From a0d3e209c110bdc33ab3f20c5e06e8a8d09928f5 Mon Sep 17 00:00:00 2001
From: Benjamin Dauvergne <bdauvergne@entrouvert.com>
Date: Fri, 16 Feb 2018 09:54:22 +0100
Subject: [PATCH] move tag Extensions in metadata template (fixes #21923)

Current template does not validate the SAML 2.0 metadata schema.
---
 mellon/templates/mellon/metadata.xml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/mellon/templates/mellon/metadata.xml b/mellon/templates/mellon/metadata.xml
index 62368e9..da01a4f 100644
--- a/mellon/templates/mellon/metadata.xml
+++ b/mellon/templates/mellon/metadata.xml
@@ -6,6 +6,12 @@
    AuthnRequestsSigned="true"
    WantAssertionsSigned="true"
    protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <Extensions>
+      <idpdisc:DiscoveryResponse index="1"
+        xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+        Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
+        Location="{{ discovery_endpoint_url }}"/>
+   </Extensions>
      {% for public_key in public_keys %}
        <KeyDescriptor>
            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
@@ -15,12 +21,6 @@
            </ds:KeyInfo>
        </KeyDescriptor>
     {% endfor %}
-    <Extensions>
-      <idpdisc:DiscoveryResponse index="1"
-        xmlns:idpdisc="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
-        Binding="urn:oasis:names:tc:SAML:profiles:SSO:idp-discovery-protocol"
-        Location="{{ discovery_endpoint_url }}"/>
-   </Extensions>
    <SingleLogoutService
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"
      Location="{{ logout_url }}" />
-- 
2.14.2