From b50825987913556744e5576c066abab939739bcf Mon Sep 17 00:00:00 2001
From: Alex Stuart <alex.stuart@jisc.ac.uk>
Date: Wed, 26 May 2021 15:20:38 +0100
Subject: [PATCH] Add validation for SAML subject identifier entity attribute

See ukf/ukf-meta#176 for details
---
 mdx/uk/check_uk_mdattr.xsl | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/mdx/uk/check_uk_mdattr.xsl b/mdx/uk/check_uk_mdattr.xsl
index 48f3ef66..cd00198b 100644
--- a/mdx/uk/check_uk_mdattr.xsl
+++ b/mdx/uk/check_uk_mdattr.xsl
@@ -64,6 +64,7 @@
         [@Name != 'http://macedir.org/entity-category']
         [@Name != 'http://macedir.org/entity-category-support']
         [@Name != 'urn:oasis:names:tc:SAML:attribute:assurance-certification']
+        [@Name != 'urn:oasis:names:tc:SAML:profiles:subject-id:req']
         ">
         <xsl:call-template name="error">
             <xsl:with-param name="m">
@@ -121,4 +122,22 @@
         </xsl:call-template>
     </xsl:template>
 
+    <!--
+        Validate SAML subject identifier requirement value.
+    -->
+    <xsl:template match="mdattr:EntityAttributes/saml:Attribute[@Name='urn:oasis:names:tc:SAML:profiles:subject-id:req']
+        /saml:AttributeValue
+            [. != 'subject-id']
+            [. != 'pairwise-id']
+            [. != 'none']
+            [. != 'any']
+        ">
+        <xsl:call-template name="error">
+            <xsl:with-param name="m">
+                <xsl:text>unknown subject identifier requirement values </xsl:text>
+                <xsl:value-of select="."/>
+            </xsl:with-param>
+        </xsl:call-template>
+    </xsl:template>
+
 </xsl:stylesheet>