From e2b15da30b67bf97e7c8e5ff2a53b5870ce674f9 Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Thu, 7 Nov 2013 15:41:32 +0000
Subject: [PATCH] Per our group discussion on 2013-11-06, enforce a rule that
 entities opted in for export MUST NOT have KeyName elements. Although these
 were already being stripped during export, it is better to debug any
 resulting issues within the local federation.

---
 mdx/uk/beans.xml               | 14 ++++++++++++
 mdx/uk/check_uk_expkeyname.xsl | 41 ++++++++++++++++++++++++++++++++++
 2 files changed, 55 insertions(+)
 create mode 100644 mdx/uk/check_uk_expkeyname.xsl

diff --git a/mdx/uk/beans.xml b/mdx/uk/beans.xml
index c499dc0d..8fa1324d 100644
--- a/mdx/uk/beans.xml
+++ b/mdx/uk/beans.xml
@@ -253,6 +253,19 @@
     </bean>
     
     
+    <!--
+        check_uk_expkeyname
+    -->
+    <bean id="check_uk_expkeyname" parent="XSLValidationStage"
+        p:id="check_uk_expkeyname">
+        <property name="XSLResource">
+            <bean parent="FilesystemResource">
+                <constructor-arg value="#{ systemProperties['basedir'] }/mdx/uk/check_uk_expkeyname.xsl"/>
+            </bean>
+        </property>
+    </bean>
+    
+    
     <!--
         check_uk_mdrps
     -->
@@ -401,6 +414,7 @@
                 <ref bean="checkSchemas"/>
                 <ref bean="CHECK_std"/>
                 <ref bean="check_ukreg"/>
+                <ref bean="check_uk_expkeyname"/>
                 <ref bean="check_uk_mdrps"/>
                 <ref bean="check_uk_urlenc"/>
                 <ref bean="mdui_dn_en_present"/>
diff --git a/mdx/uk/check_uk_expkeyname.xsl b/mdx/uk/check_uk_expkeyname.xsl
new file mode 100644
index 00000000..ad9258d1
--- /dev/null
+++ b/mdx/uk/check_uk_expkeyname.xsl
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_uk_expkeyname.xsl
+	
+    UKf-specific check that no KeyName elements appear in entities opted
+    in for inter-federation metadata exchange.
+	
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:mdrpi="urn:oasis:names:tc:SAML:metadata:rpi"
+	xmlns:ukfedlabel="http://ukfederation.org.uk/2006/11/label"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="../_rules/check_framework.xsl"/>
+
+
+	<!--
+		If a UK-registered entity is opted in to the export aggregate, it MUST
+		NOT have any KeyName elements.
+	-->
+	<xsl:template match="md:EntityDescriptor
+		[descendant::mdrpi:RegistrationInfo[@registrationAuthority='http://ukfederation.org.uk']]
+		[md:Extensions/ukfedlabel:ExportOptIn]
+		[descendant::ds:KeyName]">
+		<xsl:call-template name="error">
+			<xsl:with-param name="m">
+				<xsl:text>exported entity must not have a KeyName</xsl:text>
+			</xsl:with-param>
+		</xsl:call-template>
+	</xsl:template>
+	
+</xsl:stylesheet>