From 78574fda30cd311bee8da55657dd8bca3fb4cf40 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 27 Jan 2021 14:37:42 +0000
Subject: [PATCH 1/2] Permit mil.no as a non-regex scope on import from eduGAIN

See ukf/ukf-meta#291.
---
 mdx/uk/edugain-policy.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/mdx/uk/edugain-policy.xml b/mdx/uk/edugain-policy.xml
index af68a6e7..893e03af 100644
--- a/mdx/uk/edugain-policy.xml
+++ b/mdx/uk/edugain-policy.xml
@@ -75,6 +75,16 @@
                                 p:regex="" p:message="scope element must not be empty"/>
                             <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
                                 p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
+
+                            <!--
+                                Explicitly accept domains which, although they
+                                fall afoul of the public suffic heuristic, are
+                                nevertheless known to be legitimately used as
+                                security domains.
+                            -->
+                            <bean p:id="mil.no" parent="inc.AcceptStringValueValidator"
+                                p:value="mil.no"/>
+
                             <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
                                 p:message="scope is not a valid domain name: %s">
                                 <property name="validators">

From f4234e82206cb63cc1b41a34c198c9fd924fb6a0 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 29 Jan 2021 14:54:43 +0000
Subject: [PATCH 2/2] Accept mil.no as a non-regex scope from eduGAIN in
 InCommon

---
 mdx/incommon/edugain-policy.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/mdx/incommon/edugain-policy.xml b/mdx/incommon/edugain-policy.xml
index eaf4b0bc..8b7c8f10 100644
--- a/mdx/incommon/edugain-policy.xml
+++ b/mdx/incommon/edugain-policy.xml
@@ -301,6 +301,16 @@
                                 p:regex="" p:message="scope element must not be empty"/>
                             <bean p:id="whiteSpace" parent="inc.RejectStringRegexValidator"
                                 p:regex=".*\s.*" p:message="scope '%s' includes white space"/>
+
+                            <!--
+                                Explicitly accept domains which, although they
+                                fall afoul of the public suffic heuristic, are
+                                nevertheless known to be legitimately used as
+                                security domains.
+                            -->
+                            <bean p:id="mil.no" parent="inc.AcceptStringValueValidator"
+                                p:value="mil.no"/>
+
                             <bean p:id="domainName" parent="inc.AsDomainNameStringValidator"
                                 p:message="scope is not a valid domain name: %s">
                                 <property name="validators">