From 5e167da002b9d65090680c97c9a292ed05ea64fe Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 14 May 2015 15:44:24 +0000
Subject: [PATCH] Add proposed saml2int SSO binding rule as a future test.

---
 mdx/_rules/check_future_0.xsl | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/mdx/_rules/check_future_0.xsl b/mdx/_rules/check_future_0.xsl
index fe932075..f43d4697 100644
--- a/mdx/_rules/check_future_0.xsl
+++ b/mdx/_rules/check_future_0.xsl
@@ -30,4 +30,21 @@
 	-->
 	<xsl:import href="check_framework.xsl"/>
 
+    <!--
+        Section 6.1.
+        
+        "The <saml2p:AuthnRequest> message issued by a Service Provider MUST be
+        communicated to the Identity Provider using the HTTP-REDIRECT binding
+        [SAML2Bind]."
+        
+        Therefore, metadata for this binding MUST be present.
+    -->
+    <xsl:template match="md:IDPSSODescriptor
+        [contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+        [not(md:SingleSignOnService[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'])]">
+        <xsl:call-template name="error">
+            <xsl:with-param name="m">SAML 2.0 IDPSSODescriptor does not support HTTP-Redirect SSO binding</xsl:with-param>
+        </xsl:call-template>
+    </xsl:template>
+
 </xsl:stylesheet>