From e9225d1362725a8b912c611d9c6d41488a98063d Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 3 May 2013 10:53:31 +0000
Subject: [PATCH] Support incmd (InCommon Federation metadata) extensions.

---
 mdx/_rules/check_incmd.xsl | 97 ++++++++++++++++++++++++++++++++++++++
 mdx/common-beans.xml       |  5 +-
 mdx/validation-beans.xml   | 19 ++++++++
 xml/incommon-metadata.xsd  | 28 +++++++++++
 4 files changed, 147 insertions(+), 2 deletions(-)
 create mode 100644 mdx/_rules/check_incmd.xsl
 create mode 100644 xml/incommon-metadata.xsd

diff --git a/mdx/_rules/check_incmd.xsl b/mdx/_rules/check_incmd.xsl
new file mode 100644
index 00000000..214860a3
--- /dev/null
+++ b/mdx/_rules/check_incmd.xsl
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_incmd.xsl
+	
+	Checking ruleset for the InCommon Federation metadata extensions,
+	the schema for which can be found here:
+
+        https://spaces.internet2.edu/x/iIuVAQ
+	
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:incmd="http://id.incommon.org/metadata"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="check_framework.xsl"/>
+
+	<!--
+		Checks for the contactType attribute.
+	-->
+	
+	<xsl:template match="@incmd:contactType[not(parent::md:ContactPerson)]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">incmd:contactType should only appear on md:ContactPerson</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<xsl:template match="md:ContactPerson[@incmd:contactType][@contactType != 'other']">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>incmd:contactType requires contactType='other', found '</xsl:text>
+				<xsl:value-of select="@contactType"/>
+				<xsl:text>'</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<xsl:template match="@incmd:contactType[not(starts-with(.,'http://'))][not(starts-with(.,'https://'))]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">incmd:contactType must be an absolute URI</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<!--
+		Check for specific values.  This test is probably over-specific in the long term.
+	-->
+	<xsl:template match="@incmd:contactType
+		[not(. = 'http://id.incommon.org/metadata/contactType/security')]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>unknown value '</xsl:text>
+				<xsl:value-of select="."/>
+				<xsl:text>' for incmd:contactType</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<xsl:template match="@incmd:contactType">
+		<!-- otherwise, fine -->
+	</xsl:template>
+	
+	<!--
+		Additional schema checks.
+		
+		The schema itself doesn't help very much as most contexts in which the incmd
+		namespace is used are subject to "lax" checking.  These checks duplicate some
+		aspects of XML Schema checking as we'd like it to behave.
+	-->
+	
+	<xsl:template match="incmd:*">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>unknown element incmd:</xsl:text>
+				<xsl:value-of select="local-name()"/>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<xsl:template match="@incmd:*">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>unknown attribute incmd:</xsl:text>
+				<xsl:value-of select="local-name()"/>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+</xsl:stylesheet>
diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index fb8cfca4..7cdefe35 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -34,11 +34,11 @@
     <bean id="component_parent" abstract="true" init-method="initialize"/>
     
     <!--
-        file_parent
+        FilesystemResource / file_parent
         
         Parent for all file system resource beans.
     -->
-    <bean id="file_parent" abstract="true" parent="component_parent"
+    <bean id="FilesystemResource" name="file_parent" abstract="true" parent="component_parent"
         class="net.shibboleth.utilities.java.support.resource.FilesystemResource"/>
 
     <!--
@@ -437,6 +437,7 @@
         A list of all schema documents that we make common use of.
     -->
     <util:list id="schemaResources">
+        <bean parent="FilesystemResource" c:resourcePath="#{ systemProperties['basedir'] }/xml/incommon-metadata.xsd"/>
         <bean parent="file_parent">
             <constructor-arg value="#{ systemProperties['basedir'] }/xml/MetadataExchange.xsd"/>
         </bean>
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 54830e12..4cfa5aed 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -576,6 +576,24 @@
         </property>
     </bean>
     
+    <!--
+        *******************************************************************
+        ***                                                             ***
+        ***   I N C O M M O N   F E D E R A T I O N   M E T A D A T A   ***
+        ***                                                             ***
+        *******************************************************************
+    -->
+    
+    <!--
+        check_incmd
+    -->
+    <bean id="check_incmd" parent="check_xslt_parent"
+        p:id="check_incmd">
+        <property name="xslResource">
+            <bean parent="FilesystemResource" c:resourcePath="#{ systemProperties['rulesdir'] }/check_incmd.xsl"/>
+        </property>
+    </bean>
+    
     <!--
         *******************************************************************
         ***                                                             ***
@@ -616,6 +634,7 @@
                 <ref bean="check_bindings"/>
                 <ref bean="check_hoksso"/>
                 <ref bean="check_idpdisc"/>
+                <ref bean="check_incmd"/>
                 <ref bean="check_init"/>
                 <ref bean="check_mdiop"/>
                 <ref bean="check_mdrpi"/>
diff --git a/xml/incommon-metadata.xsd b/xml/incommon-metadata.xsd
new file mode 100644
index 00000000..f33a8398
--- /dev/null
+++ b/xml/incommon-metadata.xsd
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<xs:schema
+  xmlns:xs="http://www.w3.org/2001/XMLSchema"
+  targetNamespace="http://id.incommon.org/metadata"
+  elementFormDefault="qualified"
+  attributeFormDefault="unqualified"
+  blockDefault="substitution"
+  version="2.0">
+  
+  <xs:annotation>
+    <xs:documentation>
+      Document title: Schema for InCommon Federation metadata extensions
+      Document identifier: Metadata Extension Schema
+      Location: https://spaces.internet2.edu/x/iIuVAQ
+      Revision history: 
+      V1.2 (3 May 2013):
+      Make schema itself schema-valid.
+      V1.1 (2 May 2013):
+      Initial version. Added documentation.
+      V1.0 (2 December 2011):
+      Initial version. Added contactType attribute.
+    </xs:documentation>
+  </xs:annotation>
+  
+  <xs:attribute name="contactType" type="xs:anyURI"/>
+  
+</xs:schema>