From a2f8fc7185fc81298f5e7343b844c703bb2459f1 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Wed, 6 Sep 2017 17:20:08 +0100
Subject: [PATCH] Implement check_sp_tls

See incommon/inc-meta#85.
---
 mdx/incommon/edugain-policy.xml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/mdx/incommon/edugain-policy.xml b/mdx/incommon/edugain-policy.xml
index c89fa1bf..07397f29 100644
--- a/mdx/incommon/edugain-policy.xml
+++ b/mdx/incommon/edugain-policy.xml
@@ -375,6 +375,14 @@
                 <!-- Sub-rule t. -->
                 <ref bean="check_saml2meta"/>
 
+                <!--
+                    Sub-rule u.
+
+                    Mark SP entities with an endpoint location that
+                    is not HTTPS-protected.
+                -->
+                <ref bean="check_sp_tls"/>
+
                 <!--
                     *************************************
                     ***                               ***
@@ -408,7 +416,6 @@
                             <ref bean="check_saml2int"/>
                             <ref bean="check_saml_strings"/>
                             <ref bean="check_shibboleth"/>
-                            <ref bean="check_sp_tls"/>
                             <ref bean="check_uk_algorithms"/>
                             <ref bean="check_uk_trust"/>
                             <ref bean="check_uk_wayf"/>