From b68d98526d6fd75ac83854a78dc07ef47de2999d Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 18 Apr 2011 16:07:52 +0000
Subject: [PATCH] Split the SSO/SOAP virtual host test out from check_imported
 into check_vhosts, and use just that in the check.ports target. Neither
 check_imported (which now just observes a requirement for UK federation IdPs
 to have scopes) nor the new check_vhosts are suitable for checking metadata
 imported from other partners; they are both UK conventions only.

---
 build.xml                | 11 ++++----
 build/check_imported.xsl | 28 -------------------
 build/check_vhosts.xsl   | 58 ++++++++++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+), 34 deletions(-)
 create mode 100644 build/check_vhosts.xsl

diff --git a/build.xml b/build.xml
index 08f9f8a6..644f40fb 100644
--- a/build.xml
+++ b/build.xml
@@ -850,7 +850,10 @@
 			<arg value="${build.dir}/import.xsl"/>
 		</java>
 		<echo>Imported metadata to ${entities.dir}/imported.xml</echo>
-		<CHECK i="${entities.dir}/imported.xml" s="check_imported.xsl"/>
+        <CHECK.std i="${entities.dir}/imported.xml">
+            <arg value="${build.dir}/check_imported.xsl"/>
+            <arg value="${build.dir}/check_vhosts.xsl"/>
+        </CHECK.std>
 		<echo>Checked.</echo>
 	</target>
 	
@@ -967,7 +970,6 @@
         <attribute name="i"/>
         <sequential>
             <CHECK.std i="@{i}">
-                <arg value="${build.dir}/check_imported.xsl"/>
                 <arg value="${build.dir}/check_future.xsl"/>
                 <arg value="${build.dir}/check_saml2int.xsl"/>
             </CHECK.std>
@@ -1223,13 +1225,10 @@
 	
 	<!--
 	   Check for IdPs using the single-port configuration.
-	   
-	   It just so happens that the check_imported ruleset is exactly what we want
-	   right now.
 	-->
 	<target name="check.ports" depends="gen.uk.master">
 		<echo>Checking vhost use</echo>
-        <CHECK i="${xml.dir}/${uk.master.file}" s="check_imported.xsl"/>
+        <CHECK.one i="${xml.dir}/${uk.master.file}" s="check_vhosts.xsl"/>
         <echo>Checked.</echo>
 	</target>
 
diff --git a/build/check_imported.xsl b/build/check_imported.xsl
index 8ac86eb7..e663fe9e 100644
--- a/build/check_imported.xsl
+++ b/build/check_imported.xsl
@@ -29,34 +29,6 @@
 		Checks for IdPs.
 	-->
 	<xsl:template match="md:EntityDescriptor[md:IDPSSODescriptor]">
-		<!--
-			Look for IdPs which have either attribute authority or artifact resolution locations
-			on the same host:port combination as any of the SSO locations.
-		-->
-		
-		<!-- XPath expression to evaluate to extract host:port strings from locations -->
-		<xsl:variable name="extract">substring-before(substring-after(concat(., '/'), 'https://'), '/')</xsl:variable>
-		
-		<!-- Collect all of the SSO locations -->
-		<xsl:variable name="ssoLocations" select="descendant::md:SingleSignOnService/@Location"/>
-		<!-- convert to set of unique host:port strings -->
-		<xsl:variable name="ssoHosts" select="set:distinct(dyn:map($ssoLocations, $extract))"/>
-		
-		<!-- Collect all of the attribute authority and artifact resolution locations -->
-		<xsl:variable name="soapLocations"
-			select="descendant::md:AttributeService/@Location |
-			descendant::md:ArtifactResolutionService/@Location"/>
-		<!-- convert to set of unique host:port strings -->
-		<xsl:variable name="soapHosts" select="set:distinct(dyn:map($soapLocations, $extract))"/>
-		
-		<!-- we expect these two sets to be disjoint -->
-		<xsl:variable name="bothHosts" select="set:distinct($ssoHosts | $soapHosts)"/>
-		<xsl:if test="count($bothHosts) != count($ssoHosts) + count($soapHosts)">
-			<xsl:call-template name="fatal">
-				<xsl:with-param name="m">at least one SOAP location on same vhost as an SSO location</xsl:with-param>
-			</xsl:call-template>
-		</xsl:if>
-		
 		<!--
 			IdPs registered with the UK federation are expected to have at least one scope.
 		-->
diff --git a/build/check_vhosts.xsl b/build/check_vhosts.xsl
new file mode 100644
index 00000000..4a09451f
--- /dev/null
+++ b/build/check_vhosts.xsl
@@ -0,0 +1,58 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_vhosts.xsl
+	
+	Checking ruleset that makes sure that an IdP's SSO endpoints and SOAP
+	endpoints are on distinct virtual host.
+	
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:dyn="http://exslt.org/dynamic"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:set="http://exslt.org/sets"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="check_framework.xsl"/>
+
+	<!--
+		Check IdPs only.
+	-->
+	<xsl:template match="md:EntityDescriptor[md:IDPSSODescriptor]">
+		<!--
+			Look for IdPs which have either attribute authority or artifact resolution locations
+			on the same host:port combination as any of the SSO locations.
+		-->
+		
+		<!-- XPath expression to evaluate to extract host:port strings from locations -->
+		<xsl:variable name="extract">substring-before(substring-after(concat(., '/'), 'https://'), '/')</xsl:variable>
+		
+		<!-- Collect all of the SSO locations -->
+		<xsl:variable name="ssoLocations" select="descendant::md:SingleSignOnService/@Location"/>
+		<!-- convert to set of unique host:port strings -->
+		<xsl:variable name="ssoHosts" select="set:distinct(dyn:map($ssoLocations, $extract))"/>
+		
+		<!-- Collect all of the attribute authority and artifact resolution locations -->
+		<xsl:variable name="soapLocations"
+			select="descendant::md:AttributeService/@Location |
+			descendant::md:ArtifactResolutionService/@Location"/>
+		<!-- convert to set of unique host:port strings -->
+		<xsl:variable name="soapHosts" select="set:distinct(dyn:map($soapLocations, $extract))"/>
+		
+		<!-- we expect these two sets to be disjoint -->
+		<xsl:variable name="bothHosts" select="set:distinct($ssoHosts | $soapHosts)"/>
+		<xsl:if test="count($bothHosts) != count($ssoHosts) + count($soapHosts)">
+			<xsl:call-template name="fatal">
+				<xsl:with-param name="m">at least one SOAP location on same vhost as an SSO location</xsl:with-param>
+			</xsl:call-template>
+		</xsl:if>
+	</xsl:template>
+	
+</xsl:stylesheet>