1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
|
KEY := /opt/swamid-credentials/swamid-signer.key
CERT := /opt/swamid-credentials/swamid-signer.crt
PASS := $(shell test -f /opt/swamid-credentials/swamid-signer-pass.txt && cat /opt/swamid-credentials/swamid-signer-pass.txt)
DEST := /opt/published-metadata
SRCDIRS=swamid-2.0
DAYS:=15
DATE=$(shell perl scripts/expiration_date.pl $(DAYS))
NOW=$(shell perl scripts/now_date.pl)
RPI=false
CONTACTS=false
TOU=true
ORG=true
TRANSFORM=xslt/normalize.xsl
ID=$(shell perl scripts/unique_id.pl)
XSLTDEFS := --stringparam org $(ORG) --stringparam ID $(ID) --stringparam tou $(TOU) --stringparam rpi $(RPI) --stringparam defaultContact $(CONTACTS) --stringparam date $(DATE) --stringparam now $(NOW)
SIGNER := xmlsec1 --sign --privkey-pem $(KEY),$(CERT) --pwd $(PASS) --id-attr:ID urn:oasis:names:tc:SAML:2.0:metadata:EntitiesDescriptor
BASEURL := http://md.swamid.se/md
SIGN := xslt/sign.xsl
SITE := site/md.swamid.se
TOU := swamid-tou-en.txt swamid-tou-sv.txt
-include $(SWAMID_MK_CONFIG)
all: clean dependencies test sign clean web
MXML=$(shell echo *.mxml)
SWAMIDXML=$(patsubst swamid-2.0/%.xml,.time/%.time,$(wildcard swamid-2.0/*.xml))
TIMEFILES=$(patsubst %.time,.xml/swamid-2.0/%.time,$(wildcard .time/*.time))
sign: swamid upstream
%.sig: %.mxml
xsltproc $(XSLTDEFS) --stringparam target "$(BASEURL)/$*.xml" --xinclude $(TRANSFORM) $< > $*.n
xsltproc $(XSLTDEFS) --xinclude $(SIGN) $*.n > $*.tbs
$(SIGNER) --output $@ $*.tbs
xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $@
rm -f $*.tbs $*.n
%.pub: %.sig
mkdir -p $(DEST) && xmllint --nowarning --noout --path schema --schema schema.xsd $< && mv $< $(DEST)/$*.xml
dependencies: swamid-externals-sp-2.0.xml swamid-interfederations-idp-2.0.xml swamid-interfederations-sp-2.0.xml
# kalmar obsolete
#upstream: edugain kalmar
upstream: edugain
kalmar:
env SWAMID_MK_CONFIG=$(SWAMID_MK_CONFIG) $(MAKE) RPI=false CONTACTS=false swamid-kalmar-1.0.pub swamid-kalmar-testing-1.0.pub
edugain:
env SWAMID_MK_CONFIG=$(SWAMID_MK_CONFIG) $(MAKE) RPI=true CONTACTS=true swamid-edugain-testing-1.0.pub swamid-edugain-1.0.pub
aggregate: swamid-externals swamid-interfederations
swamid-externals: swamid-externals1 swamid-externals2
swamid-externals1:
scripts/aggregate.sh swamid-externals-1.0
swamid-externals2:
scripts/aggregate.sh swamid-externals-2.0
# kalmar obsolete
#swamid-interfederations: swamid-interfederations1 swamid-interfederations2
swamid-interfederations: swamid-interfederations2
swamid-interfederations1:
scripts/aggregate.sh swamid-interfederations-1.0
swamid-interfederations2:
scripts/aggregate.sh swamid-interfederations-2.0
swamid: swamid-2.0.pub swamid-no-interfederation-combined.pub swamid-discovery.pub swamid-idp.pub swamid-idp-transitive.pub swamid-sp-transitive.pub swamid-registered.pub swamid-testing-1.0.pub swamid-testing-idp-1.0.pub
web: $(SITE) $(TOU)
rsync -avz $(TOU) $(SITE)/ $(DEST)
swamid-interfederations-idp-2.0.xml: swamid-interfederations-2.0.mxml
@xsltproc --xinclude xslt/extract-idp.xslt swamid-interfederations-2.0.mxml > swamid-interfederations-idp-2.0.xml
# Empty PrivacyStatementURL 2020-12-09
#sed -i '/sso.irc.ugent.be-auth-realms-irc/d' swamid-interfederations-idp-2.0.xml
swamid-interfederations-sp-2.0.xml: swamid-interfederations-2.0.mxml
@xsltproc --xinclude xslt/extract-sp.xslt swamid-interfederations-2.0.mxml > swamid-interfederations-sp-2.0.xml
swamid-externals-sp-2.0.xml: swamid-externals-2.0.mxml
@xsltproc --xinclude xslt/extract-non-idp.xslt swamid-externals-2.0.mxml > swamid-externals-sp-2.0.xml
syntaxtest: clean dependencies schematest
pedantic: clean dependencies schematest testRefedsRnS testGeantCoCo testEduGAINchecks
schematest:
@fail=false ; for x in $(MXML); do test=`xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $$x 2>&1`; rc=$$?; echo $$test | sed 's/fails to validate/[1;31m&[0m/;s/validates/[1;32m&[0m/'; if [ $$rc -gt 0 ]; then fail=true ; fi; done ; if $$fail ; then exit 1 ; fi
clean:
@rm -f *.xml *.tbs *.n *.sig
tidy:
@for x in `find $(SRCDIRS) -name \*.xml`; do xsltproc xslt/add-rpi.xsl $$x > $$x.c && mv $$x.c $$x; done
@for x in `find $(SRCDIRS) -name \*.xml`; do xsltproc xslt/clean-entitydescriptor.xsl $$x > $$x.c && mv $$x.c $$x; done
testMetadataUsage:
@echo "Checking for files in swamid-2.0 that isn't used"
@for file in swamid-2.0/* ; do if ! grep -q $$file *.mxml; then echo " $$file is not referenced in any mxml file"; fi; done | sed 's/.*/[1;31m&[0m/'
testRefedsRnS:
@echo "Checking for refeds R&S compatibillity for entities exported to eduGAIN"
@for x in `cat swamid-edugain-*.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}' | xargs grep -l SPSSODescriptor` ; do \
got_refeds_RnS=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Extensions/EntityAttributes/Attribute[@Name='http://macedir.org/entity-category']/AttributeValue" - 2>/dev/null | grep 'http://refeds.org/category/research-and-scholarship'` ; \
if [ -n "$$got_refeds_RnS" ] ; then \
http_post=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/AssertionConsumerService" - 2>/dev/null | grep 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST'` ; \
if [ -z "$$http_post" ] ; then echo " $$x: Missing HTTP-POST binding." | sed 's/.*/[1;31m&[0m/' ; fi ; \
mdui_DisplayName=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/DisplayName" - 2>/dev/null | grep 'DisplayName'` ; \
if [ -z "$$mdui_DisplayName" ] ; then echo " $$x: Missing mdui:DisplayName." | sed 's/.*/[1;31m&[0m/' ; fi ; \
mdui_InformationURL=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/InformationURL" - 2>/dev/null | grep 'InformationURL'` ; \
if [ -z "$$mdui_InformationURL" ] ; then echo " $$x: Missing mdui:InformationURL." | sed 's/.*/[1;31m&[0m/' ; fi ; \
tech_contact=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/ContactPerson[@contactType='technical']" - 2>/dev/null | grep 'EmailAddress'` ; \
if [ -z "$$tech_contact" ] ; then echo " $$x: Missing ContactPerson contactType='technical'." | sed 's/.*/[1;31m&[0m/' ; fi ; \
fi ; \
done
testGeantCoCo:
@echo "Checking for Geant CoCo compliance"
@touch sp-with-coco-errors
@for x in `cat swamid-edugain-sp-1.0.mxml swamid-edugain-testing-1.0.mxml swamid-sp-2.0.mxml swamid-testing-sp-1.0.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}' | xargs grep -l SPSSODescriptor | sort -u` ; do \
got_geant_CoCo=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Extensions/EntityAttributes/Attribute[@Name='http://macedir.org/entity-category']/AttributeValue" - 2>/dev/null | grep 'http://www.geant.net/uri/dataprotection-code-of-conduct/v1'` ; \
if [ -n "$$got_geant_CoCo" ] ; then \
( \
mdui_check=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo" - 2>/dev/null` ; \
if [ -z "$$mdui_check" ] ; then \
echo " Missing MDUI"'' ; \
else \
mdui_DisplayName=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/DisplayName" - 2>/dev/null | grep 'DisplayName'` ; \
if [ -z "$$mdui_DisplayName" ] ; then echo " Missing mdui:DisplayName"'' ; fi ; \
mdui_Descr=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/DisplayName" - 2>/dev/null | grep 'DisplayName'` ; \
if [ -z "$$mdui_Descr" ] ; then echo " Missing mdui:Description"'' ; fi ; \
for y in `cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo" - | grep -v "UIInfo" | awk '{print $$1}' | cut -c2- | sort -u` ; do \
mdui_Test=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/$$y" - 2>/dev/null | grep $$y | grep 'xml:lang="en"'` ; \
if [ -z "$$mdui_Test" ] ; then echo " Missing xml:lang=\"en\" on mdui:$$y"'' ; fi ; \
done ; \
mdui_PrivacyStatementURL=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/Extensions/UIInfo/PrivacyStatementURL" - 2>/dev/null | grep 'PrivacyStatementURL' | sed 's/&/\&/g'` ; \
if [ -z "$$mdui_PrivacyStatementURL" ] ; then \
echo " Missing PrivacyStatementURL"'' ; \
else \
if ! echo "$$mdui_PrivacyStatementURL" | grep -q 'xml:lang="en"' ; then \
echo " Missing PrivacyStatementURL in english"'' ; \
fi ; \
echo "$$mdui_PrivacyStatementURL" | sed 's/></>\n</g' | sed 's/.*\ \(xml:lang=.*\)>\(.*\)<.*/\1 \2/' | while read lang url ; do \
if grep -qx "$$x" sp-with-coco-errors ; then \
echo " Known bad link to CoCo in PrivacyStatementURL: $$x" 1>&2 ; \
else \
if ! grep -q "$$url $$lang $$mdui_PrivacyStatementURL" sp-with-once-ok-coco-link ; then \
curl -A 'Mozilla' -s -L -m 5 "$$url" < /dev/null | grep "https*://www.geant.net/uri/dataprotection-code-of-conduct/v1" > /dev/null && echo "$$url $$lang $$mdui_PrivacyStatementURL" >> sp-with-once-ok-coco-link || echo " Missing link to geant.net/code-of-conduct/v1 in PrivacyStatementURL $$lang ($$url)" ; \
fi ; \
fi ; \
done ; \
fi ; \
fi ; \
requestedAttribute=`cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/SPSSODescriptor/AttributeConsumingService/RequestedAttribute" - 2>/dev/null | grep 'RequestedAttribute'` ; \
if [ -z "$$requestedAttribute" ] ; then echo " Missing RequestedAttribute"'' ; fi ; \
) | sed "1s;..*; [1\;31m$$x[0m\n&;" | grep . && echo " " ; \
fi ; \
done | grep . && tty -s && exit 1 || exit 0
testEduGAINchecks:
@echo "Checking for attributes not allowed in entities exported to eduGAIN"
@for x in `cat swamid-edugain-*.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}' | xargs grep -l SPSSODescriptor` ; do \
if ( grep -q "AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" $$x ); then \
echo " $$x: AssertionConsumerService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\" not allowed"; \
fi ; \
done
@for x in `cat swamid-edugain-idp-1.0.mxml swamid-edugain-sp-1.0.mxml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}'` ; do \
sed 's;\(</*\)[a-z0-9]*:;\1;g' $$x | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Organization/OrganizationName' - 2>/dev/null | grep -vq "^$$" || echo " $$x missing OrganizationName" | sed 's/.*/[1;31m&[0m/' ; \
sed 's;\(</*\)[a-z0-9]*:;\1;g' $$x | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Organization/OrganizationDisplayName' - 2>/dev/null | grep -vq "^$$" || echo " $$x missing OrganizationDisplayName" | sed 's/.*/[1;31m&[0m/' ; \
sed 's;\(</*\)[a-z0-9]*:;\1;g' $$x | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Organization/OrganizationURL' - 2>/dev/null | grep -vq "^$$" || echo " $$x missing OrganizationURL" | sed 's/.*/[1;31m&[0m/' ; \
done
testMDUI:
@echo "Checking for bad lang codes"
@# Lang = ISO_639-1
@for x in swamid-2.0/*.xml ; do bad_langs=`cat $$x | sed -n 's/.*xml:lang="\([^"]*\)".*/\1/p' | sort -u | grep -vxE 'cs|da|de|en|fi|fr|it|sv|no|nn|nb|is'` ; if [ -n "$$bad_langs" ] ; then echo " $$x: `echo $$bad_langs`" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || exit 0
@echo "Checking for uniq IdP MDUI DisplayName"
@for lang in `cat swamid-2.0/*.xml | sed -n 's/.*xml:lang="\([^"]*\)".*/\1/p' | sort -u` ; do for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l IDPSSODescriptor` ; do cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/IDPSSODescriptor/Extensions/UIInfo/DisplayName[@xml:lang='$$lang']" - 2>/dev/null | sed 's/^[ ]*//;s/[ ]*$$//' | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g' | sed "s;^; $$x $$lang ;" | sed 's/.*/[1;31m&[0m/' ; done | sort -k 3 | uniq -d -f 2 ; done | grep . && exit 1 || true
@echo "Checking for invalid IPHint"
@for x in `find $(SRCDIRS) -name \*.xml`; do if cat $$x | sed -n 's;.*<[a-z0-9:]*IPHint>\(.*\)</[a-z0-9:]*IPHint>;\1;p' | grep -q -vE '^$$|^[0-9./a-fA-F:]*$$' ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done
@echo "Checking for invalid geodata (syntax is geo:xx.yy,zz.vv)"
@for x in `find $(SRCDIRS) -name \*.xml`; do if cat $$x | sed -n 's;.*<[a-z0-9:]*GeolocationHint>\(.*\)</[a-z0-9:]*GeolocationHint>;\1;p' | grep -q -vE '^$$|^geo:[0-9][0-9][0-9.]*,[0-9][0-9][0-9.]*$$' ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done
@echo "Check for IdP:s with Logos over http"
@for x in `find $(SRCDIRS) -name \*.xml`; do if cat $$x | sed -n '/IDPSSODescriptor/,/\/IDPSSODescriptor/p' | grep -q 'Logo .*http://' ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || exit 0
testIdPinSP:
@echo "Check that SP:s does not define IDPSSODescriptor"
@for spfile in `cat swamid-sp-2.0.mxml swamid-externals-sp-2.0.xml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}'` ; do grep -q IDPSSODescriptor $$spfile && echo " $$spfile" | sed 's/.*/[1;31m&[0m/' ; done | grep . && exit 1 || exit 0
testMDUIreach:
@echo "Check that MDUI URLs are reachable"
@cat swamid-idp-2.0.mxml swamid-sp-2.0.mxml swamid-externals-sp-2.0.xml | grep -v "\.mxml$$" | grep "xi:include" | awk -F\" '{print $$2}' | \
xargs -n1 -P 10 scripts/verify-uiinfo-urls.sh
testOrgData:
@echo "Checking for uniq IdP OrganizationDisplayName"
@for lang in `cat swamid-2.0/*.xml | sed -n 's/.*xml:lang="\(..\)".*/\1/p' | sort -u` ; do for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l IDPSSODescriptor` ; do cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Organization/OrganizationDisplayName[@xml:lang='$$lang']" - 2>/dev/null | sed 's/^[ ]*//;s/[ ]*$$//' | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g' | sed "s;^;$$x $$lang ;" | sed 's/.*/\ \ [1;31m&[0m/' ; done | sort -k 3 | uniq -d -f 2 ; done | grep . && exit 1 || true
testEntCat:
@echo "Checking for entity-categories in SPSSODescriptors that should be moved to EntityDescriptor/Extensions"
@for x in `find $(SRCDIRS) -name \*.xml`; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath /EntityDescriptor/SPSSODescriptor/Extensions/EntityAttributes - 2>/dev/null | grep -q entity-category ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for entity-categories in IDPSSODescriptor that should be moved to EntityDescriptor/Extensions"
@for x in `find $(SRCDIRS) -name \*.xml`; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath /EntityDescriptor/IDPSSODescriptor/Extensions/EntityAttributes - 2>/dev/null | grep -q entity-category ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for MDUI in EntityDescriptor/Extensions"
@for x in `find $(SRCDIRS) -name \*.xml`; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath /EntityDescriptor/Extensions/UIInfo - 2>/dev/null | grep -q . ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for entitycategories for IdPs that should be entity-category-support"
@for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l IDPSSODescriptor` ; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Extensions/EntityAttributes/Attribute[attribute::Name="http://macedir.org/entity-category"]/AttributeValue/text()' - 2>/dev/null | grep -q http://refeds.org/category/research-and-scholarship ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for wrong Name in EntityAttributes/Attribute"
@for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l "Attribute "` ; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Extensions/EntityAttributes/Attribute' - 2>/dev/null | grep "Attribute " | sed 's/.* Name="//' | sed -e 's/ NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"//' -e 's/">//' | egrep -v "http://macedir.org/entity-category|http://macedir.org/entity-category-support|urn:oasis:names:tc:SAML:attribute:assurance-certification|http://www.swamid.se/assurance-requirement" ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for wrong AttributeValue in EntityAttributes/Attribute http://macedir.org/entity-category"
@for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l "http://macedir.org/entity-category"` ; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Extensions/EntityAttributes/Attribute[attribute::Name="http://macedir.org/entity-category"]' - 2>/dev/null | grep "AttributeValue" | egrep -v ">http://refeds.org/category/research-and-scholarship<|>http://www.geant.net/uri/dataprotection-code-of-conduct/v1<|>http://www.swamid.se/category/research-and-education<|>http://www.swamid.se/category/hei-service<|>http://www.swamid.se/category/nren-service<|>http://www.swamid.se/category/sfs-1993-1153<|>http://www.swamid.se/category/eu-adequate-protection<|>http://refeds.org/category/hide-from-discovery<|>http://id.elegnamnden.se/st/1.0/sigservice<|>http://id.elegnamnden.se/ec/1.0/loa3-pnr<|>http://id.elegnamnden.se/ec/1.0/eidas-naturalperson<" ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for wrong AttributeValue in EntityAttributes/Attribute http://macedir.org/entity-category-support"
@for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l "http://macedir.org/entity-category-support"` ; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Extensions/EntityAttributes/Attribute[attribute::Name="http://macedir.org/entity-category-support"]' - 2>/dev/null | grep "AttributeValue" | egrep -v ">http://refeds.org/category/research-and-scholarship<|>http://www.geant.net/uri/dataprotection-code-of-conduct/v1<" ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for wrong AttributeValue in EntityAttributes/Attribute http://www.swamid.se/assurance-requirement"
@for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l "http://www.swamid.se/assurance-requirement"` ; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Extensions/EntityAttributes/Attribute[attribute::Name="http://www.swamid.se/assurance-requirement"]' - 2>/dev/null | grep "AttributeValue" | egrep -v ">http://www.swamid.se/policy/assurance/al1<|>http://www.swamid.se/policy/assurance/al2<" ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
@echo "Checking for wrong AttributeValue in EntityAttributes/Attribute urn:oasis:names:tc:SAML:attribute:assurance-certification"
@for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l "urn:oasis:names:tc:SAML:attribute:assurance-certification"` ; do if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath '/EntityDescriptor/Extensions/EntityAttributes/Attribute[attribute::Name="urn:oasis:names:tc:SAML:attribute:assurance-certification"]' - 2>/dev/null | grep "AttributeValue" | egrep -v ">https://refeds.org/sirtfi<|>http://www.swamid.se/policy/assurance/al1<|>http://www.swamid.se/policy/assurance/al2<|>http://www.swamid.se/policy/authentication/swamid-al2-mfa<|>http://www.swamid.se/policy/authentication/swamid-al2-mfa-hi<" ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || true
testValidContact:
@echo "Checking for valid Contact Information"
@for x in swamid-2.0/*.xml ; do if ( cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/ContactPerson" - 2>/dev/null | grep 'EmailAddress' | grep -qv ">mailto:") ; then echo "[1;31m Missing mailto in ContactPerson in file $$x [0m" ; fi ; done | grep . && exit 1 || true
@echo "Checking for empty ContactPerson tags"
@if grep -H -E '<(Company|SurName|EmailAddress|TelephoneNumber)/>' swamid-2.0/*.xml | sed 's/^/ /' | grep . ; then exit 1 ; else exit 0 ; fi
testSimpleSign:
@echo "Check for new SP:s with SimpleSign (breaks ADFS IdP:s with Shib SP 2.5+)"
@for x in `grep -v "#" sp-with-simplesign`; do if [ ! -r swamid-2.0/$$x ] ; then echo $$x saknas; fi ; done | grep . && exit 1 || exit 0
@for x in `find $(SRCDIRS) -name \*.xml`; do if ! grep -qx `basename $$x` sp-with-simplesign && grep -q HTTP-POST-SimpleSign $$x ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done | grep . && exit 1 || exit 0
testALlevel:
@echo "Check for IdP:s with AL2 without AL1"
@for x in `find $(SRCDIRS) -name \*.xml`; do if grep -q http://www.swamid.se/policy/assurance/al2 $$x && ! grep -q http://www.swamid.se/policy/assurance/al1 $$x ; then echo " $$x" | sed 's/.*/[1;31m&[0m/' ; fi ; done
testBadStrings:
@echo "Check for bad strings in metadata"
@for x in `find $(SRCDIRS) -name \*.xml`; do grep -E 'ServiceName xml:lang="[^"]*"/>' $$x | sed 's/^/ /' ; done | grep . && exit 1 || exit 0
testRoleDescriptor:
@echo "Check for RoleDescriptor that should be removed"
@for x in `find $(SRCDIRS) -name \*.xml`; do \
grep -EH 'RoleDescriptor.*xsi:type="fed:(ApplicationServiceType|SecurityTokenServiceType)"' $$x | \
sed -e 's/^/ /' -e 's/xmlns.*xsi:type="fed:/xsi:type="fed:/' -e 's/ protocol.*>/>/' -e 's/.*/[1;31m&[0m/' ; \
done | grep . && exit 1 || exit 0
testAttributeInIdP:
@echo "Check for Attribute inside IDPSSODescriptor"
@for x in `find $(SRCDIRS) -name \*.xml`; do \
if cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/IDPSSODescriptor" - 2>/dev/null | grep -q " <Attribute Name" ; then \
echo " $$x" | sed 's/.*/[1;31m&[0m/' ;\
fi;\
done | grep . && exit 1 || exit 0
testRegistrationAuthority:
@echo "Check for registrationAuthority="http://www.swamid.se/" in EntityDescriptor/Extensions"
@for x in `find $(SRCDIRS) -name \*.xml`; do \
if ! cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Extensions" - 2>/dev/null | grep -qE 'registrationAuthority="http://www.swamid.se/"|registrationAuthority="http://www.swamid.se/loop"' ; then \
echo " $$x" | sed 's/.*/[1;31m&[0m/' ;\
fi;\
done | grep . && exit 1 || exit 0
#test: syntaxtest testMDUI testOrgData testEntCat testSimpleSign testALlevel testEduGAINchecks testRefedsRnS testGeantCoCo testMetadataUsage testBadStrings testIdPinSP testRoleDescriptor testAttributeInIdP testValidContact testRegistrationAuthority
test: syntaxtest testMDUI testEntCat testSimpleSign testALlevel testEduGAINchecks testRefedsRnS testGeantCoCo testMetadataUsage testBadStrings testIdPinSP testRoleDescriptor testAttributeInIdP testValidContact testRegistrationAuthority
test2: $(SWAMIDXML) schematest testEntCat testSimpleSign testALlevel testEduGAINchecks testRefedsRnS testGeantCoCo testMetadataUsage testBadStrings testIdPinSP testRoleDescriptor testAttributeInIdP testValidContact testRegistrationAuthority
#test2: $(SWAMIDXML)
.time/%.time: swamid-2.0/%.xml
@# make schematest
@xmllint --xinclude --nowarning --noout --path schema --schema schema.xsd $< 2>&1
@# make tidy
@xsltproc xslt/add-rpi.xsl $< > $<.c && mv $<.c $<
@xsltproc xslt/clean-entitydescriptor.xsl $< > $<.c && mv $<.c $<
@# make testMDUI
@echo "Checking for bad lang codes"
@# Lang = ISO_639-1
@cat $< | sed -n 's/.*xml:lang="\([^"]*\)".*/\1/p' | sort -u | grep -vxE 'cs|da|de|en|fi|fr|it|sv|no|nn|nb|is' | sed 's/.*/[1;31mBad lang code : &[0m/' | grep . && exit 1 || true
@if ( grep -q IDPSSODescriptor $< ) ; then \
echo "Do IdP checks" ; \
echo ">Checking for uniq IdP MDUI DisplayName"; \
for lang in `cat $< | sed -n 's/.*xml:lang="\(..\)".*/\1/p' | sort -u` ; do \
mdui_displayname=`cat $< | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/IDPSSODescriptor/Extensions/UIInfo/DisplayName[@xml:lang='$$lang']" - 2>/dev/null | sed 's/^[ ]*//;s/[ ]*$$//' | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g'`;\
organizationdisplayname=`cat $< | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/Organization/OrganizationDisplayName[@xml:lang='$$lang']" - 2>/dev/null | sed 's/^[ ]*//;s/[ ]*$$//' | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g'` ;\
for x in `find $(SRCDIRS) -name \*.xml | xargs grep -l IDPSSODescriptor | egrep -v $<` ; do cat $$x | sed 's;\(</*\)[a-z0-9]*:;\1;g' | sed 's/xmlns="[^"]*"//' | xmllint --xpath "/EntityDescriptor/IDPSSODescriptor/Extensions/UIInfo/DisplayName[@xml:lang='$$lang']" - 2>/dev/null | tr -d '\n' | sed 's;<[^>]*>\([^<]*\)</[^>]*>;\1\n;g' | egrep "^$$mdui_displayname$$" | sed "s;^;Duplicate DisplayName in $$x for lang = $$lang\n;" | sed 's/.*/[1;31m&[0m/' ; done | grep . && exit 1 || true;\
done; \
echo ">Checking for invalid IPHint"; \
cat $< | sed -n 's;.*<[a-z0-9:]*IPHint>\(.*\)</[a-z0-9:]*IPHint>;\1;p' | grep -vE '^$$|^[0-9./a-fA-F:]*$$' | sed 's/.*/[1;31m&[0m/'; \
echo ">Checking for invalid geodata (syntax is geo:xx.yy,zz.vv)";\
cat $< | sed -n 's;.*<[a-z0-9:]*GeolocationHint>\(.*\)</[a-z0-9:]*GeolocationHint>;\1;p' | grep -vE '^$$|^geo:[0-9][0-9][0-9.]*,[0-9][0-9][0-9.]*$$' | sed 's/.*/[1;31m&[0m/' ; \
echo ">Check for IdP:s with Logos over http";\
cat $< | grep 'Logo .*http://' | sed 's/.*>\(.*\)<.*/[1;31m\1[0m/' | grep . && exit 1 || exit 0 ; \
fi
@echo $< done
@touch -r $< $@
deeptest: test testMDUIreach
commit2: test2
@git diff --color || true
@echo ; echo -n "Run 'git commit -a'? [Y/n/skip] " ; read x ; case $$x in "Y"|"y"|"") git commit -a ;; s|skip) ;; *) exit 1 ;; esac
@git status -u
@echo "Checking for not committed files in swamid-2.0/" ; if git status --porcelain --ignored | awk '{print $$2}' | grep "^swamid-2.0/" | sed 's/^/ /' | grep . ; then echo "Not committed files in swamid-2.0/, aborting" ; exit 1 ; fi
@echo ; echo -n "Run 'git push'? [Y/n] " ; read x ; case $$x in "Y"|"y"|"") ;; *) exit 1 ;; esac
@git push
commit: tidy test
@git diff --color || true
@echo ; echo -n "Run 'git commit -a'? [Y/n/skip] " ; read x ; case $$x in "Y"|"y"|"") git commit -a ;; s|skip) ;; *) exit 1 ;; esac
@git status -u
@echo "Checking for not committed files in swamid-2.0/" ; if git status --porcelain --ignored | awk '{print $$2}' | grep "^swamid-2.0/" | sed 's/^/ /' | grep . ; then echo "Not committed files in swamid-2.0/, aborting" ; exit 1 ; fi
@echo ; echo -n "Run 'git push'? [Y/n] " ; read x ; case $$x in "Y"|"y"|"") ;; *) exit 1 ;; esac
@git push
|
