From c7a12585f3b8f96efe7806d20bb4023b7e557de2 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 15 Mar 2012 13:39:49 +0000
Subject: [PATCH] Check that an IdP with a SAML 1.1 AttributeAuthority has an
 AttributeService with an appropriate Binding.

---
 build/check_saml1.xsl | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/build/check_saml1.xsl b/build/check_saml1.xsl
index 4f29a94e..8719a4ed 100644
--- a/build/check_saml1.xsl
+++ b/build/check_saml1.xsl
@@ -29,4 +29,16 @@
 		</xsl:call-template>
 	</xsl:template>
 		
+	<!--
+        An IdP with a SAML 1.1 AttributeAuthority needs an AttributeService with an appropriate Binding.
+    -->
+	<xsl:template match="md:AttributeAuthorityDescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:1.1:protocol')]
+		[not(md:AttributeService[@Binding='urn:oasis:names:tc:SAML:1.0:bindings:SOAP-binding'])]
+		">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 1.1 AttributeAuthority missing appropriately bound AttributeService</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
 </xsl:stylesheet>