From 33d1fadc64926b5babfb0a30dbf06b900132a6b4 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 20 May 2014 16:01:05 +0100
Subject: [PATCH] Construct an eduGAIN export aggregate for InCommon.

---
 mdx/incommon/.gitignore           |   1 +
 mdx/incommon/beans.xml            |  39 +++++++
 mdx/incommon/export-whitelist.xml |  30 +++++
 mdx/incommon/export.xml           |  89 +++++++++++++++
 mdx/incommon/final_tweak.xsl      | 183 ++++++++++++++++++++++++++++++
 mdx/incommon/readme.md            |   5 +
 6 files changed, 347 insertions(+)
 create mode 100644 mdx/incommon/.gitignore
 create mode 100644 mdx/incommon/beans.xml
 create mode 100644 mdx/incommon/export-whitelist.xml
 create mode 100644 mdx/incommon/export.xml
 create mode 100644 mdx/incommon/final_tweak.xsl
 create mode 100644 mdx/incommon/readme.md

diff --git a/mdx/incommon/.gitignore b/mdx/incommon/.gitignore
new file mode 100644
index 00000000..38569ffb
--- /dev/null
+++ b/mdx/incommon/.gitignore
@@ -0,0 +1 @@
+exported.xml
diff --git a/mdx/incommon/beans.xml b/mdx/incommon/beans.xml
new file mode 100644
index 00000000..f479bdb6
--- /dev/null
+++ b/mdx/incommon/beans.xml
@@ -0,0 +1,39 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Common beans for this channel.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd">
+
+    <!--
+        Import generic beans from the us_incommon channel.
+    -->
+    <import resource="classpath:us_incommon/beans.xml"/>
+
+    <!--
+        finalise_parent
+
+        Template for a stage used in each output pipeline which performs
+        final tweaks on the document.
+    -->
+    <bean id="incommon_finalise_parent" abstract="true" parent="XSLTransformationStage">
+        <property name="XSLResource">
+            <bean parent="ClassPathResource">
+                <constructor-arg value="incommon/final_tweak.xsl"/>
+            </bean>
+        </property>
+        <property name="transformParameters">
+            <map>
+                <entry key="publisher" value-ref="us_incommon_registrar"/>
+            </map>
+        </property>
+    </bean>
+
+</beans>
diff --git a/mdx/incommon/export-whitelist.xml b/mdx/incommon/export-whitelist.xml
new file mode 100644
index 00000000..f8bae4b7
--- /dev/null
+++ b/mdx/incommon/export-whitelist.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd">
+
+    <!--
+        ***********************************************************
+        ***                                                     ***
+        ***   E D U G A I N   E X P O R T   W H I T E L I S T   ***
+        ***                                                     ***
+        ***********************************************************
+    -->
+
+    <!--
+        The entities named in this set will be exported from InCommon to eduGAIN.
+    -->
+    <util:set id="incommon_edugain_export_whitelist">
+
+        <!-- LIGO entities -->
+        <value>https://gw-astronomy.org/shibboleth-sp</value>
+
+    </util:set>
+
+</beans>
diff --git a/mdx/incommon/export.xml b/mdx/incommon/export.xml
new file mode 100644
index 00000000..99dcc65d
--- /dev/null
+++ b/mdx/incommon/export.xml
@@ -0,0 +1,89 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Construct InCommon eduGAIN export aggregate.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd">
+
+    <!--
+        Import commonly used beans.
+    -->
+    <import resource="classpath:common-beans.xml"/>
+
+    <!--
+        Import channel-specific beans.
+    -->
+    <import resource="classpath:incommon/beans.xml"/>
+    <import resource="classpath:incommon/export-whitelist.xml"/>
+
+    <bean id="serializeExported" parent="SerializationStage"
+        p:id="serializeExported">
+        <property name="outputFile">
+            <bean class="java.io.File">
+                <constructor-arg value="#{ systemProperties['basedir'] }/mdx/incommon/exported.xml"/>
+            </bean>
+        </property>
+    </bean>
+
+    <!--
+        Construct InCommon eduGAIN export aggregate.
+    -->
+    <bean id="export" parent="SimplePipeline"
+        p:id="export">
+        <property name="stages">
+            <list>
+                <!-- Start with the InCommon production aggregate. -->
+                <ref bean="us_incommon_productionAggregate"/>
+
+                <!--
+                    Check for fatal errors at the aggregate level:
+                        missing or expired validUntil attribute
+                        invalid signature
+                -->
+                <ref bean="check_validUntil"/>
+                <ref bean="us_incommon_checkSignature"/>
+                <ref bean="errorTerminatingFilter"/>
+
+                <!-- Break down into individual entities. -->
+                <ref bean="disassemble"/>
+
+                <!-- Remove all but the entities we want to export. -->
+                <bean id="applyEntityWhitelist" parent="EntityFilterStage"
+                    p:id="applyEntityWhitelist"
+                    p:whitelistingEntities="true"
+                    p:designatedEntities-ref="incommon_edugain_export_whitelist"/>
+
+                <!-- Include a default registrationAuthority for each entity. -->
+                <ref bean="us_incommon_default_regauth"/>
+
+                <!-- Construct an aggregate from the collection of entities. -->
+                <ref bean="assemble"/>
+
+                <!-- Apply final tweaks to the aggregate. -->
+                <bean id="finalise" parent="incommon_finalise_parent"
+                    p:id="finalise">
+                    <property name="transformParameters">
+                        <map>
+                            <entry key="extraText" value="eduGAIN export metadata"/>
+                            <entry key="publisher" value-ref="us_incommon_registrar"/>
+                        </map>
+                    </property>
+                </bean>
+
+                <!-- Normalise the use of namespace prefixes in the resulting XML document. -->
+                <ref bean="normaliseNamespaces"/>
+
+                <!-- Write the resulting aggregate out to a file. -->
+                <ref bean="serializeExported"/>
+            </list>
+        </property>
+    </bean>
+
+</beans>
diff --git a/mdx/incommon/final_tweak.xsl b/mdx/incommon/final_tweak.xsl
new file mode 100644
index 00000000..3293d46f
--- /dev/null
+++ b/mdx/incommon/final_tweak.xsl
@@ -0,0 +1,183 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	final_tweak.xsl
+
+	Final tweaks required for InCommon federation aggregates.
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+
+	xmlns:date="http://exslt.org/dates-and-times"
+	xmlns:mdxDates="xalan://uk.ac.sdss.xalan.md.Dates"
+	extension-element-prefixes="date mdxDates"
+
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	exclude-result-prefixes="md">
+
+	<!--Force UTF-8 encoding for the output.-->
+	<xsl:output omit-xml-declaration="no" method="xml" encoding="UTF-8" indent="yes"/>
+
+	<!--
+		extraText
+
+		This parameter, if present, provides additional text to be put in the
+		document comment.
+	-->
+	<xsl:param name="extraText"/>
+
+	<!--
+        publisher
+
+        This parameter, if present, prompts the generation of a PublicationInfo
+        element on the EntitiesDescriptor.
+    -->
+	<xsl:param name="publisher"/>
+
+	<!--
+		validityDays
+
+		This parameter determines the number of days between the aggregation instant and the
+		end of validity of the signed metadata.
+	-->
+	<xsl:param name="validityDays" select="14"/>
+
+	<xsl:variable name="now" select="date:date-time()"/>
+	<xsl:variable name="validUntil" select="mdxDates:dateAdd($now, $validityDays)"/>
+
+	<!--
+		documentID
+
+		This value is generated from a normalised version of the aggregation instant,
+		transformed so that it can be used as an XML ID value.
+
+		Strict conformance to the SAML 2.0 metadata specification (section 3.1.2) requires
+		that the signature explicitly references an identifier attribute in the element
+		being signed, in this case the document element.
+	-->
+	<xsl:variable name="normalisedNow" select="mdxDates:dateAdd($now, 0)"/>
+	<xsl:variable name="documentID"
+		select="concat('incommon', translate($normalisedNow, ':-', ''))"/>
+
+	<!--
+		Document root.
+	-->
+	<xsl:template match="/">
+		<xsl:call-template name="document.comment"/>
+		<xsl:apply-templates/>
+	</xsl:template>
+
+	<!--
+		Document element.
+	-->
+	<xsl:template match="/md:EntitiesDescriptor">
+		<EntitiesDescriptor>
+			<xsl:attribute name="validUntil">
+				<xsl:value-of select="$validUntil"/>
+			</xsl:attribute>
+			<xsl:attribute name="ID">
+				<xsl:value-of select="$documentID"/>
+			</xsl:attribute>
+			<xsl:apply-templates select="@*"/>
+			<xsl:call-template name="document.comment"/>
+
+			<!--
+                Add an Extensions element if there isn't one, but we need one
+                so that we can put a PublicationInfo inside it.
+            -->
+			<xsl:if test="$publisher and not(md:Extensions)">
+				<xsl:text>&#10;</xsl:text>
+				<xsl:text>    </xsl:text>
+				<xsl:element name="md:Extensions">
+					<xsl:call-template name="generate.publicationInfo"/>
+					<xsl:text>&#10;</xsl:text>
+					<xsl:text>    </xsl:text>
+				</xsl:element>
+				<xsl:text>&#10;</xsl:text>
+			</xsl:if>
+
+			<xsl:apply-templates select="node()"/>
+		</EntitiesDescriptor>
+	</xsl:template>
+
+	<!--
+		Comment to be added to the top of the document, and just inside the document element.
+	-->
+	<xsl:template name="document.comment">
+        <xsl:text>&#10;</xsl:text>
+		<xsl:comment>
+			<xsl:text>&#10;&#9;I N C O M M O N   F E D E R A T I O N   M E T A D A T A&#10;</xsl:text>
+			<xsl:text>&#10;</xsl:text>
+			<xsl:if test="$extraText">
+				<xsl:text>&#9;*** </xsl:text>
+				<xsl:value-of select="$extraText"/>
+				<xsl:text> ***&#10;</xsl:text>
+				<xsl:text>&#10;</xsl:text>
+			</xsl:if>
+			<xsl:text>&#9;Aggregate built </xsl:text>
+            <xsl:value-of select="$normalisedNow"/>
+            <xsl:if test="string($normalisedNow) != string($now)">
+                <xsl:text> (</xsl:text>
+                <xsl:value-of select="$now"/>
+                <xsl:text> local)</xsl:text>
+            </xsl:if>
+			<xsl:text>&#10;</xsl:text>
+			<xsl:text>&#10;</xsl:text>
+			<xsl:text>&#9;Aggregate valid for </xsl:text>
+			<xsl:value-of select="$validityDays"/>
+			<xsl:text> days, until </xsl:text>
+			<xsl:value-of select="$validUntil"/>
+			<xsl:text>&#10;</xsl:text>
+		</xsl:comment>
+	</xsl:template>
+
+	<!--
+        Document element's Extensions.
+
+        Insert a PublicationInfo at the top, if required.
+    -->
+	<xsl:template match="/md:EntitiesDescriptor/md:Extensions">
+		<xsl:copy>
+			<xsl:if test="$publisher">
+				<xsl:call-template name="generate.publicationInfo"/>
+			</xsl:if>
+			<xsl:apply-templates select="node()"/>
+		</xsl:copy>
+	</xsl:template>
+
+	<!--
+        PublicationInfo generation.
+
+        Assumption: called at the start of the document element's Extensions, at 4-space
+        indentation, so the element itself requires 8-space indentation.
+    -->
+	<xsl:template name="generate.publicationInfo">
+		<xsl:text>&#10;</xsl:text>
+		<xsl:text>        </xsl:text>
+		<xsl:element name="mdrpi:PublicationInfo">
+			<xsl:attribute name="publisher">
+				<xsl:value-of select="$publisher"/>
+			</xsl:attribute>
+			<xsl:attribute name="creationInstant">
+				<xsl:value-of select="$normalisedNow"/>
+			</xsl:attribute>
+		</xsl:element>
+	</xsl:template>
+
+	<!--By default, copy text blocks, comments and attributes unchanged.-->
+	<xsl:template match="text()|comment()|@*">
+		<xsl:copy/>
+	</xsl:template>
+
+	<!--By default, copy all elements from the input to the output, along with their attributes and contents.-->
+	<xsl:template match="*">
+		<xsl:copy>
+			<xsl:apply-templates select="node()|@*"/>
+		</xsl:copy>
+	</xsl:template>
+
+</xsl:stylesheet>
diff --git a/mdx/incommon/readme.md b/mdx/incommon/readme.md
new file mode 100644
index 00000000..3d409c08
--- /dev/null
+++ b/mdx/incommon/readme.md
@@ -0,0 +1,5 @@
+# `incommon` Channel
+
+The `incommon` channel contains beans for use in generating InCommon aggregates.
+
+The `us_incommon` channel is where InCommon-related beans for other purposes are defined.