From d1eeb8b22e470e749a921aa97724243b1db82cd9 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 27 Jan 2021 14:37:42 +0000
Subject: [PATCH] Permit mil.no as a non-regex scope on import from eduGAIN

See ukf/ukf-meta#291.
---
 mdx/uk/edugain-policy.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/mdx/uk/edugain-policy.xml b/mdx/uk/edugain-policy.xml
index af68a6e7..893e03af 100644
--- a/mdx/uk/edugain-policy.xml
+++ b/mdx/uk/edugain-policy.xml
@@ -75,6 +75,16 @@
                                 p:regex="" p:message="scope element must not be empty"/>
                             <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
                                 p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
+
+                            <!--
+                                Explicitly accept domains which, although they
+                                fall afoul of the public suffic heuristic, are
+                                nevertheless known to be legitimately used as
+                                security domains.
+                            -->
+                            <bean p:id="mil.no" parent="inc.AcceptStringValueValidator"
+                                p:value="mil.no"/>
+
                             <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
                                 p:message="scope is not a valid domain name: %s">
                                 <property name="validators">