From b4ae5c2425486fb9a256b841751cf8fdf41282aa Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 12 Apr 2011 16:00:27 +0000
Subject: [PATCH] Check that a SAML 1.1 SP's NameIDFormat list includes the
 Shibboleth transient, to allow the attribute query callback to be performed.

---
 build/check_shibboleth.xsl | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/build/check_shibboleth.xsl b/build/check_shibboleth.xsl
index 0bc1aad6..8b563f3c 100644
--- a/build/check_shibboleth.xsl
+++ b/build/check_shibboleth.xsl
@@ -109,6 +109,24 @@
 	</xsl:template>
 	
 
+	<!--
+		Check for SAML 1.1 SPs which exclude the Shibboleth transient name identifier format.
+		
+		An SP which has no NameIDFormat elements is fine, but if any are mentioned in a
+		SAML 1.1 SP then the Shibboleth transient must be included in the list as otherwise
+		there will be no name identifier sent to the SP and no attribute query can be
+		performed.
+	-->
+	<xsl:template match="md:SPSSODescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:1.1:protocol')]
+		[md:NameIDFormat]
+		[not(md:NameIDFormat[.='urn:mace:shibboleth:1.0:nameIdentifier'])]">
+		<xsl:call-template name="fatal">
+			<xsl:with-param name="m">SAML 1.1 SP excludes Shibboleth transient name identifier format</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+
+
 	<!--
 		Check for a construct which is known to cause the Shibboleth 1.3 SP to dump core.