From 25418645fe9a3d45f30adb6ec951cd2338344295 Mon Sep 17 00:00:00 2001
From: cantor <cantor@cb58f699-b61c-0410-a6fe-9272a202ed29>
Date: Fri, 28 May 2010 19:49:42 +0000
Subject: [PATCH] Adjust for new configuration file, and add native eol
 handling.

git-svn-id: https://svn.middleware.georgetown.edu/cpp-sp/branches/REL_2@3260 cb58f699-b61c-0410-a6fe-9272a202ed29
---
 configs/security-policy.xml            | 72 +++++++++++++++++-----------------
 configs/upgrade.xsl                    | 27 +------------
 msi/scripts/shib_edit_config_files.vbs |  4 ++
 3 files changed, 42 insertions(+), 61 deletions(-)

diff --git a/configs/security-policy.xml b/configs/security-policy.xml
index c0a5393..fdaba43 100644
--- a/configs/security-policy.xml
+++ b/configs/security-policy.xml
@@ -1,36 +1,36 @@
-<SecurityPolicies xmlns="urn:mace:shibboleth:2.0:native:sp:config">
-
-    <!-- Each policy defines a set of rules to use to secure messages. -->
-
-    <!--
-    The predefined policy enforces replay/freshness, standard
-    condition processing, and permits signing and client TLS.
-    -->
-    <Policy id="default" validate="false">
-        <PolicyRule type="MessageFlow" checkReplay="true" expires="60"/>
-        <PolicyRule type="Conditions">
-            <PolicyRule type="Audience"/>
-            <!-- Enable Delegation rule to permit delegated access. -->
-            <!-- <PolicyRule type="Delegation"/> -->
-        </PolicyRule>
-        <PolicyRule type="ClientCertAuth" errorFatal="true"/>
-        <PolicyRule type="XMLSigning" errorFatal="true"/>
-        <PolicyRule type="SimpleSigning" errorFatal="true"/>
-    </Policy>
-
-    <!--
-    This policy is a place-holder for use of assertions in metadata
-    as a way of attaching signed information about particular IdPs.
-    -->
-    <Policy id="entity-attributes">
-        <PolicyRule type="Conditions"/>
-        <PolicyRule type="XMLSigning" errorFatal="true"/>
-    </Policy>
-    
-    <!-- Disables known weak algorithms. -->
-    <AlgorithmBlacklist>
-    http://www.w3.org/2001/04/xmldsig-more#md5
-    http://www.w3.org/2001/04/xmldsig-more#rsa-md5
-    </AlgorithmBlacklist>
-
-</SecurityPolicies>
+<SecurityPolicies xmlns="urn:mace:shibboleth:2.0:native:sp:config">
+
+    <!-- Each policy defines a set of rules to use to secure messages. -->
+
+    <!--
+    The predefined policy enforces replay/freshness, standard
+    condition processing, and permits signing and client TLS.
+    -->
+    <Policy id="default" validate="false">
+        <PolicyRule type="MessageFlow" checkReplay="true" expires="60"/>
+        <PolicyRule type="Conditions">
+            <PolicyRule type="Audience"/>
+            <!-- Enable Delegation rule to permit delegated access. -->
+            <!-- <PolicyRule type="Delegation"/> -->
+        </PolicyRule>
+        <PolicyRule type="ClientCertAuth" errorFatal="true"/>
+        <PolicyRule type="XMLSigning" errorFatal="true"/>
+        <PolicyRule type="SimpleSigning" errorFatal="true"/>
+    </Policy>
+
+    <!--
+    This policy is a place-holder for use of assertions in metadata
+    as a way of attaching signed information about particular IdPs.
+    -->
+    <Policy id="entity-attributes">
+        <PolicyRule type="Conditions"/>
+        <PolicyRule type="XMLSigning" errorFatal="true"/>
+    </Policy>
+    
+    <!-- Disables known weak algorithms. -->
+    <AlgorithmBlacklist>
+    http://www.w3.org/2001/04/xmldsig-more#md5
+    http://www.w3.org/2001/04/xmldsig-more#rsa-md5
+    </AlgorithmBlacklist>
+
+</SecurityPolicies>
diff --git a/configs/upgrade.xsl b/configs/upgrade.xsl
index 842d376..a5d8ad6 100644
--- a/configs/upgrade.xsl
+++ b/configs/upgrade.xsl
@@ -64,33 +64,10 @@
 
             <xsl:text>&#10;&#10;    </xsl:text>
             <xsl:comment>
-                <xsl:text> Each policy defines a set of rules to use to secure messages. </xsl:text>
+                <xsl:text> Policies that determine how to process and authenticate runtime messages. </xsl:text>
             </xsl:comment>
             <xsl:text>&#10;    </xsl:text>
-            <SecurityPolicies>
-                <xsl:text>&#10;        </xsl:text>
-                <xsl:comment>
-                    <xsl:text> The predefined policy enforces replay/freshness and permits signing and client TLS. </xsl:text>
-                </xsl:comment>
-                <xsl:text>&#10;        </xsl:text>
-                <Policy id="default" validate="false">
-                    <xsl:text>&#10;            </xsl:text>
-                    <PolicyRule type="MessageFlow" checkReplay="true" expires="60"/>
-                    <xsl:text>&#10;            </xsl:text>
-                    <PolicyRule type="Conditions">
-                    <xsl:text>&#10;                </xsl:text>
-                        <PolicyRule type="Audience"/>
-                    <xsl:text>&#10;            </xsl:text>
-                    </PolicyRule>
-                    <PolicyRule type="ClientCertAuth" errorFatal="true"/>
-                    <xsl:text>&#10;            </xsl:text>
-                    <PolicyRule type="XMLSigning" errorFatal="true"/>
-                    <xsl:text>&#10;            </xsl:text>
-                    <PolicyRule type="SimpleSigning" errorFatal="true"/>
-                    <xsl:text>&#10;        </xsl:text>
-                </Policy>
-                <xsl:text>&#10;    </xsl:text>
-            </SecurityPolicies>
+            <SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/>
             <xsl:text>&#10;&#10;</xsl:text>
         </SPConfig>
     </xsl:template>
diff --git a/msi/scripts/shib_edit_config_files.vbs b/msi/scripts/shib_edit_config_files.vbs
index c34dc0b..d9d3816 100644
--- a/msi/scripts/shib_edit_config_files.vbs
+++ b/msi/scripts/shib_edit_config_files.vbs
@@ -186,6 +186,10 @@ if (Err = 0) then
     FileSystemObj.CopyFile DistDir & "attribute-policy.xml", ConfigDir, false
   End If
 
+  If (NOT FileSystemObj.FileExists(ConfigDir & "security-policy.xml")) then
+    FileSystemObj.CopyFile DistDir & "security-policy.xml", ConfigDir, false
+  End If
+
   ' Finally, fix up schema catalogs.
   
   XMLDir = InstallDir & "\share\xml\xmltooling\"
-- 
2.1.4