[java-identity-provider] 01/03: IDP-1450 Disallow empty attributes in the SEC schema
Rod Widdowson
rdw at steadingsoftware.com
Wed Jul 3 08:19:02 EDT 2019
This is an automated email from the git hooks/post-receive script.
rdw pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=ba12972a1d6c7b8f2ace738e29da0470d01b0318
commit ba12972a1d6c7b8f2ace738e29da0470d01b0318
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Jun 20 14:10:16 2019 +0100
IDP-1450 Disallow empty attributes in the SEC schema
https://issues.shibboleth.net/jira/browse/IDP-1450
---
.../main/resources/schema/shibboleth-security.xsd | 48 ++++++++++++----------
1 file changed, 27 insertions(+), 21 deletions(-)
diff --git a/idp-schema/src/main/resources/schema/shibboleth-security.xsd b/idp-schema/src/main/resources/schema/shibboleth-security.xsd
index 7750b37..862edf1 100644
--- a/idp-schema/src/main/resources/schema/shibboleth-security.xsd
+++ b/idp-schema/src/main/resources/schema/shibboleth-security.xsd
@@ -107,7 +107,7 @@
<complexType>
<simpleContent>
<extension base="string">
- <attribute name="algorithm" type="string" use="required">
+ <attribute name="algorithm" type="sec:string" use="required">
<annotation>
<documentation>
The JCA key algorithm identifier.
@@ -155,18 +155,18 @@
<documentation>Base type for credential information.</documentation>
</annotation>
<sequence>
- <element name="KeyName" type="string" minOccurs="0" maxOccurs="unbounded">
+ <element name="KeyName" type="sec:string" minOccurs="0" maxOccurs="unbounded">
<annotation>
<documentation>Name(s) of the key this credential represents.</documentation>
</annotation>
</element>
</sequence>
- <attribute name="id" type="string">
+ <attribute name="id" type="sec:string">
<annotation>
<documentation>Unique id for this credential.</documentation>
</annotation>
</attribute>
- <attribute name="entityID" type="string">
+ <attribute name="entityID" type="sec:string">
<annotation>
<documentation>Identifier for the entity which owns this credential.</documentation>
</annotation>
@@ -191,7 +191,7 @@
<complexType name="PasswordBearingString">
<simpleContent>
<extension base="string">
- <attribute name="password" type="string">
+ <attribute name="password" type="sec:string">
<annotation>
<documentation>
Password associated with the resource identified by elements of this type.
@@ -256,7 +256,7 @@
</annotation>
</element>
</sequence>
- <attribute name="verifyDepth" type="string">
+ <attribute name="verifyDepth" type="sec:string">
<annotation>
<documentation>
The maximum path verification depth to consider when constructing a PKIX cert path.
@@ -271,7 +271,7 @@
<annotation>
<documentation>Base type for validation information.</documentation>
</annotation>
- <attribute name="id" type="string" use="required">
+ <attribute name="id" type="sec:string" use="required">
<annotation>
<documentation>Unique id for this validation info set.</documentation>
</annotation>
@@ -282,17 +282,17 @@
<annotation>
<documentation>Type for basic PKIX validation options set for PKIX trust engines.</documentation>
</annotation>
- <attribute name="processEmptyCRLs" type="string">
+ <attribute name="processEmptyCRLs" type="sec:string">
<annotation>
<documentation>Flag as to whether empty CRL's will be processed. Defaults to true.</documentation>
</annotation>
</attribute>
- <attribute name="processExpiredCRLs" type="string">
+ <attribute name="processExpiredCRLs" type="sec:string">
<annotation>
<documentation>Flag as to whether expired CRL's will be processed. Defaults to true.</documentation>
</annotation>
</attribute>
- <attribute name="processCredentialCRLs" type="string">
+ <attribute name="processCredentialCRLs" type="sec:string">
<annotation>
<documentation>
Flag as to whether CRL's supplied in the untrusted credential
@@ -300,7 +300,7 @@
</documentation>
</annotation>
</attribute>
- <attribute name="defaultVerificationDepth" type="string">
+ <attribute name="defaultVerificationDepth" type="sec:string">
<annotation>
<documentation>Default PKIX path verification depth. Defaults to 1.</documentation>
</annotation>
@@ -317,7 +317,7 @@
<complexContent>
<extension base="sec:ValidationOptionsType">
<sequence>
- <element name="PolicyOID" type="string" minOccurs="0" maxOccurs="unbounded">
+ <element name="PolicyOID" type="sec:string" minOccurs="0" maxOccurs="unbounded">
<annotation>
<documentation>
Sets the initial policy identifiers (OID strings) for the underlying CertPath Provider,
@@ -328,7 +328,7 @@
</annotation>
</element>
</sequence>
- <attribute name="forceRevocationEnabled" type="string">
+ <attribute name="forceRevocationEnabled" type="sec:string">
<annotation>
<documentation>
If true, the revocation behavior of the underlying CertPath provider will be forced to the
@@ -338,7 +338,7 @@
</documentation>
</annotation>
</attribute>
- <attribute name="revocationEnabled" type="string">
+ <attribute name="revocationEnabled" type="sec:string">
<annotation>
<documentation>
If the attribute forceRevocationEnabled is true, the revocation behavior of the underlying CertPath
@@ -348,7 +348,7 @@
</documentation>
</annotation>
</attribute>
- <attribute name="policyMappingInhibit" type="string">
+ <attribute name="policyMappingInhibit" type="sec:string">
<annotation>
<documentation>
Sets the policy mapping inhibited flag for the underlying CertPath Provider.
@@ -357,7 +357,7 @@
</documentation>
</annotation>
</attribute>
- <attribute name="anyPolicyInhibit" type="string">
+ <attribute name="anyPolicyInhibit" type="sec:string">
<annotation>
<documentation>
Sets the any policy inhibited flag for the underlying CertPath Provider.
@@ -471,7 +471,7 @@
<complexContent>
<extension base="sec:TrustEngineType">
<sequence>
- <element name="TrustedName" type="string" minOccurs="0" maxOccurs="unbounded">
+ <element name="TrustedName" type="sec:string" minOccurs="0" maxOccurs="unbounded">
<annotation>
<documentation>
Specifies a trusted name against which the target entity
@@ -504,7 +504,7 @@
</annotation>
</element>
</sequence>
- <attribute name="trustedNameCheckEnabled" type="string">
+ <attribute name="trustedNameCheckEnabled" type="sec:string">
<annotation>
<documentation>
If true, the candidate X509Crednetial's certificate must match one of the
@@ -547,7 +547,7 @@
<complexContent>
<extension base="sec:TrustEngineType">
<sequence>
- <element name="TrustedName" type="string" minOccurs="0" maxOccurs="unbounded">
+ <element name="TrustedName" type="sec:string" minOccurs="0" maxOccurs="unbounded">
<annotation>
<documentation>
Specifies a trusted name against which the target entity
@@ -580,7 +580,7 @@
</annotation>
</element>
</sequence>
- <attribute name="trustedNameCheckEnabled" type="string">
+ <attribute name="trustedNameCheckEnabled" type="sec:string">
<annotation>
<documentation>
If true, the candidate X509Crednetial's certificate must match one of the
@@ -594,7 +594,7 @@
</complexType>
<complexType name="TrustEngineType" abstract="true">
- <attribute name="id" type="string" use="required">
+ <attribute name="id" type="sec:string" use="required">
<annotation>
<documentation>
Unique ID of the trust engine.
@@ -602,5 +602,11 @@
</annotation>
</attribute>
</complexType>
+
+ <simpleType name="string">
+ <restriction base="string">
+ <minLength value="1"/>
+ </restriction>
+ </simpleType>
</schema>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list