ArtifactResolutionService endpoints on SPs are usually not TLS-authen…

…ticated.
InCommon · Nov 18, 2012 · f6ebefc · f6ebefc
1 parent 14223b0
commit f6ebefc
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/build/extract_cert_locs.xsl b/build/extract_cert_locs.xsl
@@ -24,7 +24,12 @@
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
 
-	<xsl:template match="//md:ArtifactResolutionService">
+	<!--
+		ArtifactResolutionService endpoints on IdPs are assumed to be
+		authenticated by TLS; those on SPs are assumed to be authenticated
+		using other mechanisms.
+	-->
+	<xsl:template match="//md:IDPSSODescriptor/md:ArtifactResolutionService">
 		<xsl:value-of select="@Location"/>
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>

diff --git a/build/extract_nocert_locs.xsl b/build/extract_nocert_locs.xsl
@@ -31,6 +31,11 @@
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
 
+	<xsl:template match="//md:SPSSODescriptor/md:ArtifactResolutionService">
+		<xsl:value-of select="@Location"/>
+		<xsl:text>&#x0a;</xsl:text>
+	</xsl:template>
+
 	<xsl:template match="text()">
 		<!-- do nothing -->
 	</xsl:template>