From 2eedc031576342957892522de446aff810e3223f Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 2 Jan 2014 14:30:04 +0000
Subject: [PATCH] Improve heuristic: it can't be Shibboleth 1.3 if it supports
 SAML 2.0.

---
 mdx/uk/statistics.xsl | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/mdx/uk/statistics.xsl b/mdx/uk/statistics.xsl
index faf0c68d..e44b02e4 100644
--- a/mdx/uk/statistics.xsl
+++ b/mdx/uk/statistics.xsl
@@ -1636,10 +1636,16 @@
     -->
     <xsl:template name="list.shibboleth.1.3.entities">
         <xsl:param name="entities"/>
-        <!-- remove everything that says it is something other than Shibboleth -->
+        <!--
+            Remove everything that says it is something other than Shibboleth, or which includes
+            a SAML 2.0 token in any of its role descriptors' protocolSupportEnumerations.
+        -->
         <xsl:variable name="entities.1"
             select="set:difference($entities,
-                $entities[md:Extensions/ukfedlabel:Software[@name != 'Shibboleth']])"/>
+                $entities[
+                    md:Extensions/ukfedlabel:Software[@name != 'Shibboleth'] |
+                    md:*[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+                ])"/>
         <!-- remove things that look like Shibboleth 2.x -->
         <xsl:variable name="entities.2"
             select="set:difference($entities.1,
@@ -1788,6 +1794,8 @@
                     md:Extensions/ukfedlabel:Software[@name='Shibboleth'][@version = '1.3'] |
                     md:IDPSSODescriptor/md:SingleSignOnService[contains(@Location, '-idp/SSO')] |
                     md:SPSSODescriptor/md:AssertionConsumerService[contains(@Location, 'Shibboleth.sso')]
+                ][
+                    not(md:*[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')])
                 ]"/>
             <xsl:variable name="entities.shib.13.out"
                 select="set:difference($entities.shib.13.in, $entities.shib.13)"/>