From f226b8a0d808d19928db4e6d5dab21ddc7853aeb Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 23 May 2016 10:04:44 +0000
Subject: [PATCH 1/4] Inline CHECK_imported composite stage, which is only
 referenced once.

---
 mdx/common-beans.xml     |  5 ++++-
 mdx/validation-beans.xml | 14 --------------
 2 files changed, 4 insertions(+), 15 deletions(-)

diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index ebff731f..0a8b7dba 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -1171,7 +1171,10 @@
                 <ref bean="trimImportElementWhitespace"/>
                 <ref bean="stripEmptyExtensions"/>
                 <ref bean="checkSchemas"/>
-                <ref bean="CHECK_imported"/>
+                <ref bean="CHECK_std"/>
+                <ref bean="check_dup_display"/>
+                <ref bean="check_regscope"/>
+                <ref bean="check_namespaces"/>
 
                 <bean id="checkCertificates" parent="X509ValidationStage">
                     <property name="validators">
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 9be75207..cb1017ce 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -616,18 +616,4 @@
         </property>
     </bean>
     
-    <!--
-        CHECK_imported
-    -->
-    <bean id="CHECK_imported" parent="CompositeStage">
-        <property name="composedStages">
-            <list>
-                <ref bean="CHECK_std"/>
-                <ref bean="check_dup_display"/>
-                <ref bean="check_regscope"/>
-                <ref bean="check_namespaces"/>
-            </list>
-        </property>
-    </bean>
-    
 </beans>

From 1c2491ce329c913efe378d9c8cb7fcc7374846dc Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 23 May 2016 10:46:17 +0000
Subject: [PATCH 2/4] Reorganise validation beans.

Consolidate the "miscellaneous" validation beans.
Start a category for the Shibboleth specification.
---
 mdx/validation-beans.xml | 381 ++++++++++++++++++++-------------------
 1 file changed, 195 insertions(+), 186 deletions(-)

diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index cb1017ce..1d9a2d55 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -18,7 +18,9 @@
         ***   F U T U R E   T E S T S   ***
         ***                             ***
         ***********************************
-        
+    -->
+
+    <!--        
         The tests in this section are not applied to the UK federation metadata at the moment,
         but will be in the future.  Usually, the delay is due to the presence of the specific
         case in the current metadata, and the test will be moved into production once that
@@ -122,7 +124,6 @@
         ***                                                     ***
         ***********************************************************
     -->
-        
 
     <!--
         check_algsupport
@@ -131,63 +132,6 @@
         p:XSLResource="classpath:_rules/check_algsupport.xsl"/>
 
 
-    <!--
-        *********************
-        ***               ***
-        ***   ( E N D )   ***
-        ***               ***
-        *********************
-    -->
-    
-
-    <!--
-        check_adfs
-    -->
-    <bean id="check_adfs" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_adfs.xsl"/>
-    
-    <!--
-        check_bindings
-    -->
-    <bean id="check_bindings" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_bindings.xsl"/>
-    
-    <!--
-        check_filtered
-    -->
-    <bean id="check_filtered" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_filtered.xsl"/>
-    
-    <!--
-        check_hoksso
-    -->
-    <bean id="check_hoksso" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_hoksso.xsl"/>
-        
-    <!--
-        check_idpdisc
-    -->
-    <bean id="check_idpdisc" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_idpdisc.xsl"/>
-    
-    <!--
-        check_imported
-    -->
-    <bean id="check_imported" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_imported.xsl"/>
-    
-    <!--
-        check_init
-    -->
-    <bean id="check_init" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_init.xsl"/>
-    
-    <!--
-        check_mdiop
-    -->
-    <bean id="check_mdiop" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_mdiop.xsl"/>
-    
     <!--
         ***************************************************
         ***                                             ***
@@ -201,6 +145,7 @@
     -->
     <bean id="check_mdattr" parent="XSLValidationStage"
         p:XSLResource="classpath:_rules/check_mdattr.xsl"/>
+
     
     <!--
         *************************************************
@@ -249,6 +194,7 @@
     -->
     <bean id="check_hasreginfo" parent="XSLValidationStage"
         p:XSLResource="classpath:_rules/check_hasreginfo.xsl"/>
+
     
     <!--
         ***********************************************
@@ -314,15 +260,200 @@
             </list>
         </property>
     </bean>
+
+
+    <!--
+        *******************************************************************
+        ***                                                             ***
+        ***   I N C O M M O N   F E D E R A T I O N   M E T A D A T A   ***
+        ***                                                             ***
+        *******************************************************************
+    -->
+
+    <!--
+        check_incmd
+    -->
+    <bean id="check_incmd" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_incmd.xsl"/>
+
+    
+    <!--
+        ***********************************************************
+        ***                                                     ***
+        ***   S H I B B O L E T H   S P E C I F I C A T I O N   ***
+        ***                                                     ***
+        ***********************************************************
+    -->
+
+    <!--
+        check_regscope
+        
+        Check for regular expressions in Shibboleth Scope elements.  Applied very selectively.
+    -->
+    <bean id="check_regscope" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_regscope.xsl"/>
+
+
+    <!--
+        *******************************************************************
+        ***                                                             ***
+        ***   U K   F E D E R A T I O N   S P E C I F I C A T I O N S   ***
+        ***                                                             ***
+        *******************************************************************
+    -->
+    
+    <!--
+        check_uk_algorithms
+    -->
+    <bean id="check_uk_algorithms" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_uk_algorithms.xsl"/>
+    
+    <!--
+        check_uk_trust
+    -->
+    <bean id="check_uk_trust" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_uk_trust.xsl"/>
+    
+    <!--
+        check_uk_wayf
+    -->
+    <bean id="check_uk_wayf" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_uk_wayf.xsl"/>
+
+
+    <!--
+        *******************************************************
+        ***                                                 ***
+        ***   C O L L E C T I O N   C O N S I S T E N C Y   ***
+        ***                                                 ***
+        *******************************************************
+    -->
+    
+    <!--
+        These checks are for consistency across a collection of entities
+        rather than on each entity independently.
+    -->
+
+    <!--
+        check_aggregate
+        
+        Checks for duplicate entityID values across a set of entities.
+        
+        It is assumed that the entities are wrapped in a single EntitiesDescriptor.
+    -->
+    <bean id="check_aggregate" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_aggregate.xsl"/>
+    
+    <!--
+        check_dup_display
+        
+        Checks for duplicate identity provider display names across a set of entities.
+        
+        It is assumed that the entities are independently represented as EntityDescriptor
+        items in the item collection.
+    -->
+    <bean id="check_dup_display" parent="stage_parent"
+        p:identificationStrategy-ref="identificationStrategy"
+        class="uk.org.ukfederation.mda.IdPDisplayNameDuplicateDetectingStage"/>
+
+
+    <!--
+        ***********************************************
+        ***                                         ***
+        ***   X . 5 0 9   C E R T I F I C A T E S   ***
+        ***                                         ***
+        ***********************************************
+    -->
+    
+    <!--
+        Debian weak key blacklists.
+    -->
+
+    <bean id="debian.1024" parent="X509RSAOpenSSLBlacklistValidator"
+        p:keySize="1024"
+        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/debian-1024.txt"/>
+
+    <bean id="debian.2048" parent="X509RSAOpenSSLBlacklistValidator"
+        p:keySize="2048"
+        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/debian-2048.txt"/>
+
+    <bean id="debian.4096" parent="X509RSAOpenSSLBlacklistValidator"
+        p:keySize="4096"
+        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/debian-4096.txt"/>
+
+    <!--
+        Blacklist of known compromised 1024-bit keys, e.g., "dummy" keys shipped with
+        SAML products that are sometimes deployed by accident.
+    -->
+    <bean id="compromised.1024" parent="X509RSAOpenSSLBlacklistValidator"
+        p:keySize="1024"
+        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/compromised-1024.txt"/>
+
+    <!--
+        Blacklist of known compromised 2048-bit keys, e.g., "dummy" keys shipped with
+        SAML products that are sometimes deployed by accident.
+    -->
+    <bean id="compromised.2048" parent="X509RSAOpenSSLBlacklistValidator"
+        p:keySize="2048"
+        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/compromised-2048.txt"/>
+
+
+    <!--
+        ***************************************************
+        ***                                             ***
+        ***   M I S C E L L A N E O U S   C H E C K S   ***
+        ***                                             ***
+        ***************************************************
+    -->
+
+    <!--
+        check_adfs
+    -->
+    <bean id="check_adfs" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_adfs.xsl"/>
+    
+    <!--
+        check_bindings
+    -->
+    <bean id="check_bindings" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_bindings.xsl"/>
+    
+    <!--
+        check_filtered
+    -->
+    <bean id="check_filtered" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_filtered.xsl"/>
+    
+    <!--
+        check_hoksso
+    -->
+    <bean id="check_hoksso" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_hoksso.xsl"/>
+        
+    <!--
+        check_idpdisc
+    -->
+    <bean id="check_idpdisc" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_idpdisc.xsl"/>
+    
+    <!--
+        check_imported
+    -->
+    <bean id="check_imported" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_imported.xsl"/>
     
     <!--
-        *********************
-        ***               ***
-        ***   ( E N D )   ***
-        ***               ***
-        *********************
+        check_init
     -->
+    <bean id="check_init" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_init.xsl"/>
     
+    <!--
+        check_mdiop
+    -->
+    <bean id="check_mdiop" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_mdiop.xsl"/>
+
     <!--
         check_cr
         
@@ -361,14 +492,6 @@
     <bean id="check_namespaces" parent="XSLValidationStage"
         p:XSLResource="classpath:_rules/check_namespaces.xsl"/>
     
-    <!--
-        check_regscope
-        
-        Check for regular expressions in Shibboleth Scope elements.  Applied very selectively.
-    -->
-    <bean id="check_regscope" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_regscope.xsl"/>
-    
     <!--
         check_reqattr
     -->
@@ -456,121 +579,7 @@
     -->
     <bean id="check_vhosts" parent="XSLValidationStage"
         p:XSLResource="classpath:_rules/check_vhosts.xsl"/>
-    
-    <!--
-        *******************************************************************
-        ***                                                             ***
-        ***   I N C O M M O N   F E D E R A T I O N   M E T A D A T A   ***
-        ***                                                             ***
-        *******************************************************************
-    -->
-    
-    <!--
-        check_incmd
-    -->
-    <bean id="check_incmd" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_incmd.xsl"/>
-    
-    <!--
-        *******************************************************************
-        ***                                                             ***
-        ***   U K   F E D E R A T I O N   S P E C I F I C A T I O N S   ***
-        ***                                                             ***
-        *******************************************************************
-    -->
-    
-    <!--
-        check_uk_algorithms
-    -->
-    <bean id="check_uk_algorithms" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_uk_algorithms.xsl"/>
-    
-    <!--
-        check_uk_trust
-    -->
-    <bean id="check_uk_trust" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_uk_trust.xsl"/>
-    
-    <!--
-        check_uk_wayf
-    -->
-    <bean id="check_uk_wayf" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_uk_wayf.xsl"/>
-
-    <!--
-        *******************************************************
-        ***                                                 ***
-        ***   C O L L E C T I O N   C O N S I S T E N C Y   ***
-        ***                                                 ***
-        *******************************************************
-    -->
-    
-    <!--
-        These checks are for consistency across a collection of entities
-        rather than on each entity independently.
-    -->
-    
-    <!--
-        check_aggregate
-        
-        Checks for duplicate entityID values across a set of entities.
-        
-        It is assumed that the entities are wrapped in a single EntitiesDescriptor.
-    -->
-    <bean id="check_aggregate" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_aggregate.xsl"/>
-    
-    <!--
-        check_dup_display
-        
-        Checks for duplicate identity provider display names across a set of entities.
-        
-        It is assumed that the entities are independently represented as EntityDescriptor
-        items in the item collection.
-    -->
-    <bean id="check_dup_display" parent="stage_parent"
-        p:identificationStrategy-ref="identificationStrategy"
-        class="uk.org.ukfederation.mda.IdPDisplayNameDuplicateDetectingStage"/>
-    
-    <!--
-        ***********************************************
-        ***                                         ***
-        ***   X . 5 0 9   C E R T I F I C A T E S   ***
-        ***                                         ***
-        ***********************************************
-    -->
-    
-    <!--
-        Debian weak key blacklists.
-    -->
-
-    <bean id="debian.1024" parent="X509RSAOpenSSLBlacklistValidator"
-        p:keySize="1024"
-        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/debian-1024.txt"/>
 
-    <bean id="debian.2048" parent="X509RSAOpenSSLBlacklistValidator"
-        p:keySize="2048"
-        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/debian-2048.txt"/>
-
-    <bean id="debian.4096" parent="X509RSAOpenSSLBlacklistValidator"
-        p:keySize="4096"
-        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/debian-4096.txt"/>
-
-    <!--
-        Blacklist of known compromised 1024-bit keys, e.g., "dummy" keys shipped with
-        SAML products that are sometimes deployed by accident.
-    -->
-    <bean id="compromised.1024" parent="X509RSAOpenSSLBlacklistValidator"
-        p:keySize="1024"
-        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/compromised-1024.txt"/>
-
-    <!--
-        Blacklist of known compromised 2048-bit keys, e.g., "dummy" keys shipped with
-        SAML products that are sometimes deployed by accident.
-    -->
-    <bean id="compromised.2048" parent="X509RSAOpenSSLBlacklistValidator"
-        p:keySize="2048"
-        p:blacklistResource="classpath:net/shibboleth/metadata/validate/x509/compromised-2048.txt"/>
 
     <!--
         *********************************************

From 6011b24382163571012c3379e33a36f44b441169 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 23 May 2016 11:01:57 +0000
Subject: [PATCH 3/4] Rename check_regscope to check_shib_regscope.

---
 .../{check_regscope.xsl => check_shib_regscope.xsl}      | 2 +-
 mdx/common-beans.xml                                     | 2 +-
 mdx/validation-beans.xml                                 | 9 +++++----
 3 files changed, 7 insertions(+), 6 deletions(-)
 rename mdx/_rules/{check_regscope.xsl => check_shib_regscope.xsl} (97%)

diff --git a/mdx/_rules/check_regscope.xsl b/mdx/_rules/check_shib_regscope.xsl
similarity index 97%
rename from mdx/_rules/check_regscope.xsl
rename to mdx/_rules/check_shib_regscope.xsl
index fcae4300..b20fa7d3 100644
--- a/mdx/_rules/check_regscope.xsl
+++ b/mdx/_rules/check_shib_regscope.xsl
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
 
-	check_regscope.xsl
+	check_shib_regscope.xsl
 
 	Check for the presence of Shibboleth Scope elements containing regular expressions.
 	
diff --git a/mdx/common-beans.xml b/mdx/common-beans.xml
index 0a8b7dba..ed66d538 100644
--- a/mdx/common-beans.xml
+++ b/mdx/common-beans.xml
@@ -1173,7 +1173,7 @@
                 <ref bean="checkSchemas"/>
                 <ref bean="CHECK_std"/>
                 <ref bean="check_dup_display"/>
-                <ref bean="check_regscope"/>
+                <ref bean="check_shib_regscope"/>
                 <ref bean="check_namespaces"/>
 
                 <bean id="checkCertificates" parent="X509ValidationStage">
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 1d9a2d55..5736b9d5 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -286,12 +286,13 @@
     -->
 
     <!--
-        check_regscope
+        check_shib_regscope
         
-        Check for regular expressions in Shibboleth Scope elements.  Applied very selectively.
+        Check for regular expressions in Shibboleth Scope elements.  Applied very selectively,
+        because we do permit this in certain circumstances.
     -->
-    <bean id="check_regscope" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_regscope.xsl"/>
+    <bean id="check_shib_regscope" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_shib_regscope.xsl"/>
 
 
     <!--

From 24d59deb84fbe491f11134051ccded94250ea409 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Mon, 23 May 2016 13:27:52 +0000
Subject: [PATCH 4/4] Split out the check for Scope elements entirely lacking
 regexp attributes.

---
 mdx/_rules/check_shib_noregscope.xsl | 29 ++++++++++++++++++++++++++++
 mdx/_rules/check_shibboleth.xsl      | 12 ------------
 mdx/uk/verbs.xml                     |  1 +
 mdx/validation-beans.xml             | 23 ++++++++++++++++------
 4 files changed, 47 insertions(+), 18 deletions(-)
 create mode 100644 mdx/_rules/check_shib_noregscope.xsl

diff --git a/mdx/_rules/check_shib_noregscope.xsl b/mdx/_rules/check_shib_noregscope.xsl
new file mode 100644
index 00000000..0f1e0b79
--- /dev/null
+++ b/mdx/_rules/check_shib_noregscope.xsl
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_shib_noregscope.xsl
+
+    Check for Shibboleth Scope elements lacking a regexp attribute, which can cause
+    problems with signature generation and validation because the schema includes
+    a default value.
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:shibmd="urn:mace:shibboleth:metadata:1.0"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="check_framework.xsl"/>
+
+	<xsl:template match="shibmd:Scope[not(@regexp)]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">Scope <xsl:value-of select="."/> lacks @regexp</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+</xsl:stylesheet>
diff --git a/mdx/_rules/check_shibboleth.xsl b/mdx/_rules/check_shibboleth.xsl
index dadb1b9a..79aa6799 100644
--- a/mdx/_rules/check_shibboleth.xsl
+++ b/mdx/_rules/check_shibboleth.xsl
@@ -148,18 +148,6 @@
 			<xsl:with-param name="m">SIDPO-34: Attribute lacking NameFormat in IDPSSODescriptor</xsl:with-param>
 		</xsl:call-template>
 	</xsl:template>
-	
-	
-	<!--
-		Check for Shibboleth Scope elements that don't include a regexp attribute.
-		This has a default in the schema so omitting it can cause signing brittleness.
-	-->
-	<xsl:template match="shibmd:Scope[not(@regexp)]">
-		<xsl:call-template name="error">
-			<xsl:with-param name="m">Scope <xsl:value-of select="."/> lacks @regexp</xsl:with-param>
-		</xsl:call-template>
-	</xsl:template>
-
 
 	<!--
 		Scope elements should not contain space characters.
diff --git a/mdx/uk/verbs.xml b/mdx/uk/verbs.xml
index 5188f4e9..06b2aca4 100644
--- a/mdx/uk/verbs.xml
+++ b/mdx/uk/verbs.xml
@@ -268,6 +268,7 @@
                 <ref bean="check_saml2"/>
                 <ref bean="check_saml2int"/>
                 <!-- <ref bean="check_saml2meta"/> -->
+                <ref bean="check_shib_noregscope"/>
                 <ref bean="check_shibboleth"/>
                 <ref bean="check_sp_tls"/>
                 <ref bean="check_uk_trust"/>
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index 5736b9d5..eb0b2633 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -294,6 +294,22 @@
     <bean id="check_shib_regscope" parent="XSLValidationStage"
         p:XSLResource="classpath:_rules/check_shib_regscope.xsl"/>
 
+    <!--
+        check_shib_noregscope
+        
+        Check for Shibboleth Scope elements lacking a regexp attribute, which can cause
+        problems with signature generation and validation because the schema includes
+        a default value.
+    -->
+    <bean id="check_shib_noregscope" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_shib_noregscope.xsl"/>
+
+    <!--
+        check_shibboleth
+    -->
+    <bean id="check_shibboleth" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_shibboleth.xsl"/>
+
 
     <!--
         *******************************************************************
@@ -550,12 +566,6 @@
         </property>
     </bean>
 
-    <!--
-        check_shibboleth
-    -->
-    <bean id="check_shibboleth" parent="XSLValidationStage"
-        p:XSLResource="classpath:_rules/check_shibboleth.xsl"/>
-
     <!--
         check_validUntil
         
@@ -617,6 +627,7 @@
                 <ref bean="check_saml2int"/>
                 <ref bean="check_saml2meta"/>
                 <ref bean="check_saml_strings"/>
+                <ref bean="check_shib_noregscope"/>
                 <ref bean="check_shibboleth"/>
                 <ref bean="check_sp_tls"/>
                 <ref bean="check_uk_algorithms"/>