From b1641fa401e5ed0ab4678594f545356d7e3d4742 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 11 May 2011 10:59:31 +0000
Subject: [PATCH] Tolerate EncryptionMethod in registered metadata by moving
 the check for it down the pipeline. Filter EncryptionMethod out before
 publication on UK federation aggregates.

---
 build/check_fixups.xsl       | 14 ++++++++++++++
 build/check_shibboleth.xsl   | 11 -----------
 build/uk_master_back.xsl     | 10 ++++++++++
 build/uk_master_test.xsl     | 10 ++++++++++
 build/uk_master_unsigned.xsl | 10 ++++++++++
 5 files changed, 44 insertions(+), 11 deletions(-)

diff --git a/build/check_fixups.xsl b/build/check_fixups.xsl
index bdd1395c..c92e6d8f 100644
--- a/build/check_fixups.xsl
+++ b/build/check_fixups.xsl
@@ -46,4 +46,18 @@
 		</xsl:call-template>
 	</xsl:template>
 	
+
+	<!--
+		Use of EncryptionMethod within KeyDescriptor causes metadata loading problems
+		for OpenSAML-C 2.0.
+		
+		See https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness#MetadataCorrectness-Version2.0
+	-->
+	<xsl:template match="md:KeyDescriptor/md:EncryptionMethod">
+		<xsl:call-template name="fatal">
+			<xsl:with-param name="m">KeyDescriptor contains EncryptionMethod: OpenSAML-C 2.0 problem</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	
 </xsl:stylesheet>
diff --git a/build/check_shibboleth.xsl b/build/check_shibboleth.xsl
index 4430eb0a..14c16b9b 100644
--- a/build/check_shibboleth.xsl
+++ b/build/check_shibboleth.xsl
@@ -173,15 +173,4 @@
 	</xsl:template>
 	
 	
-	<!--
-		Use of EncryptionMethod within KeyDescriptor causes metadata loading problems
-		for OpenSAML-C 2.0.
-	-->
-	<xsl:template match="md:KeyDescriptor/md:EncryptionMethod">
-		<xsl:call-template name="fatal">
-			<xsl:with-param name="m">KeyDescriptor contains EncryptionMethod: OpenSAML-C 2.0 problem</xsl:with-param>
-		</xsl:call-template>
-	</xsl:template>
-	
-	
 </xsl:stylesheet>
diff --git a/build/uk_master_back.xsl b/build/uk_master_back.xsl
index a9fcbe39..e33f05fe 100644
--- a/build/uk_master_back.xsl
+++ b/build/uk_master_back.xsl
@@ -121,6 +121,16 @@
 		</xsl:copy>
 	</xsl:template>
 	
+	
+	<!--
+		Remove any EncryptionMethod elements within KeyDescriptor elements
+		to avoid triggering a problem in OpenSAML-C 2.0.
+		
+		See https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness#MetadataCorrectness-Version2.0
+	-->
+	<xsl:template match="md:KeyDescriptor/md:EncryptionMethod"/>
+	
+	
 	<!--
 		Pass through certain ukfedlabel namespace elements.
 	-->
diff --git a/build/uk_master_test.xsl b/build/uk_master_test.xsl
index f2ba4721..8032c845 100644
--- a/build/uk_master_test.xsl
+++ b/build/uk_master_test.xsl
@@ -143,6 +143,16 @@
 		</xsl:copy>
 	</xsl:template>
 	
+	
+	<!--
+		Remove any EncryptionMethod elements within KeyDescriptor elements
+		to avoid triggering a problem in OpenSAML-C 2.0.
+		
+		See https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness#MetadataCorrectness-Version2.0
+	-->
+	<xsl:template match="md:KeyDescriptor/md:EncryptionMethod"/>
+	
+	
 	<!--
 		Normalise and pass through certain ukfedlabel namespace elements.
 	-->
diff --git a/build/uk_master_unsigned.xsl b/build/uk_master_unsigned.xsl
index 3b0a8966..0a7ea35d 100644
--- a/build/uk_master_unsigned.xsl
+++ b/build/uk_master_unsigned.xsl
@@ -138,6 +138,16 @@
 		</xsl:copy>
 	</xsl:template>
 	
+	
+	<!--
+		Remove any EncryptionMethod elements within KeyDescriptor elements
+		to avoid triggering a problem in OpenSAML-C 2.0.
+		
+		See https://wiki.shibboleth.net/confluence/display/SHIB2/MetadataCorrectness#MetadataCorrectness-Version2.0
+	-->
+	<xsl:template match="md:KeyDescriptor/md:EncryptionMethod"/>
+	
+	
 	<!--
 		Normalise and pass through certain ukfedlabel namespace elements.
 	-->