From d4dbb24e54a337f4a1c62eec97c8d13015874ded Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 14 Mar 2012 15:35:34 +0000
Subject: [PATCH] saml2int mandates SAML 2.0 HTTP-POST responses, so fault SPs
 which support SAML 2.0 but which don't include an appropriate
 AssertionConsumerService endpoint.

---
 build/check_saml2int.xsl | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/build/check_saml2int.xsl b/build/check_saml2int.xsl
index 202c4fe8..de54b5fa 100644
--- a/build/check_saml2int.xsl
+++ b/build/check_saml2int.xsl
@@ -89,4 +89,17 @@
 		</xsl:call-template>
 	</xsl:template>
 	
+	<!--
+		Section 9.1
+		
+		Responses MUST use the HTTP-POST binding, so metadata for that MUST be present.
+	-->
+	<xsl:template match="md:SPSSODescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[not(md:AssertionConsumerService[@Binding = 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'])]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">no HTTP-POST support on SAML 2.0 SP</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
 </xsl:stylesheet>