From f39c4a0a1d9fce6ebba5dcac82a11c053af625cc Mon Sep 17 00:00:00 2001
From: Ian Young <ian@iay.org.uk>
Date: Tue, 8 Nov 2016 17:54:30 +0000
Subject: [PATCH] Checking ruleset for SIRTFI specification

Implements #40.
Note: ruleset is not yet active.
---
 mdx/_rules/check_sirtfi.xsl | 73 +++++++++++++++++++++++++++++++++++++
 mdx/validation-beans.xml    | 15 ++++++++
 2 files changed, 88 insertions(+)
 create mode 100644 mdx/_rules/check_sirtfi.xsl

diff --git a/mdx/_rules/check_sirtfi.xsl b/mdx/_rules/check_sirtfi.xsl
new file mode 100644
index 00000000..78240c01
--- /dev/null
+++ b/mdx/_rules/check_sirtfi.xsl
@@ -0,0 +1,73 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+	check_sirtfi.xsl
+
+	Checking ruleset containing rules associated with the SIRTFI specification,
+	as described here:
+
+		https://refeds.org/wp-content/uploads/2016/11/Sirtfi-certification-v1.0.pdf
+
+	Author: Ian A. Young <ian@iay.org.uk>
+
+-->
+<xsl:stylesheet version="1.0"
+	xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
+	xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
+	xmlns:remd="http://refeds.org/metadata"
+	xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+	
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
+	xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
+	
+	<!--
+		Common support functions.
+	-->
+	<xsl:import href="check_framework.xsl"/>
+
+	<!--
+		Process only entities claiming SIRTFI compliance.
+	-->
+	<xsl:template match="md:EntityDescriptor[
+			md:Extensions/mdattr:EntityAttributes/saml:Attribute[@NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:uri']
+				[@Name='urn:oasis:names:tc:SAML:attribute:assurance-certification']
+			/saml:AttributeValue[.='https://refeds.org/sirtfi']
+		]">
+
+		<!--
+			Collect the REFEDS security contacts for this entity.
+		-->
+		<xsl:variable name="securityContacts"
+			select="md:ContactPerson
+			[@contactType='other']
+			[@remd:contactType='http://refeds.org/metadata/contactType/security']"/>
+
+		<!--
+			There must be at least one REFEDS security contact.
+		-->
+		<xsl:if test="count($securityContacts) = 0">
+			<xsl:call-template name="error">
+				<xsl:with-param name="m">SIRTFI requires a REFEDS security contact</xsl:with-param>
+			</xsl:call-template>
+		</xsl:if>
+
+		<!--
+			REFEDS security contacts used in SIRTFI compliant entities need to have
+			GivenName and EmailAddress attributes.
+		-->
+		<xsl:for-each select="$securityContacts">
+			<xsl:if test="not(md:GivenName)">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">SIRTFI requires a REFEDS security contact with a GivenName</xsl:with-param>
+				</xsl:call-template>
+			</xsl:if>
+			<xsl:if test="not(md:EmailAddress)">
+				<xsl:call-template name="error">
+					<xsl:with-param name="m">SIRTFI requires a REFEDS security contact with an EmailAddress</xsl:with-param>
+				</xsl:call-template>
+			</xsl:if>
+		</xsl:for-each>
+	</xsl:template>
+
+</xsl:stylesheet>
diff --git a/mdx/validation-beans.xml b/mdx/validation-beans.xml
index eb0b2633..1b1f4ea0 100644
--- a/mdx/validation-beans.xml
+++ b/mdx/validation-beans.xml
@@ -311,6 +311,21 @@
         p:XSLResource="classpath:_rules/check_shibboleth.xsl"/>
 
 
+    <!--
+        ***************************************************
+        ***                                             ***
+        ***   S I R T F I   S P E C I F I C A T I O N   ***
+        ***                                             ***
+        ***************************************************
+    -->
+
+    <!--
+        check_sirtfi
+    -->
+    <bean id="check_sirtfi" parent="XSLValidationStage"
+        p:XSLResource="classpath:_rules/check_sirtfi.xsl"/>
+
+
     <!--
         *******************************************************************
         ***                                                             ***