From 9d28a99b2d219fe40eb73bb19f4a504454cc63eb Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 29 Apr 2014 14:54:07 +0000
Subject: [PATCH] Add very basic but generic ruleset for mdattr (entity
 attributes) specification.

---
 mdx/_rules/check_mdattr.xsl | 70 +++++++++++++++++++++++++++++++++++++
 mdx/validation-beans.xml    | 21 +++++++++++
 2 files changed, 91 insertions(+)
 create mode 100644 mdx/_rules/check_mdattr.xsl

diff --git a/mdx/_rules/check_mdattr.xsl b/mdx/_rules/check_mdattr.xsl
new file mode 100644
index 00000000..f5782d52
--- /dev/null
+++ b/mdx/_rules/check_mdattr.xsl
@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_mdattr.xsl
+	
+	Checking ruleset containing rules associated with the SAML V2.0 Metadata
+	Extension for Entity Attributes Version 1.0, see:
+
+		https://wiki.oasis-open.org/security/SAML2MetadataAttr
+		
+	This ruleset reflects Committee Specification 01, 04-Aug-2009.
+	
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="check_framework.xsl"/>
+	
+	<!--
+		Section 2.3
+
+		The specification only defines the meaning of EntityAttributes within the Extensions of either
+		EntitiesDescriptor or EntityDescriptor. 
+	-->
+	<xsl:template match="mdattr:EntityAttributes[not(parent::md:Extensions)]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">EntityAttributes must only appear within an Extensions element</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	<xsl:template match="md:Extensions[mdattr:EntityAttributes]
+		[not(parent::md:EntityDescriptor)][not(parent::md:EntitiesDescriptor)]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">EntityAttributes must only appear within Extensions of EntityDescriptor or EntitiesDescriptor</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+	<!--
+		Section 2.3 line 176.
+		
+		Assertions not permitted in the context of an EntitiesDescriptor.
+	-->
+	<xsl:template match="md:EntitiesDescriptor/md:Extensions/mdattr:EntityAttributes/saml:Assertion">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">Assertion may not appear in the EntityAttributes for an EntitiesDescriptor</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+
+	<!--
+		Section 2.3 line 182.
+		
+		EntityAttributes MUST NOT appear more than once within a given <md:Extensions> element.
+	-->
+	<xsl:template match="md:Extensions/mdattr:EntityAttributes[position()>1]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">more than one EntityAttributes element in an Extensions element</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+</xsl:stylesheet>
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 540b66eb..c5f5a995 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -303,6 +303,26 @@
         </property>
     </bean>
     
+    <!--
+        ***************************************************
+        ***                                             ***
+        ***   M D A T T R   S P E C I F I C A T I O N   ***
+        ***                                             ***
+        ***************************************************
+    -->
+
+    <!--
+        check_mdattr
+    -->
+    <bean id="check_mdattr" parent="XSLValidationStage"
+        p:id="check_mdattr">
+        <property name="XSLResource">
+            <bean parent="FileSystemResource">
+                <constructor-arg value="#{ systemProperties['rulesdir'] }/check_mdattr.xsl"/>
+            </bean>
+        </property>
+    </bean>
+    
     <!--
         *************************************************
         ***                                           ***
@@ -760,6 +780,7 @@
                 <ref bean="check_idpdisc"/>
                 <ref bean="check_incmd"/>
                 <ref bean="check_init"/>
+                <ref bean="check_mdattr"/>
                 <ref bean="check_mdiop"/>
                 <ref bean="check_mdrpi"/>
                 <ref bean="check_mdui"/>