++++++++++++++++++++++++
 mdx/uk/generate.xml       |  11 ++++
 3 files changed, 155 insertions(+)
 create mode 100644 mdx/uk/edugain-policy.xml

diff --git a/mdx/int_edugain/verbs.xml b/mdx/int_edugain/verbs.xml
index e4fa53e4..a540a5d5 100644
--- a/mdx/int_edugain/verbs.xml
+++ b/mdx/int_edugain/verbs.xml
@@ -22,6 +22,16 @@
     -->
     <import resource="classpath:int_edugain/beans.xml"/>
 
+    <!--
+        Import inc-mda beans.
+    -->
+    <import resource="classpath:uk/org/iay/incommon/mda/beans.xml"/>
+
+    <!--
+        Import UK federation ingress policy for eduGAIN.
+    -->
+    <import resource="classpath:uk/edugain-policy.xml"/>
+
     <bean id="serializeImported" parent="mda.SerializationStage">
         <property name="serializer" ref="serializer"/>
         <property name="outputFile">
@@ -50,6 +60,7 @@
             <list>
                 <ref bean="int_edugain_productionEntities"/>
                 <ref bean="standardImportActions"/>
+                <ref bean="edugainPolicy"/>
                 <ref bean="standardImportTail"/>
                 <ref bean="serializeImported"/>
             </list>
@@ -70,6 +81,7 @@
             <list>
                 <ref bean="int_edugain_testEntities"/>
                 <ref bean="standardImportActions"/>
+                <ref bean="edugainPolicy"/>
                 <ref bean="standardImportTail"/>
                 <ref bean="serializeImported"/>
             </list>
@@ -94,6 +106,7 @@
                     p:designatedEntities-ref="int_edugain_verify_blacklist"/>
 
                 <ref bean="standardImportActions"/>
+                <ref bean="edugainPolicy"/>
                 <ref bean="errorTerminatingFilter"/>
             </list>
         </property>
@@ -114,6 +127,7 @@
                     p:designatedEntities-ref="int_edugain_verify_blacklist"/>
 
                 <ref bean="standardImportActions"/>
+                <ref bean="edugainPolicy"/>
                 <ref bean="errorTerminatingFilter"/>
             </list>
         </property>
@@ -133,6 +147,7 @@
 
                 <!-- remove all entities which still have errors -->
                 <ref bean="standardImportActions"/>
+                <ref bean="edugainPolicy"/>
                 <ref bean="errorRemover"/>
 
                 <!-- remove all entities *other* than the ones in the blacklist -->
@@ -165,6 +180,7 @@
                 <ref bean="removeUKEntities"/>
 
                 <ref bean="standardImportActions"/>
+                <ref bean="edugainPolicy"/>
                 <ref bean="warningAndErrorAnnouncer"/>
                 <ref bean="errorTerminator"/>
             </list>
diff --git a/mdx/uk/edugain-policy.xml b/mdx/uk/edugain-policy.xml
new file mode 100644
index 00000000..78914b35
--- /dev/null
+++ b/mdx/uk/edugain-policy.xml
@@ -0,0 +1,128 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+    <!--
+        edugainPolicy
+
+        Applies policy to entities sourced from eduGAIN.
+
+        Entities may be transformed by policy, or marked as being in error.
+
+        Entities with errors are NOT removed here, so that this policy can be
+        used in contexts where reporting is more appropriate than just removal.
+
+        This is not the only policy applied to entities sourced from
+        eduGAIN, but that may change over time.
+
+        This policy is partially derived from Incommon's Interfederation
+        policy.
+
+        Rule number references are to the Interfederation Technical Policy
+        pages on the Internet2 wiki. There are two versions:
+
+        * Interfederation Technical Policy Development
+            * at https://spaces.internet2.edu/x/ugDABg
+            * documents the expected *next* deployment
+            * updated as changes are made in the master branch
+            * use this if you want to cross-reference numbers against
+              the development tooling
+
+        * Interfederation Technical Policy
+            * at https://spaces.internet2.edu/x/TgCNBQ
+            * documents the *current* deployment
+            * to cross-reference against this page, check out the specific
+              release mentioned there
+
+    -->
+    <bean id="edugainPolicy" parent="mda.CompositeStage">
+        <property name="composedStages">
+            <list>
+
+                <!--
+                    *************************************
+                    ***                               ***
+                    ***   P O L I C Y   R U L E   4   ***
+                    ***                               ***
+                    *************************************
+
+                    "Remove (and log the removal of) all imported
+                    entities matching one or more of the following conditions:"
+
+                    This rule is performed by the error-detecting beans below
+                    in combination with the caller of this CompositeStage
+                    taking action on any resulting ErrorStatus objects in
+                    item metadata.
+                -->
+
+                <!--
+                    Sub-rule c.ii.
+
+                    Perform detailed scope checking.
+                -->
+                <bean id="checkScopes" parent="inc.stage_parent"
+                    class="uk.org.iay.incommon.mda.dom.saml.shib.ScopeValidationStage">
+                    <property name="validators">
+                        <list>
+                            <bean p:id="empty" parent="inc.RejectStringRegexValidator"
+                                p:regex="" p:message="scope element must not be empty"/>
+                            <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
+                                p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
+                            <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
+                                p:message="scope is not a valid domain name: %s">
+                                <property name="validators">
+                                    <list>
+                                        <!-- DNS name validators -->
+                                        <bean p:id="publicSuffix" parent="inc.RejectDomainNamePublicSuffixValidator"
+                                            p:message="scope is a public suffix: '%s'"/>
+                                        <bean p:id="noPublicSuffix" parent="inc.RejectDomainNameNotUnderPublicSuffixValidator"
+                                            p:message="scope is not under a public suffix: '%s'"/>
+                                    </list>
+                                </property>
+                            </bean>
+                        </list>
+                    </property>
+                    <property name="regexpValidators">
+                        <list>
+                            <bean p:id="empty" parent="inc.RejectStringRegexValidator"
+                                p:regex="" p:message="regex scope element must not be empty"/>
+                            <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
+                                p:regex=".*\s.*" p:message="regex scope '%s' includes white space"/>
+                            <bean p:id="endAnchor" parent="inc.RejectStringRegexValidator"
+                                p:regex=".*[^$]" p:message="regex scope '%s' does not end with an anchor ('$')"/>
+                            <bean p:id="literalTail" parent="inc.AsLiteralTailStringValidator"
+                                p:message="regular expression '%s' does not end with a literal tail">
+                                <property name="validators">
+                                    <!-- validators to apply to the literal tail -->
+                                    <list>
+                                        <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
+                                            p:message="literal tail is not a valid domain name: %s">
+                                            <property name="validators">
+                                                <list>
+                                                    <!-- DNS name validators for the literal tail -->
+                                                    <bean p:id="publicSuffix" parent="inc.RejectDomainNamePublicSuffixValidator"
+                                                        p:message="literal tail is a public suffix: '%s'"/>
+                                                    <bean p:id="noPublicSuffix" parent="inc.RejectDomainNameNotUnderPublicSuffixValidator"
+                                                        p:message="literal tail is not under a public suffix: '%s'"/>
+                                                </list>
+                                            </property>
+                                        </bean>
+                                    </list>
+                                </property>
+                            </bean>
+                        </list>
+                    </property>
+                </bean>
+
+            </list>
+        </property>
+    </bean>
+
+</beans>
diff --git a/mdx/uk/generate.xml b/mdx/uk/generate.xml
index 3f16d7d5..c3b061d9 100644
--- a/mdx/uk/generate.xml
+++ b/mdx/uk/generate.xml
@@ -33,6 +33,16 @@
     -->
     <import resource="file:${blocklists.dir}/fallback-blocklist.xml"/>
 
+    <!--
+        Import inc-mda beans.
+    -->
+    <import resource="classpath:uk/org/iay/incommon/mda/beans.xml"/>
+
+    <!--
+        Import UK federation ingress policy for eduGAIN.
+    -->
+    <import resource="classpath:uk/edugain-policy.xml"/>
+
     <!--
         *****************************
         ***                       ***
@@ -243,6 +253,7 @@
                 <ref bean="removeUKEntities"/>
                 <ref bean="removeBlacklistedEntities"/>
                 <ref bean="standardImportActions"/>
+                <ref bean="edugainPolicy"/>
 
                 <!--
                     Silently remove entities which are marked as