[java-identity-provider] branch master updated: IDP-1583 - Spring schema metafiles have stale references
Scott Cantor
cantor.2 at osu.edu
Wed Jun 24 22:42:30 UTC 2020
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=4b697053e6582a6c3740cc1bb1b7a0b3e7580ffd
The following commit(s) were added to refs/heads/master by this push:
new 4b697053e IDP-1583 - Spring schema metafiles have stale references
4b697053e is described below
commit 4b697053e6582a6c3740cc1bb1b7a0b3e7580ffd
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Jun 24 18:42:21 2020 -0400
IDP-1583 - Spring schema metafiles have stale references
https://issues.shibboleth.net/jira/browse/IDP-1583
Restore removed schemas to prevent remote lookup.
---
.../resources/schema/shibboleth-afp-mf-basic.xsd | 394 +++++++++
.../resources/schema/shibboleth-afp-mf-saml.xsd | 394 +++++++++
.../schema/shibboleth-attribute-encoder.xsd | 222 +++++
.../schema/shibboleth-attribute-resolver-ad.xsd | 376 +++++++++
.../schema/shibboleth-attribute-resolver-dc.xsd | 898 +++++++++++++++++++++
.../schema/shibboleth-attribute-resolver-pc.xsd | 82 ++
.../schema/shibboleth-relying-party-saml.xsd | 380 +++++++++
.../resources/schema/shibboleth-relying-party.xsd | 146 ++++
.../main/resources/schema/shibboleth-resource.xsd | 126 +++
.../schema/shibboleth-security-policy-saml.xsd | 157 ++++
10 files changed, 3175 insertions(+)
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp-mf-basic.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp-mf-basic.xsd
new file mode 100644
index 000000000..844dfcf97
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp-mf-basic.xsd
@@ -0,0 +1,394 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema"
+ xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
+ xmlns:afp="urn:mace:shibboleth:2.0:afp"
+ targetNamespace="urn:mace:shibboleth:2.0:afp:mf:basic"
+ elementFormDefault="qualified"
+ version="3.3.0">
+
+ <import namespace="urn:mace:shibboleth:2.0:afp" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-afp.xsd"/>
+
+ <!-- Blanket Match Function -->
+ <complexType name="ANY">
+ <annotation>
+ <documentation>A match function that evaluates to true.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType"/>
+ </complexContent>
+ </complexType>
+
+ <!-- Boolean Match Functions -->
+ <complexType name="AND">
+ <annotation>
+ <documentation>
+ A match function that performs a logical AND on the results of all contained matching functions.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <choice maxOccurs="unbounded">
+ <element name="Rule" type="afp:MatchFunctorType">
+ <annotation>
+ <documentation>
+ The set of match function rules to be ANDed.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="RuleReference" type="afp:ReferenceType">
+ <annotation>
+ <documentation>
+ The set of match function rules to be ANDed.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="OR">
+ <annotation>
+ <documentation>
+ A match function that performs a logical OR on the results of all contained matching functions.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <choice maxOccurs="unbounded">
+ <element name="Rule" type="afp:MatchFunctorType">
+ <annotation>
+ <documentation>
+ The set of match function rules to be ORed.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="RuleReference" type="afp:ReferenceType">
+ <annotation>
+ <documentation>
+ The set of match function rules to be ORed.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="NOT">
+ <annotation>
+ <documentation>
+ A match function that performs a logical NOT on the result of the contained matching function.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <choice>
+ <element name="Rule" type="afp:MatchFunctorType">
+ <annotation>
+ <documentation>
+ The set of match function rules to be negated.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="RuleReference" type="afp:ReferenceType">
+ <annotation>
+ <documentation>
+ The set of match function rules to be negated.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <!-- Predicate Plugin Function -->
+ <complexType name="Predicate">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute request against the
+ specified value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="rulePredicateRef" type="string" use="required">
+ <annotation>
+ <documentation>
+ The reference to an externally defined bean to do the predicate work
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="contextStrategyRef" type="string">
+ <annotation>
+ <documentation>
+ The reference to an externally define bean to lookup the context
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <!-- Literal String Match Functions -->
+ <complexType name="AttributeRequesterString">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute request against the specified value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:StringMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeIssuerString">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute issuer against the specified value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:StringMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="PrincipalNameString">
+ <annotation>
+ <documentation>A match function that matches the principal name against the specified value.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:StringMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AuthenticationMethodString">
+ <annotation>
+ <documentation>
+ A match function that matches the authentication method against the specified value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:StringMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeValueString">
+ <annotation>
+ <documentation>
+ A match function that matches the value of an attribute against the specified value. This match
+ evaluates to true if the attribute contains the specified value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:AttributeTargetedStringMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeScopeString">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute scope against the specified value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:AttributeTargetedStringMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeTargetedStringMatchType" abstract="true">
+ <complexContent>
+ <extension base="basic:StringMatchType">
+ <attribute name="attributeID" type="string">
+ <annotation>
+ <documentation>
+ The ID of the attribute whose value should be matched. If no attribute ID is specified the
+ ID of the containing attribute rule is assumed.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="StringMatchType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="value" type="string" use="required">
+ <annotation>
+ <documentation>The string value to match.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="ignoreCase" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether case should be ignored when evaluating the match.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <!-- Regular Expression Match Functions -->
+ <complexType name="AttributeRequesterRegex">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute requester against the specified regular expression.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:RegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeIssuerRegex">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute issuer against the specified regular expression.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:RegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="PrincipalNameRegex">
+ <annotation>
+ <documentation>
+ A match function that matches the principal name against the specified regular expression.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:RegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AuthenticationMethodRegex">
+ <annotation>
+ <documentation>
+ A match function that matches the authentication method against the specified regular expression.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:RegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeValueRegex">
+ <annotation>
+ <documentation>
+ A match function that matches an attribute value against the specified regular expression. This function
+ evaluates to true if any value matches the given expression.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:AttributeTargetedRegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeScopeRegex">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute scope against the specified regular expression.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="basic:AttributeTargetedRegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeTargetedRegexMatchType" abstract="true">
+ <complexContent>
+ <extension base="basic:RegexMatchType">
+ <attribute name="attributeID" type="string">
+ <annotation>
+ <documentation>
+ The ID of the attribute whose value should be matched. If no attribute ID is specified the
+ ID of the containing attribute rule is assumed.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="RegexMatchType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="regex" type="string" use="required">
+ <annotation>
+ <documentation>The regular expression values are matched against.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <!-- Misc. Functions -->
+ <complexType name="Script">
+ <annotation>
+ <documentation>
+ A match function that evaluates a script to determine if some criteria is met. The script MUST return a
+ boolean.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <choice>
+ <element name="Script" type="string" minOccurs="0">
+ <annotation>
+ <documentation>The script to evaluate to construct the attribute.</documentation>
+ </annotation>
+ </element>
+ <element name="ScriptFile" type="string" minOccurs="0">
+ <annotation>
+ <documentation>
+ The filesystem path to the script to evaluate to construct the attribute.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ <attribute name="language" type="string">
+ <annotation>
+ <documentation>
+ The JSR-233 name for the scripting language that will be used. By default "javascript" is
+ supported.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="NumberOfAttributeValues">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the given attribute has as a number of values that falls
+ between the minimum and maximum. This method may be used as a sanity check to ensure that an unexpected
+ number of values did not come from the attribute resolver and be released.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="attributeID" type="string" use="required">
+ <annotation>
+ <documentation>The ID of the attribute whose value should be matched.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="minimum" type="string">
+ <annotation>
+ <documentation>Minimum number of values an attribute may have.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="maximum" type="string">
+ <annotation>
+ <documentation>Maximum number of values an attribute may have.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-afp-mf-saml.xsd b/idp-schema/src/main/resources/schema/shibboleth-afp-mf-saml.xsd
new file mode 100644
index 000000000..f2c5ff178
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-afp-mf-saml.xsd
@@ -0,0 +1,394 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema"
+ xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"
+ xmlns:afp="urn:mace:shibboleth:2.0:afp"
+ targetNamespace="urn:mace:shibboleth:2.0:afp:mf:saml"
+ elementFormDefault="qualified"
+ version="3.3.0">
+
+ <import namespace="urn:mace:shibboleth:2.0:afp" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-afp.xsd"/>
+
+ <annotation>
+ <documentation>
+ A set of SAML specific match functions. These match functions only operate against a
+ SAMLFilterContext.
+ </documentation>
+ </annotation>
+
+ <complexType name="AttributeIssuerEntityAttributeExactMatch">
+ <annotation>
+ <documentation>
+ A match function that checks if the attribute issuer contains an entity attribute with the
+ specified value.
+
+ Not supported in V3.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityAttributeExactMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="EntityAttributeExactMatch">
+ <annotation>
+ <documentation>
+ A match function that checks if the attribute requester contains an entity attribute with the
+ specified value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityAttributeExactMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeRequesterEntityAttributeExactMatch">
+ <annotation>
+ <documentation>
+ A match function that checks if the attribute requester contains an entity attribute with the
+ specified value.
+
+ Deprecated in favor of "EntityAttributeExactMatch".
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityAttributeExactMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="EntityAttributeExactMatchType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="attributeName" type="string" use="required">
+ <annotation>
+ <documentation>The name of the entity attribute to match.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="attributeNameFormat" type="string" use="optional">
+ <annotation>
+ <documentation>The name format of the entity attribute to match.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="attributeValue" type="string" use="required">
+ <annotation>
+ <documentation>The value of the entity attribute to match.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeIssuerEntityAttributeRegexMatch">
+ <annotation>
+ <documentation>
+ A match function that checks if the attribute issuer contains an entity attribute with a
+ value that matches the given regular expression.
+
+ Not supported in V3.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityAttributeRegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="EntityAttributeRegexMatch">
+ <annotation>
+ <documentation>
+ A match function that checks if the attribute requester contains an entity attribute with a
+ value that matches the given regular expression.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityAttributeRegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeRequesterEntityAttributeRegexMatch">
+ <annotation>
+ <documentation>
+ A match function that checks if the attribute requester contains an entity attribute with a
+ value that matches the given regular expression.
+
+ Deprecated in favor of "EntityAttributeRegexMatch".
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityAttributeRegexMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="EntityAttributeRegexMatchType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="attributeName" type="string" use="required">
+ <annotation>
+ <documentation>The name of the entity attribute to match.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="attributeNameFormat" type="string" use="optional">
+ <annotation>
+ <documentation>The name format of the entity attribute to match.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="attributeValueRegex" type="string" use="required">
+ <annotation>
+ <documentation>The regular expression that must match the value of the entity attribute to
+ match.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeIssuerNameIDFormatExactMatch">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute issuer supports a specified
+ NameID format.
+
+ Not supported in V3.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:NameIDFormatExactMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="NameIDFormatExactMatch">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute requester supports a specified
+ NameID format.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:NameIDFormatExactMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeRequesterNameIDFormatExactMatch">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute requester supports a specified
+ NameID format.
+
+ Deprecated in favor of "NameIDFormatExactMatch".
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:NameIDFormatExactMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="NameIDFormatExactMatchType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="nameIdFormat" type="string" use="required">
+ <annotation>
+ <documentation>The NameID format that needs to be supported by the entity.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeRequesterInEntityGroup">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute requester is found in metadata and
+ is a member of the given entity group.
+
+ Deprecated in favor of "InEntityGroup".
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityGroupMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="InEntityGroup">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute requester is found in metadata and
+ is a member of the given entity group.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityGroupMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeIssuerInEntityGroup">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if the attribute issuer is found in metadata and is a
+ member of the given entity group.
+
+ Not supported in V3.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:EntityGroupMatchType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="EntityGroupMatchType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="groupID" type="string" use="required">
+ <annotation>
+ <documentation>The entity group ID that an entity must be in.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeScopeMatchesShibMDScope">
+ <annotation>
+ <documentation>
+ A match function that ensures that an attribute value's scope matches a scope given in
+ metadata for the entity or role.
+
+ Not supported in V3.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeValueMatchesShibMDScope">
+ <annotation>
+ <documentation>
+ A match function that ensures that an attribute's value matches a scope given in
+ metadata for the entity or role.
+
+ Not supported in V3.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType" />
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeIssuerRegistrationAuthority">
+ <annotation>
+ <documentation>
+ A match function that matches the attribute issuer's MDRPI content against a list of potential values.
+
+ Not supported in V3.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:RegistrationAuthorityMatchType" />
+ </complexContent>
+ </complexType>
+
+ <complexType name="RegistrationAuthority">
+ <annotation>
+ <documentation>
+ A match function that matches the SP (requester) MDRPI against a list of potential values.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:RegistrationAuthorityMatchType" />
+ </complexContent>
+ </complexType>
+
+ <complexType name="RegistrationAuthorityMatchType" abstract="true">
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="registrars" type="saml:anyURIListType" use="required">
+ <annotation>
+ <documentation>The string values to match.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="matchIfMetadataSilent" type="boolean">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether a match should occur if the metadata does
+ not contain an MDRPI statement (coded) default is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeInMetadataType" abstract="true">
+ <annotation>
+ <documentation>
+ Functions that evaluate to true if an attribute (or specific values) is specified by
+ supplied metadata.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="afp:MatchFunctorType">
+ <attribute name="attributeID" type="string">
+ <annotation>
+ <documentation>
+ The ID of the attribute whose value should be matched. If no attribute ID is specified the
+ ID of the containing attribute rule is assumed.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="onlyIfRequired" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether attributes noted as optional should match.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="matchIfMetadataSilent" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether a match should occur if (after mapping)
+ the metadata does not contain and Attributes.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="AttributeInMetadata">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if an attribute (or specific values) is specified by
+ the requesting entity's AttributeConsumingService SP metadata.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:AttributeInMetadataType">
+ <attribute name="attributeName" type="string" use="optional">
+ <annotation>
+ <documentation>The name of a requested attribute to look for.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="attributeNameFormat" type="string" use="optional">
+ <annotation>
+ <documentation>The name format of a requested attribute to look for.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="MappedAttributeInMetadata">
+ <annotation>
+ <documentation>
+ A match function that evaluates to true if a mapped attribute (or specific values) is specified by
+ the requesting entity's AttributeConsumingService SP metadata.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="saml:AttributeInMetadataType" />
+ </complexContent>
+ </complexType>
+
+ <simpleType name="anyURIListType">
+ <list itemType="string"/>
+ </simpleType>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-encoder.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-encoder.xsd
new file mode 100644
index 000000000..b8a774663
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-encoder.xsd
@@ -0,0 +1,222 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:encoder="urn:mace:shibboleth:2.0:attribute:encoder" xmlns:resolver="urn:mace:shibboleth:2.0:resolver" targetNamespace="urn:mace:shibboleth:2.0:attribute:encoder" elementFormDefault="qualified">
+
+ <import namespace="urn:mace:shibboleth:2.0:resolver" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"/>
+
+ <!-- Encoders that produce SAML 1 or SAML 2 Attribtues -->
+ <complexType name="SAML1String">
+ <annotation>
+ <documentation>Defines a SAML 1 string encoder for an attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="namespace" type="string">
+ <annotation>
+ <documentation>The SAML 1 Namespace of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML1Base64">
+ <annotation>
+ <documentation>Defines a SAML 1 Base64 encoder for an attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="namespace" type="string">
+ <annotation>
+ <documentation>The SAML 1 Namespace of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML1XMLObject">
+ <annotation>
+ <documentation>Defines a SAML 1 Base64 encoder for an attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="namespace" type="string">
+ <annotation>
+ <documentation>The SAML 1 Namespace of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2String">
+ <annotation>
+ <documentation>Defines a SAML 2 string encoder for an attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="nameFormat" type="string">
+ <annotation>
+ <documentation>The SAML 2 NameFormat of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="friendlyName" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 2 FriendlyName of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2Base64">
+ <annotation>
+ <documentation>Defines a SAML 2 Base64 encoder for an attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="nameFormat" type="string">
+ <annotation>
+ <documentation>The SAML 2 NameFormat of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="friendlyName" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 2 FriendlyName of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2XMLObject">
+ <annotation>
+ <documentation>Defines a SAML 2 Base64 encoder for an attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="nameFormat" type="string">
+ <annotation>
+ <documentation>The SAML 2 NameFormat of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="friendlyName" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 2 FriendlyName of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="BaseScopedAttributeEncoderType">
+ <annotation>
+ <documentation>Defines an encoder for a scoped attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="scopeType" type="string" use="optional">
+ <annotation>
+ <documentation>
+ The type of scoping to use for the encoded attribute. Valid values are "inline" or
+ "attribute".
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="scopeDelimiter" type="string" use="optional">
+ <annotation>
+ <documentation>
+ If scopeType is "inline", this is the delimeter used between the attribute value and
+ scope.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="scopeAttribute" type="string" use="optional">
+ <annotation>
+ <documentation>
+ If scopeType is "attribute", this is the name of the name of the attribute used to carry the
+ scope value.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML1ScopedString">
+ <annotation>
+ <documentation>Defines a SAML 1 string encoder for a scoped attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="encoder:BaseScopedAttributeEncoderType">
+ <attribute name="namespace" type="string">
+ <annotation>
+ <documentation>The SAML 1 Namespace of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2ScopedString">
+ <annotation>
+ <documentation>Defines a SAML 2 string encoder for a scoped attribute.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="encoder:BaseScopedAttributeEncoderType">
+ <attribute name="nameFormat" type="string">
+ <annotation>
+ <documentation>The SAML 2 NameFormat of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="friendlyName" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 2 FriendlyName of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+<!-- Encoders that produce SAML 1 or 2 name identifiers -->
+ <complexType name="SAML1StringNameIdentifier">
+ <annotation>
+ <documentation>Defines a SAML 1 string encoder for a NameIdentifier.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="nameFormat" type="string">
+ <annotation>
+ <documentation>The SAML 1 NameFormat of the NameIdentifier.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="nameQualifier" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 1 NameQualfier of the NameIdentifier.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2StringNameID">
+ <annotation>
+ <documentation>Defines a SAML 2 string encoder for a NameID.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeEncoderType">
+ <attribute name="nameFormat" type="string">
+ <annotation>
+ <documentation>The SAML 2 NameFormat of the NameID.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="nameQualifier" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 2 NameQualfier of the NameID.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-ad.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-ad.xsd
new file mode 100644
index 000000000..a0e992a0a
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-ad.xsd
@@ -0,0 +1,376 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:ad="urn:mace:shibboleth:2.0:resolver:ad" xmlns:resolver="urn:mace:shibboleth:2.0:resolver" targetNamespace="urn:mace:shibboleth:2.0:resolver:ad" elementFormDefault="qualified">
+
+ <import namespace="urn:mace:shibboleth:2.0:resolver" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"/>
+
+ <complexType name="Simple">
+ <annotation>
+ <documentation>A basic attribute definition.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="PrincipalName">
+ <annotation>
+ <documentation>Exposes the principal's name as an attribute definition.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="PrincipalAuthenticationMethod">
+ <annotation>
+ <documentation>Exposes the principal's authentication method as an attribute definition.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SubjectDerivedAttribute">
+ <annotation>
+ <documentation>A attribute definition to pull attribute values from the Principals. A short cut looks at IdPAttributePrincipals</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="attributeValuesFunctionRef" type="string" >
+ <annotation>
+ <documentation>Provides a plug in point to allow general extraction of values from Principals. Incompatible with idpAttributeName</documentation>
+ </annotation>
+ </attribute>
+
+ <attribute name="principalAttributeName" type="string" >
+ <annotation>
+ <documentation>The id of the IdPAttribute contained within a IdPAttributePrincipal to look for. Incompatible with attributeValueEngineRef.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="ContextDerivedAttribute">
+ <annotation>
+ <documentation>A attribute definition to pull attribute values from anywhere in the PRC tree</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="attributeValuesFunctionRef" type="string" use="required">
+ <annotation>
+ <documentation>The Function to generate the Attribute Values given a PRC</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="TransientId">
+ <annotation>
+ <documentation>A attribute definition used to construct transient subject identifiers.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="storageServiceRef" type="string" default="shibboleth.StorageService">
+ <annotation>
+ <documentation>Storage service used to store created identifiers</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="lifetime" type="string">
+ <annotation>
+ <documentation>Lifetime of issued identifiers</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="CryptoTransientId">
+ <annotation>
+ <documentation>An attribute definition used to construct stateless transient subject identifiers.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="dataSealerRef" type="string" use="required">
+ <annotation>
+ <documentation>Object used to protect and encrypt identifiers</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="lifetime" type="string">
+ <annotation>
+ <documentation>Lifetime of issued identifiers</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Scoped">
+ <annotation>
+ <documentation>A basic attribute definition which supports attribute scoping.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="scope" type="string" use="required">
+ <annotation>
+ <documentation>Value to use for scoping the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Prescoped">
+ <annotation>
+ <documentation>
+ An attribute definition that splits the values of the source attribute into an attribute value
+ with a value and scope.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="scopeDelimiter" type="string">
+ <annotation>
+ <documentation>Delimiter between the value and scope.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="RegexSplit">
+ <annotation>
+ <documentation>An attribute definition that splits the source attribute's values based on a regular expression.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="regex" type="string" use="required">
+ <annotation>
+ <documentation>The regular expression used to split a value.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="caseSensitive" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating the case sensitivity of the regular expression.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML1NameIdentifier">
+ <annotation>
+ <documentation>An attribute definition that creates attributes whose values are SAML 1 NameIdentifiers.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="nameIdFormat" type="string">
+ <annotation>
+ <documentation>The SAML 1 NameFormat of the NameID.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="nameIdQualifier" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 1 NameQualifier of the NameID.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2NameID">
+ <annotation>
+ <documentation>An attribute definition that creates attributes whose values are SAML 2 NameIDs.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <attribute name="nameIdFormat" type="string">
+ <annotation>
+ <documentation>The SAML 2 NameFormat of the NameID.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="nameIdQualifier" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 2 NameQualifier of the NameID.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="nameIdSPQualifier" type="string" use="optional">
+ <annotation>
+ <documentation>The SAML 2 SPNameQualifier of the NameID.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Script">
+ <annotation>
+ <documentation>
+ An attribute definition that constructs its attributes by means of a script supported by JSR-223. The
+ script is provided all the edu.internet2.middleware.shibboleth.common.attribute.Attribute object
+ resolved from all the definitions dependencies. The resultant attribute definition must then be bound to
+ a script attribute corresponding to the script variable whose name is the ID of the definition. This
+ variable is injected into the script by the attribute definition.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <choice>
+ <element name="Script" type="string">
+ <annotation>
+ <documentation>The script to evaluate to construct the attribute.</documentation>
+ </annotation>
+ </element>
+ <element name="ScriptFile" type="string">
+ <annotation>
+ <documentation>
+ The filesystem path to the script to evaluate to construct the attribute.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ <attribute name="language" type="string">
+ <annotation>
+ <documentation>
+ The JSR-233 name for the scripting language that will be used. By default "javascript" is
+ supported.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="customObjectRef" type="string">
+ <annotation>
+ <documentation>
+ The name of a bean defined somewhere else which will be injected into the script as an
+ object called "custom". If not supplied, nothing is injected.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Mapped">
+ <annotation>
+ <documentation>
+ The mapped attribute definition performs a many to many mapping from source attributes values provided
+ by the definition's dependencies to values which are returned. Each source value is passed through each
+ defined ValueMap which may result in one or more resulting values. If no ValueMaps match the source
+ value and a DefaultValue is defined, the DefaultValue is used.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <sequence>
+ <element name="DefaultValue" minOccurs="0">
+ <annotation>
+ <documentation>
+ A source value is mapped to the DefaultValue if none of the ValueMaps result in a match.
+ This string may not contain regular expression back references.
+ </documentation>
+ </annotation>
+ <complexType>
+ <simpleContent>
+ <extension base="string">
+ <attribute name="passThru" type="string">
+ <annotation>
+ <documentation>
+ If true, the source value is passed thru unmodified. If passThru is
+ enabled, DefaultValue may not contain a string value.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </simpleContent>
+ </complexType>
+ </element>
+ <element name="ValueMap" type="ad:ValueMapType" maxOccurs="unbounded"/>
+ </sequence>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="ValueMapType">
+ <annotation>
+ <documentation>
+ Performs many to one mapping of source values to a return value. SourceValue strings may include regular
+ expressions and the ReturnValue may include back references to capturing groups as supported by
+ java.util.regex.Pattern.
+ </documentation>
+ </annotation>
+ <sequence>
+ <element name="ReturnValue" type="string">
+ <annotation>
+ <documentation>The value to be returned from this value map.</documentation>
+ </annotation>
+ </element>
+ <element name="SourceValue" maxOccurs="unbounded">
+ <annotation>
+ <documentation>A regular expression string to be matched against the incoming value.</documentation>
+ </annotation>
+ <complexType>
+ <simpleContent>
+ <extension base="string">
+ <attribute name="ignoreCase" type="string">
+ <annotation>
+ <documentation>If true, value matching will be case-insensitive.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="partialMatch" type="string">
+ <annotation>
+ <documentation>
+ If true, the SourceValue may match only a substring of the incoming value. By
+ default, it must match the entire value.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </simpleContent>
+ </complexType>
+ </element>
+ </sequence>
+ </complexType>
+
+ <complexType name="Template">
+ <annotation>
+ <documentation>
+ An Attribute Definition that constructs its values based on the values of its dependencies using the
+ Velocity Template Language. Dependencies may have multiple values, however multiple dependencies must
+ have the same number of values. In the case of multi-valued dependencies, the template will be evaluated
+ multiples times, iterating over each dependency.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseAttributeDefinitionType">
+ <sequence>
+ <element name="Template" type="string" minOccurs="0">
+ <annotation>
+ <documentation>
+ Template specified in the Velocity Template Language used to construct attribute values.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="SourceAttribute" type="string" maxOccurs="unbounded">
+ <annotation>
+ <documentation>
+ Attribute IDs which should be used in this definition, rather than the sourceAttributeID
+ attribute. Each source attribute is available to be used in the Template as
+ ${attribute_name}. If the source attribute has multiple values, only one value is
+ available to the template at a time, but the template will be evaluated once for each
+ value.
+ </documentation>
+ </annotation>
+ </element>
+ </sequence>
+ <attribute name="velocityEngine" type="string">
+ <annotation>
+ <documentation>Name of the velocity engine defined within the application.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-dc.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-dc.xsd
new file mode 100644
index 000000000..8cdfa64b1
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-dc.xsd
@@ -0,0 +1,898 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:dc="urn:mace:shibboleth:2.0:resolver:dc" xmlns:resolver="urn:mace:shibboleth:2.0:resolver" xmlns:sec="urn:mace:shibboleth:2.0:security" targetNamespace="urn:mace:shibboleth:2.0:resolver:dc" elementFormDefault="qualified">
+
+ <import namespace="urn:mace:shibboleth:2.0:resolver" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"/>
+
+ <import namespace="urn:mace:shibboleth:2.0:security" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-security.xsd"/>
+
+ <complexType name="Static">
+ <annotation>
+ <documentation>
+ A data connector that gets its information from a static list of attributes and values specified within
+ this configuration.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseDataConnectorType">
+ <sequence>
+ <element name="Attribute" minOccurs="0" maxOccurs="unbounded">
+ <annotation>
+ <documentation>
+ Specifies an attribute, and its values, to be exposed by this connector.
+ </documentation>
+ </annotation>
+ <complexType>
+ <sequence>
+ <element name="Value" type="string" maxOccurs="unbounded">
+ <annotation>
+ <documentation>
+ A value of the attribute. If the value contains characters that would
+ otherwise need to be XML encoded you may wrap the value in a CDATA section.
+ </documentation>
+ </annotation>
+ </element>
+ </sequence>
+ <attribute name="id" type="string" use="required">
+ <annotation>
+ <documentation>The ID of the attribute.</documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+ </element>
+ </sequence>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Script">
+ <annotation>
+ <documentation>
+ A data connector that constructs attributes by means of a script supported by JSR-223. Populated
+ Attributes are added to the java.util.Collection "connectorResults".
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseDataConnectorType">
+ <choice>
+ <element name="Script" type="string" minOccurs="0">
+ <annotation>
+ <documentation>The script to evaluate to construct the attribute.</documentation>
+ </annotation>
+ </element>
+ <element name="ScriptFile" type="string" minOccurs="0">
+ <annotation>
+ <documentation>
+ The filesystem path to the script to evaluate to construct the attribute.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ <attribute name="language" type="string">
+ <annotation>
+ <documentation>
+ The JSR-233 name for the scripting language that will be used. By default "javascript" is
+ supported.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="customObjectRef" type="string">
+ <annotation>
+ <documentation>
+ The name of a bean defined somewhere else which will be injected into the script as an
+ object called "custom". If not supplied, nothing is injected.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="ComputedId">
+ <annotation>
+ <documentation>
+ An ID created by taking the SHA-1 hash of the requesting entity's ID, an attribute value (usually a user identifier), and a salt.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseDataConnectorType">
+ <attribute name="generatedAttributeID" type="string">
+ <annotation>
+ <documentation>
+ The name of the attribute produced by this data connector.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="sourceAttributeID" type="string" use="required">
+ <annotation>
+ <documentation>
+ The name of the attribute which should be used to as input to the computed ID.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="salt" type="string" use="required">
+ <annotation>
+ <documentation>
+ A salt, of at least 16 bytes, used in the computed ID.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="StoredId">
+ <annotation>
+ <documentation>
+ A connector that either generates a persistent ID by hashing or by looking it up in a database.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseDataConnectorType">
+ <choice minOccurs="0">
+ <element ref="dc:ContainerManagedConnection">
+ <annotation>
+ <documentation>
+ A connection, or pool of connections, to the database managed by the application
+ container.
+ </documentation>
+ </annotation>
+ </element>
+ <element ref="dc:ApplicationManagedConnection">
+ <annotation>
+ <documentation>
+ A connection, or pool of connections, to the database managed by the data connector.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="BeanManagedConnection" type="string">
+ <annotation>
+ <documentation>
+ A connection, or pool of connections, to the database configured in a Spring bean.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ <attribute name="queryTimeout" type="string">
+ <annotation>
+ <documentation>
+ Timeout for the queries made to the database.
+ Timeout is given in ISO8601 duration form.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="transactionRetries" type="string">
+ <annotation>
+ <documentation>
+ Number of retries if insert fails (defaults to 3).
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="failFast" type="string">
+ <annotation>
+ <documentation>
+ Whether to fail if the store cannot be verified at startup (defaults to false).
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="retryableErrors">
+ <annotation>
+ <documentation>
+ A space-delimited list of SQLState codes to treat as retryable (indicating
+ a duplicate insert error occurred).
+ </documentation>
+ </annotation>
+ <simpleType>
+ <list itemType="string"/>
+ </simpleType>
+ </attribute>
+ <attribute name="generatedAttributeID" type="string">
+ <annotation>
+ <documentation>
+ The name of the attribute produced by this data connector.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="sourceAttributeID" type="string" use="required">
+ <annotation>
+ <documentation>
+ The name of the attribute which should be used to as input to the computed ID.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="salt" type="string" >
+ <annotation>
+ <documentation>
+ A salt, of at least 16 bytes, used in the computed ID.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="RelationalDatabase">
+ <annotation>
+ <documentation>
+ A data connector definition that uses JDBC version 3 to connect to and pull information from a
+ relational database.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseDataConnectorType">
+ <sequence>
+ <choice minOccurs="0">
+ <element ref="dc:ContainerManagedConnection">
+ <annotation>
+ <documentation>
+ A connection, or pool of connections, to the database managed by the application
+ container.
+ </documentation>
+ </annotation>
+ </element>
+ <element ref="dc:ApplicationManagedConnection">
+ <annotation>
+ <documentation>
+ A connection, or pool of connections, to the database managed by the data connector.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="BeanManagedConnection" type="string">
+ <annotation>
+ <documentation>
+ A connection, or pool of connections, to the database configured in a Spring bean.
+ </documentation>
+ </annotation>
+ </element>
+ </choice>
+ <element name="QueryTemplate" type="string" minOccurs="0">
+ <annotation>
+ <documentation>
+ A template that will be used to create the SQL query thats pulls information from the
+ database.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="Column" type="dc:ColumnType" minOccurs="0" maxOccurs="unbounded"/>
+ <choice minOccurs="0">
+ <element name="ResultCache" type="dc:CacheConfigType"/>
+ <element name="ResultCacheBean" type="string"/>
+ </choice>
+ </sequence>
+ <attribute name="readOnlyConnection" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag that determines whether the connection to the database is read-only, if the
+ value is true, or read-write if the value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="queryUsesStoredProcedure" type="string">
+ <annotation>
+ <documentation>
+ No longer supported.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="queryTimeout" type="string">
+ <annotation>
+ <documentation>
+ Timeout for the queries made to the database.
+ Timeout is given in ISO8601 duration form.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="noResultIsError" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether a query returning no results should be considered an error. If
+ an error is raised and a failover dependency is defined for this connector the failover will
+ be invoked.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="multipleResultsIsError" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether a query returning more than one result should be considered an error. If
+ an error is raised and a failover dependency is defined for this connector the failover will
+ be invoked.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="cacheResults" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag that determines whether to cache results.
+
+ This option is no longer supported, use the ResultCache element instead.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="templateEngine" type="string">
+ <annotation>
+ <documentation>
+ Name of the template engine defined within the application.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="mappingStrategyRef" type="string">
+ <annotation>
+ <documentation>
+ Reference to a Spring bean providing the MappingStrategy implementation to use.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="validatorRef" type="string">
+ <annotation>
+ <documentation>
+ Reference to a Spring bean providing the Validator implementation to use.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <element name="ContainerManagedConnection" type="dc:ContainerManagedConnectionType">
+ <annotation>
+ <documentation>
+ Describes a database connection source that is managed by the application container.
+ </documentation>
+ </annotation>
+ </element>
+ <complexType name="ContainerManagedConnectionType">
+ <sequence>
+ <element name="JNDIConnectionProperty" type="dc:PropertyType" minOccurs="0" maxOccurs="unbounded">
+ <annotation>
+ <documentation>
+ A property used when constructing a JNDI initial context which in turn is used to lookup the
+ database DataSource.
+ </documentation>
+ </annotation>
+ </element>
+ </sequence>
+ <attribute name="resourceName" type="string" use="required">
+ <annotation>
+ <documentation>The resource name the DataSource is bound to in the JNDI tree.</documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+
+ <element name="ApplicationManagedConnection" type="dc:ApplicationManagedConnectionType">
+ <annotation>
+ <documentation>
+ Describes a database connection source that is managed by the attribute resolver data connector.
+ </documentation>
+ </annotation>
+ </element>
+ <complexType name="ApplicationManagedConnectionType">
+ <attribute name="jdbcDriver" type="string" use="required">
+ <annotation>
+ <documentation>
+ This is the full qualified class name of the JDBC driver used to connect to the database.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="jdbcURL" type="string" use="required">
+ <annotation>
+ <documentation>
+ The JDBC URL for the database. These are usually of the form
+ jdbc:databaseProduceName:databaseSpecificInformation. For example, jdbc:hsql:mem:MyDatabase
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="jdbcUserName" type="string">
+ <annotation>
+ <documentation>The user name to use while connecting to the database.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="jdbcPassword" type="string">
+ <annotation>
+ <documentation>The password to use while connecting to the database.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolAcquireIncrement" type="string">
+ <annotation>
+ <documentation>
+ The number of new connections that will be created when the pool is exhausted.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolAcquireRetryAttempts" type="string">
+ <annotation>
+ <documentation>
+ The number of times the pool will try to establish a connection to a database.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolAcquireRetryDelay" type="string">
+ <annotation>
+ <documentation>
+ The amount of time, in milliseconds, the pool will wait before trying to retrieve a new connection
+ after it has failed.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolBreakAfterAcquireFailure" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag that indicates whether the pool should be marked as permanently unavailable if a new
+ connection can not be established after the acquire retry attempts is reached.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolMinSize" type="string">
+ <annotation>
+ <documentation>
+ The minimum number of connections the pool will establish with the database. A value of zero means
+ there is no minimum.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolMaxSize" type="string">
+ <annotation>
+ <documentation>
+ The maximum number of connections the pool will establish with the database. A value of zero means
+ there is no maximum.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolMaxIdleTime" type="string">
+ <annotation>
+ <documentation>
+ The maximum time, in seconds, that an established connection will remain idle before it is closed.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolIdleTestPeriod" type="string">
+ <annotation>
+ <documentation>
+ The interval, in seconds, that the pool will scan idle established connections, using the validation
+ query, for liveness.
+ </documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+
+ <complexType name="PropertyType">
+ <attribute name="name" type="string" use="required">
+ <annotation>
+ <documentation>The name of the property.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="value" type="string" use="required">
+ <annotation>
+ <documentation>The value of the property,</documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+
+ <complexType name="ColumnType">
+ <attribute name="columnName" type="string" use="required">
+ <annotation>
+ <documentation>The name of the database column.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="attributeID" type="string">
+ <annotation>
+ <documentation>The name of the attribute that data from this column should be added to.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="type" type="dc:ColumnDataType">
+ <annotation>
+ <documentation>The Java data type data in the column should be extracted as.</documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+
+ <simpleType name="ColumnDataType">
+ <restriction base="string">
+ <enumeration value="BigDecimal"/>
+ <enumeration value="Boolean"/>
+ <enumeration value="Byte"/>
+ <enumeration value="ByteArray"/>
+ <enumeration value="Date"/>
+ <enumeration value="Double"/>
+ <enumeration value="Float"/>
+ <enumeration value="Integer"/>
+ <enumeration value="Long"/>
+ <enumeration value="Object"/>
+ <enumeration value="Short"/>
+ <enumeration value="String"/>
+ <enumeration value="Time"/>
+ <enumeration value="Timestamp"/>
+ <enumeration value="URL"/>
+ </restriction>
+ </simpleType>
+
+ <complexType name="LDAPDirectory">
+ <annotation>
+ <documentation>
+ A data connector that can pull information from an LDAP, version 3, directory.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BaseDataConnectorType">
+ <sequence>
+ <element name="FilterTemplate" type="string" minOccurs="0">
+ <annotation>
+ <documentation>
+ A template used to construct the LDAP filter used to query the directory.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="ReturnAttributes" type="string" minOccurs="0">
+ <annotation>
+ <documentation>
+ A space separated list of attributes that should be returned from the query.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="LDAPProperty" type="dc:PropertyType" minOccurs="0" maxOccurs="unbounded">
+ <annotation>
+ <documentation>
+ LDAP connection properties relevant to the underlying provider being used.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="StartTLSTrustCredential" type="sec:X509Credential" minOccurs="0">
+ <annotation>
+ <documentation>
+ The X.509 trust information to use when connecting to the directory over LDAPS or startTLS.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="StartTLSAuthenticationCredential" type="sec:X509Credential" minOccurs="0">
+ <annotation>
+ <documentation>
+ The X.509 client authentication information to use when connecting to the directory over LDAPS or startTLS.
+ </documentation>
+ </annotation>
+ </element>
+ <element name="ConnectionPool" type="dc:LdapPoolConfigType" minOccurs="0"/>
+ <element name="Column" type="dc:ColumnType" minOccurs="0" maxOccurs="unbounded"/>
+ <choice minOccurs="0">
+ <element name="ResultCache" type="dc:CacheConfigType"/>
+ <element name="ResultCacheBean" type="string"/>
+ </choice>
+ </sequence>
+ <attribute name="ldapURL" type="string">
+ <annotation>
+ <documentation>
+ The URL to the LDAP server.
+ If the search scope is set to ONELEVEL only the entries
+ within this node will be searched, if SUBTREE is specified entries within this node and descendant
+ nodes will be searched.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="connectionStrategy" type="dc:ConnectionStrategyType">
+ <annotation>
+ <documentation>
+ The LDAP connection strategy. Acceptable values are DEFAULT, ACTIVE_PASSIVE, ROUND_ROBIN, and RANDOM.
+ Default value is ACTIVE_PASSIVE.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="baseDN" type="string">
+ <annotation>
+ <documentation>
+ The base DN from which attribute search filtering occurs
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="principal" type="string">
+ <annotation>
+ <documentation>The DN for the principal connecting to the LDAP directory.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="principalCredential" type="string">
+ <annotation>
+ <documentation>
+ The credential for the principal connecting to the LDAP directory.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="authenticationType" type="dc:AuthenticationType">
+ <annotation>
+ <documentation>
+ The LDAP authentication type. Acceptable values are ANONYMOUS, SIMPLE, STRONG, EXTERNAL, DIGEST_MD5, CRAM_MD5, GSSAPI.
+ Default value is SIMPLE.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="searchScope" type="dc:SearchScopeType">
+ <annotation>
+ <documentation>
+ The LDAP search scope. Acceptable values are OBJECT, ONELEVEL, SUBTREE.
+ Default value is SUBTREE.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="useStartTLS" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether startTLS should be used when connecting to the LDAP.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolInitialSize" type="string">
+ <annotation>
+ <documentation>
+ This attribute is deprecated, use LdapPoolConfig#minPoolSize instead.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="poolMaxIdleSize" type="string">
+ <annotation>
+ <documentation>
+ This attribute is deprecated, use LdapPoolConfig#maxPoolSize instead.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="searchTimeLimit" type="string">
+ <annotation>
+ <documentation>
+ The maximum amount of time to wait for search results. If this limit is
+ reached a timeout error is raised. Default value is 3 seconds.
+ Time is expressed in ISO8601 duration format.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="connectTimeout" type="string">
+ <annotation>
+ <documentation>
+ The maximum amount of time to wait for connections to open. If this limit is
+ reached a timeout error is raised. Default value is 3 seconds.
+ Time is expressed in ISO8601 duration format.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="responseTimeout" type="string">
+ <annotation>
+ <documentation>
+ The maximum amount of time to wait for operation responses. If this limit is
+ reached a timeout error is raised. Default value is 3 seconds.
+ Time is expressed in ISO8601 duration format.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="maxResultSize" type="string">
+ <annotation>
+ <documentation>
+ The maximum number of results that may be returned from a query.
+ Default value is 1.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="cacheResults" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating that search results should be cached for the duration of a user's
+ session.
+
+ This option is no longer supported, use the ResultCache element instead.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="mergeResults" type="string">
+ <annotation>
+ <documentation>
+ No longer supported.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="noResultIsError" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether a query returning no results should be considered an error. If
+ an error is raised and a failover dependency is defined for this connector the failover will
+ be invoked.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="multipleResultsIsError" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether a query returning more than one result should be considered an error. If
+ an error is raised and a failover dependency is defined for this connector the failover will
+ be invoked.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="lowercaseAttributeNames" type="string">
+ <annotation>
+ <documentation>
+ Whether to lowercase LDAP attribute names used as IDs for shibboleth attributes
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="templateEngine" type="string">
+ <annotation>
+ <documentation>Name of the template engine defined within the application.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="mappingStrategyRef" type="string">
+ <annotation>
+ <documentation>
+ Reference to a Spring bean providing the MappingStrategy implementation to use.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="validatorRef" type="string">
+ <annotation>
+ <documentation>
+ Reference to a Spring bean providing the Validator implementation to use.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <simpleType name="ConnectionStrategyType">
+ <annotation>
+ <documentation>Supported connection strategies.</documentation>
+ </annotation>
+ <restriction base="string">
+ <enumeration value="DEFAULT"/>
+ <enumeration value="ACTIVE_PASSIVE"/>
+ <enumeration value="ROUND_ROBIN"/>
+ <enumeration value="RANDOM"/>
+ </restriction>
+ </simpleType>
+
+ <simpleType name="AuthenticationType">
+ <annotation>
+ <documentation>Supported authentication types.</documentation>
+ </annotation>
+ <restriction base="string">
+ <enumeration value="ANONYMOUS"/>
+ <enumeration value="SIMPLE"/>
+ <enumeration value="STRONG"/>
+ <enumeration value="EXTERNAL"/>
+ <enumeration value="DIGEST_MD5"/>
+ <enumeration value="CRAM_MD5"/>
+ <enumeration value="GSSAPI"/>
+ </restriction>
+ </simpleType>
+
+ <simpleType name="SearchScopeType">
+ <annotation>
+ <documentation>Supported search scopes.</documentation>
+ </annotation>
+ <restriction base="string">
+ <enumeration value="SUBTREE"/>
+ <enumeration value="ONELEVEL"/>
+ <enumeration value="OBJECT"/>
+ </restriction>
+ </simpleType>
+
+ <complexType name="LdapPoolConfigType">
+ <attribute name="minPoolSize" type="string">
+ <annotation>
+ <documentation>
+ The minimum number of ldap connections that should always be available in the pool.
+ Note that these connections are provisioned as soon as the pool is initialized.
+ Default value is 0.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="maxPoolSize" type="string">
+ <annotation>
+ <documentation>
+ The maximum number of ldap connections that should ever be available in the pool.
+ Note that when this threshold is reach the pool will begin blocking until a connection
+ is available.
+ Default value is 3.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="blockWhenEmpty" type="string">
+ <annotation>
+ <documentation>
+ Whether the pool should block when maxPoolSize objects are in use.
+ If false, pool will grow beyond the maxPoolSize value.
+ Note that a properly configured blocking pool will yield better performance.
+ Default value is true.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="blockWaitTime" type="string">
+ <annotation>
+ <documentation>
+ Amount of time to block while waiting for a connection from the pool. If no
+ wait time is given, callers will block indefinitely.
+
+ Values are expressed in ISO8601 duration format.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="validatePeriodically" type="string">
+ <annotation>
+ <documentation>
+ Whether each ldap connection should be checked on a periodic basis.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="validateTimerPeriod" type="string">
+ <annotation>
+ <documentation>
+ Time that the periodic pool validation process should repeat.
+ Ldap objects are pruned when they have been idle beyond the expiration time.
+ The pool is not pruned below the minimum pool size.
+ Default value is 30 minutes.
+
+ Period is expressed in ISO8601 duration format.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="validateDN" type="string">
+ <annotation>
+ <documentation>
+ Ldap compare DN to use for connection validation.
+ Used in conjunction with validateFilter to perform a compare.
+ Default value is empty.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="validateFilter" type="string">
+ <annotation>
+ <documentation>
+ Ldap compare filter to use for connection validation.
+ Used in conjuction with validateDN to perform a compare.
+ Default value is (objectClass=*).
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="expirationTime" type="string">
+ <annotation>
+ <documentation>
+ Time in that an object in the pool should be considered stale and ready for removal.
+ Time is expressed in ISO8601 duration format.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="failFastInitialize" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether pool initialization should fail if configuration criteria is not met.
+ Default value is true.
+ </documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+
+ <complexType name="CacheConfigType">
+ <attribute name="cacheManagerRef" type="string">
+ <annotation>
+ <documentation>
+ Name of the CacheManager bean that will manage the result cache. This is not used.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="elementTimeToLive" type="string">
+ <annotation>
+ <documentation>
+ Length of time a result will be cached.
+
+ Duration is expressed in ISO8601 duration notation.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="maximumCachedElements" type="string">
+ <annotation>
+ <documentation>
+ Maximum number of results that will be held in cache.
+ </documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-pc.xsd b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-pc.xsd
new file mode 100644
index 000000000..db0dd68eb
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-attribute-resolver-pc.xsd
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:pc="urn:mace:shibboleth:2.0:resolver:pc" xmlns:resolver="urn:mace:shibboleth:2.0:resolver" targetNamespace="urn:mace:shibboleth:2.0:resolver:pc" elementFormDefault="qualified">
+
+ <import namespace="urn:mace:shibboleth:2.0:resolver" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"/>
+
+ <import namespace="urn:mace:shibboleth:2.0:resolver:dc" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-attribute-resolver-dc.xsd"/>
+
+ <complexType name="Transient">
+ <annotation>
+ <documentation>
+ A principal connector that returns the SAML name identifier value as the principal name.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BasePrincipalConnectorType">
+ <attribute name="storageServiceRef" type="string" default="shibboleth.StorageService">
+ <annotation>
+ <documentation>
+ The identifier of the storage service used to store and retrieve principal names.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="noResultIsError" type="boolean">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether a query returning no results should be considered an error.
+ Default value is false.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="CryptoTransient">
+ <annotation>
+ <documentation>
+ A principal connector that decrypts the SAML name identifier value as the principal name.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BasePrincipalConnectorType">
+ <attribute name="dataSealerRef" type="string" use="required">
+ <annotation>
+ <documentation>Object used to decrypt identifiers</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="StoredId">
+ <annotation>
+ <documentation>
+ A principal connector that returns the SAML name identifier value as the principal name.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BasePrincipalConnectorType">
+ <attribute name="storedIdDataConnectorRef" type="string" use="required">
+ <annotation>
+ <documentation>
+ The ID of the StoredId data connector that created the ID to be resolved.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Direct">
+ <annotation>
+ <documentation>
+ A principal connector that returns the SAML name identifier value as the principal name.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="resolver:BasePrincipalConnectorType"/>
+ </complexContent>
+ </complexType>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-relying-party-saml.xsd b/idp-schema/src/main/resources/schema/shibboleth-relying-party-saml.xsd
new file mode 100644
index 000000000..05468d9b8
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-relying-party-saml.xsd
@@ -0,0 +1,380 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:spring="http://www.springframework.org/schema/beans" xmlns:samlrp="urn:mace:shibboleth:2.0:relying-party:saml" xmlns:rp="urn:mace:shibboleth:2.0:relying-party" targetNamespace="urn:mace:shibboleth:2.0:relying-party:saml" elementFormDefault="qualified">
+
+ <import namespace="urn:mace:shibboleth:2.0:relying-party" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-relying-party.xsd"/>
+
+ <complexType name="SAML2ArtifactResolutionProfile">
+ <annotation>
+ <documentation>SAML 2.0 artifact query communication profile configuration.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAML2ProfileConfigurationType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2AttributeQueryProfile">
+ <annotation>
+ <documentation>SAML 2.0 attribute query communication profile configuration.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAML2ProfileConfigurationType">
+ <attributeGroup ref="samlrp:artifactSettingsGroup"/>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2LogoutRequestProfile">
+ <annotation>
+ <documentation>SAML 2.0 logout request communication profile configuration.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAML2ProfileConfigurationType">
+ <attributeGroup ref="samlrp:artifactSettingsGroup"/>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2ECPProfile">
+ <annotation>
+ <documentation>SAML 2.0 ECP single sign-on communication profile configuration.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAML2SSOProfile"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2SSOSProfile">
+ <annotation>
+ <documentation>SAML 2.0 Liberty ID-WSF SSOS profile configuration.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAML2SSOProfile">
+ <attribute name="delegationPredicateRef" type="string">
+ <annotation>
+ <documentation>
+ Reference to a predicate used to determine whether a delegated token presented
+ to the IdP by another non-user entity may be used to complete SAML 2 SSO
+ to this relying party.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2SSOProfile">
+ <annotation>
+ <documentation>SAML 2.0 single sign-on communication profile configuration.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAML2ProfileConfigurationType">
+ <attributeGroup ref="samlrp:artifactSettingsGroup"/>
+ <attribute name="allowDelegation" type="string">
+ <annotation>
+ <documentation>
+ Whether produced assertions may be delegated.
+
+ Mutually exclusive with allowDelegationPredicateRef.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="allowDelegationPredicateRef" type="string">
+ <annotation>
+ <documentation>
+ Reference to a predicate use to determine whether produced assertions may be delegated.
+
+ Mutually exclusive with allowDelegation.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="maximumTokenDelegationChainLength" type="string">
+ <annotation>
+ <documentation>
+ Limits the total number of delegates that may be derived from the initial SAML token.
+ The identity provider will not accept, and therefore will also not issue, Assertion tokens
+ with a delegation chain length greater than this value.
+
+ The length of a delegation chain is evaluated as the number of Delegate children within an
+ Assertion's DelegationRestrictionType Condition element.
+
+ The value used when applying the policy is determined by the value in effect for the
+ relying party to which the initial SSO Assertion was issued.
+
+ Defaults to 1.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="localityAddress" type="string">
+ <annotation>
+ <documentation>
+ Deprecated, never implemented.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="localityDNSName" type="string">
+ <annotation>
+ <documentation>
+ Deprecated, never implemented.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="includeAttributeStatement" type="string">
+ <annotation>
+ <documentation>
+ Boolean flag indicating whether an attribute statement should be included with the
+ authentication statement in the response sent back to the relying party.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="maximumSPSessionLifetime" type="string">
+ <annotation>
+ <documentation>
+ The maximum amount of time the service provider should maintain a session
+ for the user based on the authentication assertion. This attribute is converted into the
+ SessionNotOnOrAfter attribute of the AuthnStatement. If no value is supplied then the
+ SessionNotOnOrAfter attribute is not sent within the AuthnStatement.
+
+ Lifetime is expressed in ISO8601 duration notation.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="skipEndpointValidationWhenSigned" type="string">
+ <annotation>
+ <documentation>
+ If true, allows signed AuthnRequests to bypass validation of the response
+ location against metadata, if a location is specified in the request.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2ProfileConfigurationType" abstract="true">
+ <annotation>
+ <documentation>Base type for SAML 2.0 communication profile configurations.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAMLProfileConfigurationType">
+ <sequence>
+ <element name="ProxyAudience" type="string" minOccurs="0" maxOccurs="unbounded">
+ <annotation>
+ <documentation>List of audiences for proxied assertions.</documentation>
+ </annotation>
+ </element>
+ </sequence>
+ <attribute name="encryptionOptional" type="string">
+ <annotation>
+ <documentation>A flag indicating whether encryption is optional.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="encryptNameIds" type="string">
+ <annotation>
+ <documentation>
+ A flag indicating whether NameIDs should be encrypted.
+
+ One of "always", "conditional", "never"
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="encryptAssertions" type="string">
+ <annotation>
+ <documentation>
+ A flag indicating whether assertions should be encrypted.
+
+ One of "always", "conditional", "never"
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="encryptAttributes" type="string">
+ <annotation>
+ <documentation>
+ A flag indicating whether attributes should be encrypted.
+
+ One of "always", "conditional", "never"
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="assertionProxyCount" type="string">
+ <annotation>
+ <documentation>The maximum number of times an assertion may be proxied.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML1ArtifactResolutionProfile">
+ <annotation>
+ <documentation>SAML 1.0 and 1.1 artifact query communication profile configurations.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAMLProfileConfigurationType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML1AttributeQueryProfile">
+ <annotation>
+ <documentation>SAML 1.0 and 1.1 attribute query communication profile configurations.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAMLProfileConfigurationType">
+ <attributeGroup ref="samlrp:artifactSettingsGroup"/>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="ShibbolethSSOProfile">
+ <annotation>
+ <documentation>Shibboleth 1 single sign-on communication profile configurations.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="samlrp:SAMLProfileConfigurationType">
+ <attributeGroup ref="samlrp:artifactSettingsGroup"/>
+ <attribute name="localityAddress" type="string">
+ <annotation>
+ <documentation>
+ Deprecated, never implemented.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="localityDNSName" type="string">
+ <annotation>
+ <documentation>
+ Deprecated, never implemented.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="includeAttributeStatement" type="string">
+ <annotation>
+ <documentation>
+ Boolean flag indicating whether an attribute statement should be included with the
+ authentication statement in the response sent back to the relying party.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAMLProfileConfigurationType" abstract="true">
+ <annotation>
+ <documentation>Base type for SAML (1.0, 1.1, and 2.0) communication profile configurations.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="rp:ProfileConfigurationType">
+ <sequence>
+ <choice>
+ <element name="Audience" type="string" minOccurs="0" maxOccurs="unbounded">
+ <annotation>
+ <documentation>Additional audiences to which an assertion may be released.</documentation>
+ </annotation>
+ </element>
+ </choice>
+ </sequence>
+ <attribute name="assertionLifetime" type="string">
+ <annotation>
+ <documentation>
+ The amount of time before an issued assertion expires.
+
+ Lifetime is expressed in ISO8601 duration notation.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="attributeAuthority" type="string">
+ <annotation>
+ <documentation>
+ Deprecated in V3
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="includeConditionsNotBefore" type="string">
+ <annotation>
+ <documentation>
+ Boolean flag indicating whether a NotBefore condition should be included in any
+ assertions sent back to the relying party.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="outboundArtifactType" type="string">
+ <annotation>
+ <documentation>Deprecated in V3.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="securityPolicyRef" type="string">
+ <annotation>
+ <documentation>
+ Deprecated in V3.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="signingCredentialRef" type="string">
+ <annotation>
+ <documentation>ID of the credential to use to sign SAML assertions.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="signAssertions" type="string">
+ <annotation>
+ <documentation>
+ A flag indicating whether issued assertions should be signed. If no signing
+ credential is provided on this configuration and no default signing credential is provided
+ on the relying party configuration then signing will not occur regardless of this setting.
+
+ One of "always", "conditional", "never"
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="signRequests" type="string">
+ <annotation>
+ <documentation>
+ A flag indicating whether protocol requests should be signed. If no signing
+ credential is provided on this configuration and no default signing credential is provided
+ on the relying party configuration then signing will not occur regardless of this setting.
+
+ One of "always", "conditional", "never"
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="signResponses" type="string">
+ <annotation>
+ <documentation>
+ A flag indicating whether protocol responses should be signed. If no signing
+ credential is provided on this configuration and no default signing credential is provided
+ on the relying party configuration then signing will not occur regardless of this setting.
+
+ One of "always", "conditional", "never"
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <attributeGroup name="artifactSettingsGroup">
+ <annotation>
+ <documentation>
+ Settings involved in artifact issuance for the subset of profiles that use them.
+ </documentation>
+ </annotation>
+ <attribute name="artifactType" type="string">
+ <annotation>
+ <documentation>An integral type code for the artifact type to issue.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="artifactResolutionServiceURL" type="string">
+ <annotation>
+ <documentation>
+ The location, as a URL, of the issuer's resolution service endpoint.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="artifactResolutionServiceIndex" type="string">
+ <annotation>
+ <documentation>
+ The index of the issuer's resolution service endpoint, corresponding to its metadata.
+ </documentation>
+ </annotation>
+ </attribute>
+ </attributeGroup>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-relying-party.xsd b/idp-schema/src/main/resources/schema/shibboleth-relying-party.xsd
new file mode 100644
index 000000000..784699e42
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-relying-party.xsd
@@ -0,0 +1,146 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:rp="urn:mace:shibboleth:2.0:relying-party" xmlns:security="urn:mace:shibboleth:2.0:security" xmlns:shibmd="urn:mace:shibboleth:2.0:metadata" xmlns:service="urn:mace:shibboleth:2.0:services" targetNamespace="urn:mace:shibboleth:2.0:relying-party" elementFormDefault="qualified">
+
+ <import namespace="urn:mace:shibboleth:2.0:metadata" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-metadata.xsd"/>
+
+ <import namespace="urn:mace:shibboleth:2.0:security" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-security.xsd"/>
+
+ <annotation>
+ <documentation>Schema describing relying party configurations.</documentation>
+ </annotation>
+
+ <element name="RelyingPartyGroup">
+ <annotation>
+ <documentation>Root element of a relying party configuration document.</documentation>
+ </annotation>
+ <complexType>
+ <sequence>
+ <element ref="rp:AnonymousRelyingParty" minOccurs="1"/>
+ <element ref="rp:DefaultRelyingParty" minOccurs="1"/>
+ <element ref="rp:RelyingParty" minOccurs="0" maxOccurs="unbounded"/>
+ <element ref="shibmd:MetadataProvider" minOccurs="0"/>
+ <element ref="security:Credential" minOccurs="0" maxOccurs="unbounded"/>
+ <element ref="security:TrustEngine" minOccurs="0" maxOccurs="unbounded"/>
+ <element ref="security:SecurityPolicy" minOccurs="0" maxOccurs="unbounded"/>
+ </sequence>
+ </complexType>
+ </element>
+
+ <element name="RelyingParty" type="rp:IdentifiedRelyingPartyType">
+ <annotation>
+ <documentation>
+ A set of configuration options specific to a given relying party or group of relying parties as
+ expressed in SAML 2 metadata. Note, configuration options are not inherited from either the default
+ relying party or ancestral groups.
+ </documentation>
+ </annotation>
+ </element>
+
+ <element name="DefaultRelyingParty" type="rp:UnidentifiedRelyingParty">
+ <annotation>
+ <documentation>
+ The default set of configuration options to use for relying parties/groups not specifically called out.
+ </documentation>
+ </annotation>
+ </element>
+
+ <element name="AnonymousRelyingParty" type="rp:UnidentifiedRelyingParty">
+ <annotation>
+ <documentation>
+ The set of configuration options to use for relying parties/groups which are not authenticated or known
+ to the system.
+ </documentation>
+ </annotation>
+ </element>
+
+ <complexType name="IdentifiedRelyingPartyType">
+ <annotation>
+ <documentation>A relying party configuration specific to a particular relying party.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="rp:UnidentifiedRelyingParty">
+ <attribute name="id" type="string" use="required">
+ <annotation>
+ <documentation>The entity ID of the relying party.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="UnidentifiedRelyingParty">
+ <annotation>
+ <documentation>
+ Relying party configuration information that is not
+ specific to an identified relying party.
+ </documentation>
+ </annotation>
+ <sequence>
+ <element ref="rp:ProfileConfiguration" minOccurs="0"
+ maxOccurs="unbounded">
+ <annotation>
+ <documentation>
+ Profile specific configuration information.
+ </documentation>
+ </annotation>
+ </element>
+ </sequence>
+ <attribute name="provider" type="string" use="required">
+ <annotation>
+ <documentation>
+ The entity ID the responder should use when
+ communicating with the relying party.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="defaultAuthenticationMethod" type="string">
+ <annotation>
+ <documentation>
+ The authentication method to use to authenticate the
+ user, if one is not specified within the request.
+ This method must be one of the methods handled by
+ one of the authentication handlers defined for the
+ system.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="defaultSigningCredentialRef" type="string">
+ <annotation>
+ <documentation>
+ The ID of the default signing credential for the
+ relying party. This is provided as a convenience
+ method so that this credential need not be defined
+ on every signing supporting profile configuration.
+ If a profile configuration has a defined signing
+ credential it must be used in place of the
+ credential retrieved here.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="nameIDFormatPrecedence" type="string">
+ <annotation>
+ <documentation>
+ A space delimited list that provides a precedence
+ for NameID format to be used with the relying party.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="detailedErrors" type="string">
+ <annotation>
+ <documentation>
+ a boolean to indicate whether details errors are to be reported
+ </documentation>
+ </annotation>
+ </attribute>
+ </complexType>
+
+ <element name="ProfileConfiguration" type="rp:ProfileConfigurationType"/>
+ <complexType name="ProfileConfigurationType" abstract="true">
+ <annotation>
+ <documentation>
+ An abstract type from which all profile specific configuration types are derived.
+ </documentation>
+ </annotation>
+ </complexType>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-resource.xsd b/idp-schema/src/main/resources/schema/shibboleth-resource.xsd
new file mode 100644
index 000000000..b7a8a2ce3
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-resource.xsd
@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:res="urn:mace:shibboleth:2.0:resource" targetNamespace="urn:mace:shibboleth:2.0:resource" elementFormDefault="qualified">
+
+ <complexType name="ClasspathResource">
+ <complexContent>
+ <extension base="res:ResourceType">
+ <attribute name="file" type="string" use="required">
+ <annotation>
+ <documentation>
+ The file, within the JVM classpath, this resource represents.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="FilesystemResource">
+ <complexContent>
+ <extension base="res:ResourceType">
+ <attribute name="file" type="string" use="required">
+ <annotation>
+ <documentation>
+ The file this resource represents.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="HttpResource">
+ <complexContent>
+ <extension base="res:ResourceType">
+ <attribute name="url" type="string" use="required">
+ <annotation>
+ <documentation>
+ The URL this resource represents.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="FileBackedHttpResource">
+ <complexContent>
+ <extension base="res:ResourceType">
+ <attribute name="url" type="string" use="required">
+ <annotation>
+ <documentation>
+ The URL this resource represents.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="file" type="string" use="required">
+ <annotation>
+ <documentation>
+ The file the resource will be saved to and read from when the URL resource is not available.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SVNResource">
+ <complexContent>
+ <extension base="res:ResourceType">
+ <attribute name="repositoryURL" type="string" use="required"/>
+ <attribute name="connectionTimeout" type="string"/>
+ <attribute name="readTimeout" type="string"/>
+ <attribute name="workingCopyDirectory" type="string" use="required"/>
+ <attribute name="revision" type="string"/>
+ <attribute name="resourceFile" type="string" use="required"/>
+ <attribute name="username" type="string"/>
+ <attribute name="password" type="string"/>
+ <attribute name="proxyHost" type="string"/>
+ <attribute name="proxyPort" type="string"/>
+ <attribute name="proxyUsername" type="string"/>
+ <attribute name="proxyPassword" type="string"/>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="ResourceType" abstract="true">
+ <sequence>
+ <element ref="res:ResourceFilter" minOccurs="0"/>
+ </sequence>
+ </complexType>
+
+ <complexType name="PropertyReplacement">
+ <annotation>
+ <documentation>
+ A resource filter that replaces ${KEY} macros with the values associated with the KEY in a property
+ file.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="res:ResourceFilterType">
+ <attribute name="propertyFile" type="string" use="required">
+ <annotation>
+ <documentation> Path to the Java property file used during macro expansion.</documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Chaining">
+ <annotation>
+ <documentation>A resource filter that executes the child filters in the order they defined.</documentation>
+ </annotation>
+ <complexContent>
+ <extension base="res:ResourceFilterType">
+ <sequence>
+ <element ref="res:ResourceFilter" minOccurs="0" maxOccurs="unbounded"/>
+ </sequence>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <element name="ResourceFilter" type="res:ResourceFilterType"/>
+ <complexType name="ResourceFilterType" abstract="true"/>
+
+</schema>
diff --git a/idp-schema/src/main/resources/schema/shibboleth-security-policy-saml.xsd b/idp-schema/src/main/resources/schema/shibboleth-security-policy-saml.xsd
new file mode 100644
index 000000000..c54abdc84
--- /dev/null
+++ b/idp-schema/src/main/resources/schema/shibboleth-security-policy-saml.xsd
@@ -0,0 +1,157 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:samlsec="urn:mace:shibboleth:2.0:security:saml" xmlns:sec="urn:mace:shibboleth:2.0:security" targetNamespace="urn:mace:shibboleth:2.0:security:saml" elementFormDefault="qualified">
+
+ <import namespace="urn:mace:shibboleth:2.0:security" schemaLocation="http://shibboleth.net/schema/idp/shibboleth-security.xsd"/>
+
+ <complexType name="ProtocolWithXMLSignature">
+ <annotation>
+ <documentation>
+ A rule that checks the signature on SAML protocol messages.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="sec:SecurityPolicyRuleType">
+ <attribute name="trustEngineRef" type="string" use="required">
+ <annotation>
+ <documentation>
+ Reference to the trust engine used to validate the signature.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2AuthnRequestsSigned">
+ <annotation>
+ <documentation>
+ A rule that requires that an incoming SAML 2 AuthnRequest be signed
+ if this requirement is indicated in metadata via the request issuer's
+ SPSSODescriptor AuthnRequestsSigned attribute value.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="sec:SecurityPolicyRuleType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2HTTPPostSimpleSign">
+ <annotation>
+ <documentation>
+ A rule that checks the signature on SAML protocol messages.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="sec:SecurityPolicyRuleType">
+ <attribute name="trustEngineRef" type="string" use="required">
+ <annotation>
+ <documentation>
+ Reference to the trust engine used to validate the signature.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="parserPoolRef" type="string" default="shibboleth.ParserPool">
+ <annotation>
+ <documentation>
+ Reference to the parser pool used to parse incoming XML message.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="SAML2HTTPRedirectSimpleSign">
+ <annotation>
+ <documentation>
+ A rule that checks the signature on SAML protocol messages.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="sec:SecurityPolicyRuleType">
+ <attribute name="trustEngineRef" type="string" use="required">
+ <annotation>
+ <documentation>
+ Reference to the trust engine used to validate the signature.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="MandatoryIssuer">
+ <annotation>
+ <documentation>
+ A rule that requires that the issuer of the inbound SAML message, within the message context, be
+ populated.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="sec:SecurityPolicyRuleType"/>
+ </complexContent>
+ </complexType>
+
+ <complexType name="IssueInstant">
+ <annotation>
+ <documentation>
+ A rule that inspects the message issue instant and ensures that it is within a certain timeframe.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="sec:SecurityPolicyRuleType">
+ <attribute name="expirationThreshold" type="string">
+ <annotation>
+ <documentation>
+ Time after a message is issued before it is considered expired.
+
+ Threshold is expressed in ISO8601 duration notation.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="clockSkew" type="string">
+ <annotation>
+ <documentation>
+ Defines the valid life time of a message issue instant as: (instant - skew) < now >
+ (instant + expirationThreshold + skew)
+
+ Skew is expressed in ISO8601 duration notation.
+ </documentation>
+ </annotation>
+ </attribute>
+ <attribute name="required" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether this rule is required to be evaluated.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+ <complexType name="Replay">
+ <annotation>
+ <documentation>
+ A security policy rule that ensure a received SAML message has not already been processed.
+ </documentation>
+ </annotation>
+ <complexContent>
+ <extension base="sec:SecurityPolicyRuleType">
+ <attribute name="replayCacheRef" type="string" default="shibboleth.ReplayCache">
+ <annotation>
+ <documentation>Name of the replay cache to use.</documentation>
+ </annotation>
+ </attribute>
+ <attribute name="required" type="string">
+ <annotation>
+ <documentation>
+ A boolean flag indicating whether this rule is required to be evaluated.
+ </documentation>
+ </annotation>
+ </attribute>
+ </extension>
+ </complexContent>
+ </complexType>
+
+</schema>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list