Add a check for the Shib 1.3 IdP (and metadatatool) issue described in …

…https://bugs.internet2.edu/jira/browse/SIDPO-34
InCommon · Nov 6, 2009 · c03bf2e · c03bf2e
1 parent c3c6958
commit c03bf2e
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 0 deletions.
diff --git a/build/check.xsl b/build/check.xsl
@@ -13,6 +13,7 @@
 	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
 	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
 	xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
 	xmlns:set="http://exslt.org/sets"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
@@ -164,6 +165,22 @@
 	</xsl:template>
 
 
+	<!--
+		Check for IDP role descriptors containing (at any level of nesting)
+		SAML 2.0 attribute elements that do not include a NameFormat XML attribute.
+		
+		This combination causes the Shibboleth 1.3 and related code (such as metadatatool)
+		to reject the metadata.
+		
+		See https://bugs.internet2.edu/jira/browse/SIDPO-34
+	-->
+	<xsl:template match="md:IDPSSODescriptor[descendant::saml:Attribute[not(@NameFormat)]]">
+		<xsl:call-template name="fatal">
+			<xsl:with-param name="m">SIDPO-34: Attribute lacking NameFormat in IDPSSODescriptor</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+
+
 	<!--
 		Entity IDs should not contain space characters.
 	-->

diff --git a/build/check_imported.xsl b/build/check_imported.xsl
@@ -13,6 +13,7 @@
 	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
 	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
 	xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
 	xmlns:set="http://exslt.org/sets"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
@@ -99,6 +100,22 @@
 	</xsl:template>
 
 
+	<!--
+		Check for IDP role descriptors containing (at any level of nesting)
+		SAML 2.0 attribute elements that do not include a NameFormat XML attribute.
+		
+		This combination causes the Shibboleth 1.3 and related code (such as metadatatool)
+		to reject the metadata.
+		
+		See https://bugs.internet2.edu/jira/browse/SIDPO-34
+	-->
+	<xsl:template match="md:IDPSSODescriptor[descendant::saml:Attribute[not(@NameFormat)]]">
+		<xsl:call-template name="fatal">
+			<xsl:with-param name="m">SIDPO-34: Attribute lacking NameFormat in IDPSSODescriptor</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+
+
 	<!--
 		Entity IDs should not contain space characters.
 	-->