From 63c86df3f429a6c9c4541b2b855f9b1f206b8bc8 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Fri, 22 May 2015 09:08:45 +0000
Subject: [PATCH] Promote check for saml2int section 6.1.

Look for metadata for a SingleSignOnService with HTTP-Redirect binding
on a SAML 2 IdP.
---
 mdx/_rules/check_future_0.xsl | 17 -----------------
 mdx/_rules/check_saml2int.xsl | 17 +++++++++++++++++
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/mdx/_rules/check_future_0.xsl b/mdx/_rules/check_future_0.xsl
index f43d4697..fe932075 100644
--- a/mdx/_rules/check_future_0.xsl
+++ b/mdx/_rules/check_future_0.xsl
@@ -30,21 +30,4 @@
 	-->
 	<xsl:import href="check_framework.xsl"/>
 
-    <!--
-        Section 6.1.
-        
-        "The <saml2p:AuthnRequest> message issued by a Service Provider MUST be
-        communicated to the Identity Provider using the HTTP-REDIRECT binding
-        [SAML2Bind]."
-        
-        Therefore, metadata for this binding MUST be present.
-    -->
-    <xsl:template match="md:IDPSSODescriptor
-        [contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
-        [not(md:SingleSignOnService[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'])]">
-        <xsl:call-template name="error">
-            <xsl:with-param name="m">SAML 2.0 IDPSSODescriptor does not support HTTP-Redirect SSO binding</xsl:with-param>
-        </xsl:call-template>
-    </xsl:template>
-
 </xsl:stylesheet>
diff --git a/mdx/_rules/check_saml2int.xsl b/mdx/_rules/check_saml2int.xsl
index 8e00e073..812fe87e 100644
--- a/mdx/_rules/check_saml2int.xsl
+++ b/mdx/_rules/check_saml2int.xsl
@@ -61,6 +61,23 @@
 		</xsl:call-template>
 	</xsl:template>
 	
+	<!--
+        Section 6.1.
+        
+        "The <saml2p:AuthnRequest> message issued by a Service Provider MUST be
+        communicated to the Identity Provider using the HTTP-REDIRECT binding
+        [SAML2Bind]."
+        
+        Therefore, metadata for this binding MUST be present.
+    -->
+	<xsl:template match="md:IDPSSODescriptor
+		[contains(@protocolSupportEnumeration, 'urn:oasis:names:tc:SAML:2.0:protocol')]
+		[not(md:SingleSignOnService[@Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect'])]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">SAML 2.0 IDPSSODescriptor does not support HTTP-Redirect SSO binding</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+
 	<!--
 		Section 7.