From 4a13c34fd067487345ea6fda79cae4e0bd34c3a1 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 31 Jan 2017 14:51:40 +0000
Subject: [PATCH] Implement checks for v1.3 of the REFEDS R+S specification

Checks only applied to UK federation entities for now.
See ukf/ukf-meta#20.
---
 mdx/_rules/check_rands_member.xsl  | 86 ++++++++++++++++++++++++++++++
 mdx/_rules/check_rands_support.xsl | 49 +++++++++++++++++
 mdx/uk/beans.xml                   |  1 +
 mdx/validation-beans.xml           | 24 +++++++++
 4 files changed, 160 insertions(+)
 create mode 100644 mdx/_rules/check_rands_member.xsl
 create mode 100644 mdx/_rules/check_rands_support.xsl

diff --git a/mdx/_rules/check_rands_member.xsl b/mdx/_rules/check_rands_member.xsl
new file mode 100644
index 00000000..bee2e9d0
--- /dev/null
+++ b/mdx/_rules/check_rands_member.xsl
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_rands_member.xsl
+	
+	Checking ruleset containing rules associated with membership of the REFEDS
+	Research and Scholarship entity category, see:
+
+		https://refeds.org/category/research-and-scholarship/
+		
+	This ruleset reflects v1.3, 8-Sep-2016.
+
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+	xmlns:mdui="urn:oasis:names:tc:SAML:metadata:ui"
+	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="check_framework.xsl"/>
+
+    <!--
+    	Process entity category.
+	-->
+	<xsl:template match="md:EntityDescriptor
+		[md:Extensions/mdattr:EntityAttributes/saml:Attribute
+		[@NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:uri']
+		[@Name='http://macedir.org/entity-category']
+		/saml:AttributeValue[.='http://refeds.org/category/research-and-scholarship']
+		]">
+		<xsl:choose>
+			<!--
+				(Implicit) applies only to service providers.
+			-->
+			<xsl:when test="not(md:SPSSODescriptor)">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">REFEDS R+S only applies to service provider entities</xsl:with-param>
+				</xsl:call-template>        
+			</xsl:when>
+			<!--
+		        4.3.1
+
+        		The Service Provider [...] supports SAML V2.0 HTTP-POST binding.
+    		-->
+			<xsl:when test="not(md:SPSSODescriptor/md:AssertionConsumerService
+				[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'])">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">REFEDS R+S requires SAML 2.0 POST support</xsl:with-param>
+				</xsl:call-template>        
+			</xsl:when>
+			<!--
+				4.3.3
+				
+				The Service Provider provides an mdui:DisplayName and mdui:InformationURL in metadata.
+			-->
+			<xsl:when test="not(md:SPSSODescriptor/md:Extensions/mdui:UIInfo/mdui:DisplayName)">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">REFEDS R+S requires mdui:DisplayName</xsl:with-param>
+				</xsl:call-template>        
+			</xsl:when>
+			<xsl:when test="not(md:SPSSODescriptor/md:Extensions/mdui:UIInfo/mdui:InformationURL)">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">REFEDS R+S requires mdui:InformationURL</xsl:with-param>
+				</xsl:call-template>        
+			</xsl:when>
+			<!--
+				4.3.4
+
+				The Service Provider provides one or more technical contacts in metadata.
+			-->
+			<xsl:when test="not(md:ContactPerson[@contactType='technical'])">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">REFEDS R+S requires one or more technical contacts</xsl:with-param>
+				</xsl:call-template>        
+			</xsl:when>
+		</xsl:choose>
+	</xsl:template>
+
+</xsl:stylesheet>
diff --git a/mdx/_rules/check_rands_support.xsl b/mdx/_rules/check_rands_support.xsl
new file mode 100644
index 00000000..fe92e6d8
--- /dev/null
+++ b/mdx/_rules/check_rands_support.xsl
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_rands_support.xsl
+	
+	Checking ruleset containing rules associated with the REFEDS
+	Research and Scholarship entity support category, see:
+
+		https://refeds.org/category/research-and-scholarship/
+		
+	This ruleset reflects v1.3, 8-Sep-2016.
+	
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="check_framework.xsl"/>
+
+	<!--
+        Process entity support category.
+    -->
+	<xsl:template match="md:EntityDescriptor
+		[md:Extensions/mdattr:EntityAttributes/saml:Attribute
+		[@NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:uri']
+		[@Name='http://macedir.org/entity-category-support']
+		/saml:AttributeValue[.='http://refeds.org/category/research-and-scholarship']
+		]">
+		<xsl:choose>
+			<!--
+                (Implicit) applies only to identity providers.
+            -->
+			<xsl:when test="not(md:IDPSSODescriptor)">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">REFEDS R+S support only applies to identity provider entities</xsl:with-param>
+				</xsl:call-template>        
+			</xsl:when>
+		</xsl:choose>
+	</xsl:template>
+
+</xsl:stylesheet>
diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index eb185e63..6fb81d6a 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -334,6 +334,7 @@
                 <ref bean="check_uk_mdattr"/>
                 <ref bean="check_uk_mdrps"/>
                 <ref bean="check_uk_urlenc"/>
+                <ref bean="check_rands"/>
                 <ref bean="mdui_dn_en_present"/>
                 <ref bean="mdui_dn_en_match"/>
                 <ref bean="check_dup_display"/>
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 3ded8bdf..da3237f7 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -277,6 +277,30 @@
         p:XSLResource="classpath:_rules/check_incmd.xsl"/>
 
     
+    <!--
+        ***********************************************************
+        ***                                                     ***
+        ***   R E F E D S   R + S   S P E C I F I C A T I O N   ***
+        ***                                                     ***
+        ***********************************************************
+    -->
+
+    <bean id="check_rands_member" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_rands_member.xsl"/>
+
+    <bean id="check_rands_support" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_rands_support.xsl"/>
+
+    <bean id="check_rands" parent="CompositeStage">
+        <property name="composedStages">
+            <list>
+                <ref bean="check_rands_member"/>
+                <ref bean="check_rands_support"/>
+            </list>
+        </property>
+    </bean>
+
+
     <!--
         ***********************************************************
         ***                                                     ***