From 5014a0991e732efdd690e4be167ded318311a32b Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 5 Jun 2015 15:03:40 +0100
Subject: [PATCH] Add draft phase 2 and phase 3 policy files.

---
 mdx/incommon/edugain-phase2.xml | 170 ++++++++++++++++++++++++++++++++
 mdx/incommon/edugain-phase3.xml | 147 +++++++++++++++++++++++++++
 2 files changed, 317 insertions(+)
 create mode 100644 mdx/incommon/edugain-phase2.xml
 create mode 100644 mdx/incommon/edugain-phase3.xml

diff --git a/mdx/incommon/edugain-phase2.xml b/mdx/incommon/edugain-phase2.xml
new file mode 100644
index 00000000..0874b9b1
--- /dev/null
+++ b/mdx/incommon/edugain-phase2.xml
@@ -0,0 +1,170 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+    <!--
+        edugainPolicy
+
+        Applies policy to entities sourced from eduGAIN.
+
+        Entities may be transformed by policy, or marked as being in error.
+
+        Entities with errors are NOT removed here, so that this policy can be
+        used in contexts where reporting is more appropriate than just removal.
+    -->
+    <bean id="edugainPolicy" parent="CompositeStage"
+        p:id="edugainPolicy">
+        <property name="composedStages">
+            <list>
+
+                <!--
+                    removeInCommonEntities
+
+                    Filter out entities that declare themselves as registered
+                    by our federation.  We don't want those coming back in
+                    from another registrar or metadata exchange as they may be
+                    old versions of entities we have deregistered, or spoofed.
+                -->
+                <bean p:id="removeInCommonEntities" parent="EntityRegistrationAuthorityFilterStage">
+                    <property name="designatedRegistrationAuthorities">
+                        <list>
+                            <ref bean="us_incommon_registrar"/>
+                        </list>
+                    </property>
+                    <property name="requiringRegistrationInformation" value="true"/>
+                    <property name="whitelistingRegistrationAuthorities" value="false"/>
+                </bean>
+
+                <!--
+                    Remove all but those eduGAIN entities we intend to import in this
+                    phase of the roadmap.
+
+                    Phase 2: import all SPs, plus IdPs that support global R&S.
+                -->
+                <bean p:id="selectEntities" parent="XPathFilteringStage"
+                    p:XPathExpression="not(/md:EntityDescriptor
+                        [md:IDPSSODescriptor]
+                        [md:Extensions
+                            /mdattr:EntityAttributes
+                            /saml:Attribute
+                                [@NameFormat = 'urn:oasis:names:tc:SAML:2.0:attrname-format:uri']
+                                [@Name = 'http://macedir.org/entity-category-support']
+                            /saml:AttributeValue
+                                [. = 'http://refeds.org/category/research-and-scholarship']
+                        ]
+                    or
+                        /md:EntityDescriptor
+                            [md:SPSSODescriptor]
+                    )"
+                />
+
+                <!-- Filter the entity attributes imported from eduGAIN. -->
+                <bean parent="EntityAttributeFilteringStage" p:id="entityAttributes">
+                    <property name="rules">
+                        <list>
+                            <!-- Permit REFEDS R&S category membership -->
+                            <bean parent="EntityCategoryMatcher"
+                                c:category="http://refeds.org/category/research-and-scholarship"/>
+
+                            <!-- Permit REFEDS R&S category support -->
+                            <bean parent="EntityCategorySupportMatcher"
+                                c:category="http://refeds.org/category/research-and-scholarship"/>
+
+                            <!-- Permit REFEDS Hide From Discovery category membership -->
+                            <bean parent="EntityCategoryMatcher"
+                                c:category="http://refeds.org/category/hide-from-discovery"/>
+
+                        </list>
+                    </property>
+                </bean>
+
+                <!--
+                    The following two namespaces are always stripped because they are
+                    specific to the UK registrar and can't be valid when imported from
+                    some other source.
+                -->
+                <ref bean="stripUkfedlabelNamespace"/>
+                <ref bean="stripWayfNamespace"/>
+
+                <ref bean="cleanImport"/>
+                <ref bean="stripAAMDUI"/>
+                <ref bean="trimImportElementWhitespace"/>
+                <ref bean="removeEmptyExtensions"/>
+                <ref bean="checkSchemas"/>
+
+                <!--
+                    We do not currently apply the complete battery of checking rulesets used by
+                    the UK federation. Originally, this was because of issues porting some rules
+                    into the MDA 0.9 environment.
+
+                    For reference, here is an expanded list of the individual checking beans
+                    so that we can review and reintroduce those which seem appropriate.
+
+                    CHECK_imported:
+                        CHECK_std:
+                            <ref bean="check_adfs"/>
+                            <ref bean="check_algsupport"/>
+                            <ref bean="check_bindings"/>
+                            <ref bean="check_hoksso"/>
+                            <ref bean="check_idpdisc"/>
+                            <ref bean="check_incmd"/>
+                            <ref bean="check_init"/>
+                            <ref bean="check_mdattr"/>
+                            <ref bean="check_mdiop"/>
+                            <ref bean="check_mdrpi"/>
+                            <ref bean="check_mdui"/>
+                            <ref bean="check_misc"/>
+                            <ref bean="check_reqattr"/>
+                            <ref bean="check_saml1"/>
+                            <ref bean="check_saml2"/>
+                            <ref bean="check_saml2int"/>
+                            <ref bean="check_saml2meta"/>
+                            <ref bean="check_saml_strings"/>
+                            <ref bean="check_shibboleth"/>
+                            <ref bean="check_uk_algorithms"/>
+                            <ref bean="check_uk_trust"/>
+                            <ref bean="check_uk_wayf"/>
+                        <ref bean="check_dup_display"/>
+                        <ref bean="check_regscope"/>
+                        <ref bean="check_namespaces"/>
+                -->
+
+                <bean p:id="certificateValidation" parent="X509ValidationStage">
+                    <property name="validators">
+                        <list>
+                            <!-- Error on RSA key length less than 2048 bits. -->
+                            <bean parent="X509RSAKeyLengthValidator"
+                                p:warningBoundary="0" p:errorBoundary="2048"/>
+                            <!-- Error on small RSA public exponents. -->
+                            <bean parent="X509RSAExponentValidator"/>
+
+                            <!--
+                                Debian weak key blacklists.
+
+                                Don't need to check for keys below our minimum key size.
+                            -->
+                            <ref bean="debian.2048"/>
+                            <ref bean="debian.4096"/>
+
+                            <!--
+                                Compromised key blacklists.
+
+                                Again, don't need to check for keys below our minimum key size.
+                            -->
+                            <ref bean="compromised.2048"/>
+                        </list>
+                    </property>
+                </bean>
+
+            </list>
+        </property>
+    </bean>
+
+</beans>
diff --git a/mdx/incommon/edugain-phase3.xml b/mdx/incommon/edugain-phase3.xml
new file mode 100644
index 00000000..e6b387cd
--- /dev/null
+++ b/mdx/incommon/edugain-phase3.xml
@@ -0,0 +1,147 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<beans xmlns="http://www.springframework.org/schema/beans"
+    default-lazy-init="true"
+    xmlns:c="http://www.springframework.org/schema/c"
+    xmlns:p="http://www.springframework.org/schema/p"
+    xmlns:util="http://www.springframework.org/schema/util"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="
+        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
+
+    <!--
+        edugainPolicy
+
+        Applies policy to entities sourced from eduGAIN.
+
+        Entities may be transformed by policy, or marked as being in error.
+
+        Entities with errors are NOT removed here, so that this policy can be
+        used in contexts where reporting is more appropriate than just removal.
+    -->
+    <bean id="edugainPolicy" parent="CompositeStage"
+        p:id="edugainPolicy">
+        <property name="composedStages">
+            <list>
+
+                <!--
+                    removeInCommonEntities
+
+                    Filter out entities that declare themselves as registered
+                    by our federation.  We don't want those coming back in
+                    from another registrar or metadata exchange as they may be
+                    old versions of entities we have deregistered, or spoofed.
+                -->
+                <bean p:id="removeInCommonEntities" parent="EntityRegistrationAuthorityFilterStage">
+                    <property name="designatedRegistrationAuthorities">
+                        <list>
+                            <ref bean="us_incommon_registrar"/>
+                        </list>
+                    </property>
+                    <property name="requiringRegistrationInformation" value="true"/>
+                    <property name="whitelistingRegistrationAuthorities" value="false"/>
+                </bean>
+
+                <!-- Filter the entity attributes imported from eduGAIN. -->
+                <bean parent="EntityAttributeFilteringStage" p:id="entityAttributes">
+                    <property name="rules">
+                        <list>
+                            <!-- Permit REFEDS R&S category membership -->
+                            <bean parent="EntityCategoryMatcher"
+                                c:category="http://refeds.org/category/research-and-scholarship"/>
+
+                            <!-- Permit REFEDS R&S category support -->
+                            <bean parent="EntityCategorySupportMatcher"
+                                c:category="http://refeds.org/category/research-and-scholarship"/>
+
+                            <!-- Permit REFEDS Hide From Discovery category membership -->
+                            <bean parent="EntityCategoryMatcher"
+                                c:category="http://refeds.org/category/hide-from-discovery"/>
+
+                        </list>
+                    </property>
+                </bean>
+
+                <!--
+                    The following two namespaces are always stripped because they are
+                    specific to the UK registrar and can't be valid when imported from
+                    some other source.
+                -->
+                <ref bean="stripUkfedlabelNamespace"/>
+                <ref bean="stripWayfNamespace"/>
+
+                <ref bean="cleanImport"/>
+                <ref bean="stripAAMDUI"/>
+                <ref bean="trimImportElementWhitespace"/>
+                <ref bean="removeEmptyExtensions"/>
+                <ref bean="checkSchemas"/>
+
+                <!--
+                    We do not currently apply the complete battery of checking rulesets used by
+                    the UK federation. Originally, this was because of issues porting some rules
+                    into the MDA 0.9 environment.
+
+                    For reference, here is an expanded list of the individual checking beans
+                    so that we can review and reintroduce those which seem appropriate.
+
+                    CHECK_imported:
+                        CHECK_std:
+                            <ref bean="check_adfs"/>
+                            <ref bean="check_algsupport"/>
+                            <ref bean="check_bindings"/>
+                            <ref bean="check_hoksso"/>
+                            <ref bean="check_idpdisc"/>
+                            <ref bean="check_incmd"/>
+                            <ref bean="check_init"/>
+                            <ref bean="check_mdattr"/>
+                            <ref bean="check_mdiop"/>
+                            <ref bean="check_mdrpi"/>
+                            <ref bean="check_mdui"/>
+                            <ref bean="check_misc"/>
+                            <ref bean="check_reqattr"/>
+                            <ref bean="check_saml1"/>
+                            <ref bean="check_saml2"/>
+                            <ref bean="check_saml2int"/>
+                            <ref bean="check_saml2meta"/>
+                            <ref bean="check_saml_strings"/>
+                            <ref bean="check_shibboleth"/>
+                            <ref bean="check_uk_algorithms"/>
+                            <ref bean="check_uk_trust"/>
+                            <ref bean="check_uk_wayf"/>
+                        <ref bean="check_dup_display"/>
+                        <ref bean="check_regscope"/>
+                        <ref bean="check_namespaces"/>
+                -->
+
+                <bean p:id="certificateValidation" parent="X509ValidationStage">
+                    <property name="validators">
+                        <list>
+                            <!-- Error on RSA key length less than 2048 bits. -->
+                            <bean parent="X509RSAKeyLengthValidator"
+                                p:warningBoundary="0" p:errorBoundary="2048"/>
+                            <!-- Error on small RSA public exponents. -->
+                            <bean parent="X509RSAExponentValidator"/>
+
+                            <!--
+                                Debian weak key blacklists.
+
+                                Don't need to check for keys below our minimum key size.
+                            -->
+                            <ref bean="debian.2048"/>
+                            <ref bean="debian.4096"/>
+
+                            <!--
+                                Compromised key blacklists.
+
+                                Again, don't need to check for keys below our minimum key size.
+                            -->
+                            <ref bean="compromised.2048"/>
+                        </list>
+                    </property>
+                </bean>
+
+            </list>
+        </property>
+    </bean>
+
+</beans>