From f6ebefc3e209103c74fe52e61240264595cb029f Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Sun, 18 Nov 2012 10:10:26 +0000
Subject: [PATCH] ArtifactResolutionService endpoints on SPs are usually not
 TLS-authenticated.

---
 build/extract_cert_locs.xsl   | 7 ++++++-
 build/extract_nocert_locs.xsl | 5 +++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/build/extract_cert_locs.xsl b/build/extract_cert_locs.xsl
index 53e0c474..983f7194 100644
--- a/build/extract_cert_locs.xsl
+++ b/build/extract_cert_locs.xsl
@@ -24,7 +24,12 @@
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
 	
-	<xsl:template match="//md:ArtifactResolutionService">
+	<!--
+		ArtifactResolutionService endpoints on IdPs are assumed to be
+		authenticated by TLS; those on SPs are assumed to be authenticated
+		using other mechanisms.
+	-->
+	<xsl:template match="//md:IDPSSODescriptor/md:ArtifactResolutionService">
 		<xsl:value-of select="@Location"/>
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
diff --git a/build/extract_nocert_locs.xsl b/build/extract_nocert_locs.xsl
index 99e5dd2c..335e0fc7 100644
--- a/build/extract_nocert_locs.xsl
+++ b/build/extract_nocert_locs.xsl
@@ -31,6 +31,11 @@
 		<xsl:text>&#x0a;</xsl:text>
 	</xsl:template>
 
+	<xsl:template match="//md:SPSSODescriptor/md:ArtifactResolutionService">
+		<xsl:value-of select="@Location"/>
+		<xsl:text>&#x0a;</xsl:text>
+	</xsl:template>
+
 	<xsl:template match="text()">
 		<!-- do nothing -->
 	</xsl:template>