ausaccessfed/federationregistry — pull request #128 by bradleybeddoes (2013-09-16 04:47:57+00:00)
Title: FR generates invalid metadata with no AttributeQuery endpoint

Hi Bradley,

Something we ran into recently - and I've just verified it applies to FR 2.2 as well: when an IdP deactivates their AttributeQuery endpoint, the federation metadata becomes invalid with respect to the schema.

xmlsectool --validateSchema says:
```xml
INFO XmlSecTool - Reading XML document from file 'registry-tamaki-metadata-no-aa-endpoint.xml'
INFO XmlSecTool - XML document parsed and is well-formed.
ERROR XmlSecTool - Invalid XML schema files, unable to validate XML
org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'NameIDFormat'. One of '{"urn:oasis:names:tc:SAML:2.0:metadata":ContactPerson, "urn:oasis:names:tc:SAML:2.0:metadata":AttributeService}' is expected.
```

The schema says that an AttributeAuthorityDescriptor must have at least one AttributeService.

When there's none, probably the only safe thing to do is not to include an AttributeAuthorityDescriptor at all in the EntityDescriptor...

Just checked: deleting the incomplete AttributeAuthorityDescriptor from the metadata makes it valid again.... (have not done integration testing with IdPs yet though....)

Hope this could be fixed for next release.

Cheers,
Vlad