From b1996170fb0880ef643722ba137dad0cf31f27aa Mon Sep 17 00:00:00 2001
From: Alex Stuart <alex.stuart@jisc.ac.uk>
Date: Mon, 30 Nov 2020 14:53:33 +0000
Subject: [PATCH] Add UK-specific check for IdPs suppporting REFEDS R&S entity
 category

Similar to the check for SPs, we ensure that any IdP that supports
the category will have a valid MDRPS in metadata.

See ukf/ukf-meta#281 for details
---
 mdx/uk/check_uk_rands.xsl                     | 23 ++++++++++++++++++-
 tests/manual/ukf-meta-281/README.md           |  9 ++++++++
 .../manual/ukf-meta-281/has-ec-has-policy.xml | 18 +++++++++++++++
 .../manual/ukf-meta-281/has-ec-no-policy.xml  | 16 +++++++++++++
 .../manual/ukf-meta-281/no-ec-has-policy.xml  | 13 +++++++++++
 tests/manual/ukf-meta-281/no-ec-no-policy.xml |  5 ++++
 .../ukf-meta-281/sirtfi-ec-no-policy.xml      | 18 +++++++++++++++
 7 files changed, 101 insertions(+), 1 deletion(-)
 create mode 100644 tests/manual/ukf-meta-281/README.md
 create mode 100644 tests/manual/ukf-meta-281/has-ec-has-policy.xml
 create mode 100644 tests/manual/ukf-meta-281/has-ec-no-policy.xml
 create mode 100644 tests/manual/ukf-meta-281/no-ec-has-policy.xml
 create mode 100644 tests/manual/ukf-meta-281/no-ec-no-policy.xml
 create mode 100644 tests/manual/ukf-meta-281/sirtfi-ec-no-policy.xml

diff --git a/mdx/uk/check_uk_rands.xsl b/mdx/uk/check_uk_rands.xsl
index 6ad2ee94..331aa9d5 100644
--- a/mdx/uk/check_uk_rands.xsl
+++ b/mdx/uk/check_uk_rands.xsl
@@ -3,7 +3,8 @@
 
     check_uk_rands.xsl
 
-    UKf-specific check for SPs asserting R&S entity category
+    UKf-specific checks for SPs asserting R&S entity category
+    or for IdPs supporting the entity category.
 
 -->
 <xsl:stylesheet version="1.0"
@@ -41,5 +42,25 @@
         </xsl:call-template>
     </xsl:template>
 
+    <!--
+        IdPs which support the R&S entity category must include an explicit RegistrationPolicy.
+
+        Note that there is a different UK-specific check to ensure that RegistrationPolicy
+        contains valid values, so we don't need to repeat ourselves here.
+
+        Note also that check_rands_support ensures that entities asserting the entity category
+        are IdPs.
+    -->
+    <xsl:template match="md:EntityDescriptor
+                        [md:Extensions/mdattr:EntityAttributes/saml:Attribute[@Name='http://macedir.org/entity-category-support']
+                                /saml:AttributeValue='http://refeds.org/category/research-and-scholarship']
+                        [not(md:Extensions/mdrpi:RegistrationInfo/mdrpi:RegistrationPolicy)]">
+        <xsl:call-template name="error">
+            <xsl:with-param name="m">
+                <xsl:text>IdP supports R&amp;S entity category but has no RegistrationPolicy element.</xsl:text>
+            </xsl:with-param>
+        </xsl:call-template>
+    </xsl:template>
+
 
 </xsl:stylesheet>
diff --git a/tests/manual/ukf-meta-281/README.md b/tests/manual/ukf-meta-281/README.md
new file mode 100644
index 00000000..b1bd1e2d
--- /dev/null
+++ b/tests/manual/ukf-meta-281/README.md
@@ -0,0 +1,9 @@
+# Tests for UK-specific check for R and S
+
+If the entity supports R&S, it must have a RegistrationPolicy
+
+Other checks ensure that the RegistrationPolicy is valid
+
+Run tests like this:
+
+`for i in *.xml; do echo "Test: $i ==="; xsltproc ../../../mdx/uk/check_uk_rands.xsl $i; done`
diff --git a/tests/manual/ukf-meta-281/has-ec-has-policy.xml b/tests/manual/ukf-meta-281/has-ec-has-policy.xml
new file mode 100644
index 00000000..e431bf6a
--- /dev/null
+++ b/tests/manual/ukf-meta-281/has-ec-has-policy.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+    <Extensions>
+        <mdrpi:RegistrationInfo registrationAuthority="http://ukfederation.org.uk"
+            registrationInstant="2012-07-13T11:19:55Z">
+            <mdrpi:RegistrationPolicy xml:lang="en"
+                >http://ukfederation.org.uk/doc/mdrps-20130902</mdrpi:RegistrationPolicy>
+        </mdrpi:RegistrationInfo>
+        <mdattr:EntityAttributes>
+            <saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="http://macedir.org/entity-category-support">
+                <saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-281/has-ec-no-policy.xml b/tests/manual/ukf-meta-281/has-ec-no-policy.xml
new file mode 100644
index 00000000..e1b7218d
--- /dev/null
+++ b/tests/manual/ukf-meta-281/has-ec-no-policy.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+    <Extensions>
+        <mdrpi:RegistrationInfo registrationAuthority="http://ukfederation.org.uk"
+            registrationInstant="2012-07-13T11:19:55Z">
+        </mdrpi:RegistrationInfo>
+        <mdattr:EntityAttributes>
+            <saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="http://macedir.org/entity-category-support">
+                <saml:AttributeValue>http://refeds.org/category/research-and-scholarship</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-281/no-ec-has-policy.xml b/tests/manual/ukf-meta-281/no-ec-has-policy.xml
new file mode 100644
index 00000000..c82a2c97
--- /dev/null
+++ b/tests/manual/ukf-meta-281/no-ec-has-policy.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+    <Extensions>
+        <mdrpi:RegistrationInfo registrationAuthority="http://ukfederation.org.uk"
+            registrationInstant="2012-07-13T11:19:55Z">
+            <mdrpi:RegistrationPolicy xml:lang="en"
+                >http://ukfederation.org.uk/doc/mdrps-20130902</mdrpi:RegistrationPolicy>
+        </mdrpi:RegistrationInfo>
+    </Extensions>
+</EntityDescriptor>
diff --git a/tests/manual/ukf-meta-281/no-ec-no-policy.xml b/tests/manual/ukf-meta-281/no-ec-no-policy.xml
new file mode 100644
index 00000000..7d9301f7
--- /dev/null
+++ b/tests/manual/ukf-meta-281/no-ec-no-policy.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" />
diff --git a/tests/manual/ukf-meta-281/sirtfi-ec-no-policy.xml b/tests/manual/ukf-meta-281/sirtfi-ec-no-policy.xml
new file mode 100644
index 00000000..1bf29ae2
--- /dev/null
+++ b/tests/manual/ukf-meta-281/sirtfi-ec-no-policy.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+    xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
+    <Extensions>
+        <mdrpi:RegistrationInfo registrationAuthority="http://ukfederation.org.uk"
+            registrationInstant="2012-07-13T11:19:55Z">
+            <mdrpi:RegistrationPolicy xml:lang="en"
+                >http://ukfederation.org.uk/doc/mdrps-20130902</mdrpi:RegistrationPolicy>
+        </mdrpi:RegistrationInfo>
+        <mdattr:EntityAttributes>
+            <saml:Attribute NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri" Name="http://macedir.org/entity-category">
+                <saml:AttributeValue>https://refeds.org/sirtfi</saml:AttributeValue>
+            </saml:Attribute>
+        </mdattr:EntityAttributes>
+    </Extensions>
+</EntityDescriptor>