[cpp-sp] branch main updated: Remove XML schemas and start baking in new configs.
Scott Cantor
cantor.2 at osu.edu
Tue Jan 28 15:10:42 UTC 2025
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch main
in repository cpp-sp.
View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=ac2224669e027cbcf58213f421378f2ce5f85aee
The following commit(s) were added to refs/heads/main by this push:
new ac222466 Remove XML schemas and start baking in new configs.
ac222466 is described below
commit ac2224669e027cbcf58213f421378f2ce5f85aee
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Jan 28 10:10:35 2025 -0500
Remove XML schemas and start baking in new configs.
---
.gitignore | 1 -
Makefile.am | 1 -
configs/Makefile.am | 21 +-
configs/accessError.html | 31 -
configs/apache24.config.in | 2 +-
configs/attribute-map.xml | 166 ---
configs/example-shibboleth2.xml | 290 -----
configs/handlers.ini | 4 +
configs/metadataError.html | 35 -
configs/request-map.xml | 9 +
configs/sessionError.html | 45 -
configs/shibboleth.ini | 28 +
configs/shibboleth2.xml | 106 --
configs/sslError.html | 33 -
configs/win-shibboleth2.xml | 155 ---
configure.ac | 5 +-
schemas/Makefile.am | 46 -
schemas/MetadataExchange.xsd | 112 --
schemas/WS-Trust.xsd | 113 --
schemas/catalog.xml.in | 21 -
schemas/oasis-200401-wss-wssecurity-secext-1.0.xsd | 195 ----
.../oasis-200401-wss-wssecurity-utility-1.0.xsd | 108 --
schemas/shibboleth-2.0-afp-mf-basic.xsd | 336 ------
schemas/shibboleth-2.0-afp-mf-saml.xsd | 381 -------
schemas/shibboleth-2.0-afp.xsd | 853 --------------
schemas/shibboleth-2.0-attribute-map.xsd | 358 ------
schemas/shibboleth-2.0-native-sp-config.xsd | 850 --------------
schemas/shibboleth-2.0-native-sp-protocols.xsd | 59 -
schemas/shibboleth-2.0-sp-notify.xsd | 64 --
schemas/shibboleth-3.0-native-sp-config.xsd | 908 ---------------
schemas/shibboleth-metadata-1.0.xsd | 42 -
schemas/shibboleth.xsd | 300 -----
schemas/ws-addr.xsd | 137 ---
schemas/ws-authorization.xsd | 145 ---
schemas/ws-federation.xsd | 471 --------
schemas/ws-securitypolicy-1.2.xsd | 1205 --------------------
shibsp/Makefile.am | 8 +-
shibsp/base.h | 6 -
shibsp/handler/impl/AbstractHandler.cpp | 4 +-
shibsp/handler/impl/SecuredHandler.cpp | 26 +-
shibsp/handler/impl/StatusHandler.cpp | 10 +-
shibsp/paths.h.in | 3 -
42 files changed, 65 insertions(+), 7628 deletions(-)
diff --git a/.gitignore b/.gitignore
index 4d077a30..b359f7bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -74,7 +74,6 @@ x64
/m4/lt~obsolete.m4
/m4/ltsugar.m4
/m4/libtool.m4
-/schemas/catalog.xml
/shibsp/config_pub.h
/shibsp/paths.h
/shibsp/stamp-h2
diff --git a/Makefile.am b/Makefile.am
index 3bcf4901..43564195 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -7,7 +7,6 @@ SUBDIRS = $(WANT_SUBDIRS)
DIST_SUBDIRS = \
doc \
- schemas \
configs \
shibsp \
apache \
diff --git a/configs/Makefile.am b/configs/Makefile.am
index f8626421..93ec5bc6 100644
--- a/configs/Makefile.am
+++ b/configs/Makefile.am
@@ -11,30 +11,18 @@ pkgsysconf_DATA = \
apache24.config \
seckeygen.sh
-# The config files are installed "special". Unlike the entries in
-# pkgsysconf_DATA, these files are installed as "foo.dist" and only
-# installed as "foo" if "foo" does not already exist. In other words,
-# the config files will not overwrite existing versions.
-BUILTCONFIGFILES = \
- native.logger
-
# While BUILTCONFIGFILES are processed, these are not; so we should pull
# them from SRCDIR.
CONFIGFILES = \
- shibboleth2.xml \
- attribute-map.xml \
- example-shibboleth2.xml \
- console.logger \
- native.logger \
attrChecker.html \
- sessionError.html \
- metadataError.html \
discoveryTemplate.html \
postTemplate.html \
localLogout.html \
globalLogout.html \
partialLogout.html \
- sslError.html
+ shiibboleth.ini \
+ handlers.ini \
+ request-map.xml
#
# Some of these need building
@@ -86,7 +74,4 @@ CLEANFILES = \
EXTRA_DIST = \
apache24.config.in \
seckeygen.bat \
- seckeygen.sh \
- win-shibboleth2.xml \
- win-native.logger \
$(CONFIGFILES)
diff --git a/configs/accessError.html b/configs/accessError.html
deleted file mode 100644
index 7e0a7fd7..00000000
--- a/configs/accessError.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html
- PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
- "DTD/xhtml1-strict.dtd">
-
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
-<head>
- <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
- <link rel="stylesheet" type="text/css" href="<shibmlp styleSheet/>" />
- <title>Authorization Failed</title>
-</head>
-
-<body>
-
-<shibmlpif logoLocation>
-<img src="<shibmlp logoLocation/>" alt="Logo" />
-</shibmlpif>
-<h1>Authorization Failed</h1>
-
-<p>
-Based on the information provided to this application about you, you are
-not authorized to access the resource at "<shibmlp requestURL/>"
-</p>
-
-<p>
-Please contact the administrator of this service or application if you
-believe this to be an error at <a href="mailto:<shibmlp supportContact/>"><shibmlp supportContact/></a>
-</p>
-
-</body>
-</html>
diff --git a/configs/apache24.config.in b/configs/apache24.config.in
index 56df4989..11d68753 100644
--- a/configs/apache24.config.in
+++ b/configs/apache24.config.in
@@ -10,7 +10,7 @@
#
# Load the Shibboleth module.
#
-LoadModule mod_shib @-PKGLIBDIR-@/mod_shib_24.so
+LoadModule shib_module @-PKGLIBDIR-@/mod_shib_24.so
#
# Turn this on to support "require valid-user" rules from other
diff --git a/configs/attribute-map.xml b/configs/attribute-map.xml
deleted file mode 100644
index 1a4a3b01..00000000
--- a/configs/attribute-map.xml
+++ /dev/null
@@ -1,166 +0,0 @@
-<Attributes xmlns="urn:mace:shibboleth:2.0:attribute-map" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
-
- <!--
- The mappings are a mix of SAML 1.1 and SAML 2.0 attribute names agreed to within the Shibboleth
- community. The non-OID URNs are SAML 1.1 names and most of the OIDs are SAML 2.0 names, with a
- few exceptions for newer attributes where the name is the same for both versions. You will
- usually want to uncomment or map the names for both SAML versions as a unit.
- -->
-
- <!-- New standard identifier attributes for SAML. -->
-
- <Attribute name="urn:oasis:names:tc:SAML:attribute:subject-id" id="subject-id">
- <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
- </Attribute>
-
- <Attribute name="urn:oasis:names:tc:SAML:attribute:pairwise-id" id="pairwise-id">
- <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
- </Attribute>
-
- <!-- The most typical eduPerson attributes. -->
-
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" id="eppn">
- <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonPrincipalName" id="eppn">
- <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
- </Attribute>
-
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" id="affiliation">
- <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonScopedAffiliation" id="affiliation">
- <AttributeDecoder xsi:type="ScopedAttributeDecoder" caseSensitive="false"/>
- </Attribute>
-
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" id="entitlement"/>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonEntitlement" id="entitlement"/>
-
- <!--
- Legacy pairwise identifier attribute / NameID format, intended to be replaced by the
- simpler pairwise-id attribute (see top of file).
- -->
-
- <!-- The eduPerson attribute version (note the OID-style name): -->
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" id="persistent-id">
- <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
- </Attribute>
-
- <!-- The SAML 2.0 NameID Format: -->
- <Attribute name="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" id="persistent-id">
- <AttributeDecoder xsi:type="NameIDAttributeDecoder" formatter="$NameQualifier!$SPNameQualifier!$Name" defaultQualifiers="true"/>
- </Attribute>
-
- <!-- Other eduPerson attributes (SAML 2 names followed by SAML 1 names)... -->
- <!--
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" id="assurance"/>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.5.1.1" id="member"/>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.1" id="eduCourseOffering"/>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.6.1.2" id="eduCourseMember"/>
-
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" id="unscoped-affiliation">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" id="primary-affiliation">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" id="nickname"/>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.8" id="primary-orgunit-dn"/>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" id="orgunit-dn"/>
- <Attribute name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" id="org-dn"/>
-
- <Attribute name="urn:mace:dir:attribute-def:eduPersonAffiliation" id="unscoped-affiliation">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryAffiliation" id="primary-affiliation">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonNickname" id="nickname"/>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonPrimaryOrgUnitDN" id="primary-orgunit-dn"/>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonOrgUnitDN" id="orgunit-dn"/>
- <Attribute name="urn:mace:dir:attribute-def:eduPersonOrgDN" id="org-dn"/>
- -->
-
- <!-- Older LDAP-defined attributes (SAML 2.0 names followed by SAML 1 names)... -->
- <!--
- <Attribute name="urn:oid:2.5.4.3" id="cn"/>
- <Attribute name="urn:oid:2.5.4.4" id="sn"/>
- <Attribute name="urn:oid:2.5.4.42" id="givenName"/>
- <Attribute name="urn:oid:2.16.840.1.113730.3.1.241" id="displayName"/>
- <Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="uid"/>
- <Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="mail"/>
- <Attribute name="urn:oid:2.5.4.20" id="telephoneNumber"/>
- <Attribute name="urn:oid:2.5.4.12" id="title"/>
- <Attribute name="urn:oid:2.5.4.43" id="initials"/>
- <Attribute name="urn:oid:2.5.4.13" id="description"/>
- <Attribute name="urn:oid:2.16.840.1.113730.3.1.1" id="carLicense"/>
- <Attribute name="urn:oid:2.16.840.1.113730.3.1.2" id="departmentNumber"/>
- <Attribute name="urn:oid:2.16.840.1.113730.3.1.3" id="employeeNumber"/>
- <Attribute name="urn:oid:2.16.840.1.113730.3.1.4" id="employeeType"/>
- <Attribute name="urn:oid:2.16.840.1.113730.3.1.39" id="preferredLanguage"/>
- <Attribute name="urn:oid:0.9.2342.19200300.100.1.10" id="manager"/>
- <Attribute name="urn:oid:2.5.4.34" id="seeAlso"/>
- <Attribute name="urn:oid:2.5.4.23" id="facsimileTelephoneNumber"/>
- <Attribute name="urn:oid:2.5.4.9" id="street"/>
- <Attribute name="urn:oid:2.5.4.18" id="postOfficeBox"/>
- <Attribute name="urn:oid:2.5.4.17" id="postalCode"/>
- <Attribute name="urn:oid:2.5.4.8" id="st"/>
- <Attribute name="urn:oid:2.5.4.7" id="l"/>
- <Attribute name="urn:oid:2.5.4.10" id="o"/>
- <Attribute name="urn:oid:2.5.4.11" id="ou"/>
- <Attribute name="urn:oid:2.5.4.15" id="businessCategory"/>
- <Attribute name="urn:oid:2.5.4.19" id="physicalDeliveryOfficeName"/>
-
- <Attribute name="urn:mace:dir:attribute-def:cn" id="cn"/>
- <Attribute name="urn:mace:dir:attribute-def:sn" id="sn"/>
- <Attribute name="urn:mace:dir:attribute-def:givenName" id="givenName"/>
- <Attribute name="urn:mace:dir:attribute-def:displayName" id="displayName"/>
- <Attribute name="urn:mace:dir:attribute-def:uid" id="uid"/>
- <Attribute name="urn:mace:dir:attribute-def:mail" id="mail"/>
- <Attribute name="urn:mace:dir:attribute-def:telephoneNumber" id="telephoneNumber"/>
- <Attribute name="urn:mace:dir:attribute-def:title" id="title"/>
- <Attribute name="urn:mace:dir:attribute-def:initials" id="initials"/>
- <Attribute name="urn:mace:dir:attribute-def:description" id="description"/>
- <Attribute name="urn:mace:dir:attribute-def:carLicense" id="carLicense"/>
- <Attribute name="urn:mace:dir:attribute-def:departmentNumber" id="departmentNumber"/>
- <Attribute name="urn:mace:dir:attribute-def:employeeNumber" id="employeeNumber"/>
- <Attribute name="urn:mace:dir:attribute-def:employeeType" id="employeeType"/>
- <Attribute name="urn:mace:dir:attribute-def:preferredLanguage" id="preferredLanguage"/>
- <Attribute name="urn:mace:dir:attribute-def:manager" id="manager"/>
- <Attribute name="urn:mace:dir:attribute-def:seeAlso" id="seeAlso"/>
- <Attribute name="urn:mace:dir:attribute-def:facsimileTelephoneNumber" id="facsimileTelephoneNumber"/>
- <Attribute name="urn:mace:dir:attribute-def:street" id="street"/>
- <Attribute name="urn:mace:dir:attribute-def:postOfficeBox" id="postOfficeBox"/>
- <Attribute name="urn:mace:dir:attribute-def:postalCode" id="postalCode"/>
- <Attribute name="urn:mace:dir:attribute-def:st" id="st"/>
- <Attribute name="urn:mace:dir:attribute-def:l" id="l"/>
- <Attribute name="urn:mace:dir:attribute-def:o" id="o"/>
- <Attribute name="urn:mace:dir:attribute-def:ou" id="ou"/>
- <Attribute name="urn:mace:dir:attribute-def:businessCategory" id="businessCategory"/>
- <Attribute name="urn:mace:dir:attribute-def:physicalDeliveryOfficeName" id="physicalDeliveryOfficeName"/>
- -->
-
- <!-- SCHAC attributes... -->
- <!--
- <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.9" id="schacHomeOrganization">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.10" id="schacHomeOrganizationType">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.14" id="schacPersonalUniqueCode">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.15" id="schacPersonalUniqueID"/>
- <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.19" id="schacUserStatus">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.20" id="schacProjectMembership">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- <Attribute name="urn:oid:1.3.6.1.4.1.25178.1.2.21" id="schacProjectSpecificRole">
- <AttributeDecoder xsi:type="StringAttributeDecoder" caseSensitive="false"/>
- </Attribute>
- -->
-
-</Attributes>
diff --git a/configs/example-shibboleth2.xml b/configs/example-shibboleth2.xml
deleted file mode 100644
index a79d9fbc..00000000
--- a/configs/example-shibboleth2.xml
+++ /dev/null
@@ -1,290 +0,0 @@
-<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
- xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
- xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
- clockSkew="180">
-
- <!-- The OutOfProcess section contains properties affecting the shibd daemon. -->
- <OutOfProcess logger="shibd.logger" tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a">
- <!--
- <Extensions>
- <Library path="odbc-store.so" fatal="true"/>
- </Extensions>
- -->
- </OutOfProcess>
-
- <!--
- The InProcess section contains settings affecting web server modules.
- Required for IIS, but can be removed when using other web servers.
- -->
- <InProcess logger="native.logger">
- <ISAPI normalizeRequest="true" safeHeaderNames="true">
- <!--
- Maps IIS Instance ID values to the host scheme/name/port. The name is
- required so that the proper <Host> in the request map above is found without
- having to cover every possible DNS/IP combination the user might enter.
- -->
- <Site id="1" name="sp.example.org"/>
- <!--
- When the port and scheme are omitted, the HTTP request's port and scheme are used.
- If these are wrong because of virtualization, they can be explicitly set here to
- ensure proper redirect generation.
- -->
- <!--
- <Site id="42" name="virtual.example.org" scheme="https" port="443"/>
- -->
- </ISAPI>
- </InProcess>
-
- <!-- Only one listener can be defined, to connect in-process modules to shibd. -->
- <UnixListener address="shibd.sock"/>
- <!-- <TCPListener address="127.0.0.1" port="1600" acl="127.0.0.1"/> -->
-
- <!-- This set of components stores sessions and other persistent data in daemon memory. -->
- <StorageService type="Memory" id="mem" cleanupInterval="900"/>
- <SessionCache type="StorageService" StorageService="mem" cacheAssertions="false"
- cacheAllowance="900" inprocTimeout="900" cleanupInterval="900"/>
- <ReplayCache StorageService="mem"/>
- <ArtifactMap artifactTTL="180"/>
-
- <!-- This set of components stores sessions and other persistent data in an ODBC database. -->
- <!--
- <StorageService type="ODBC" id="db" cleanupInterval="900">
- <ConnectionString>
- DRIVER=drivername;SERVER=dbserver;UID=shibboleth;PWD=password;DATABASE=shibboleth;APP=Shibboleth
- </ConnectionString>
- </StorageService>
- <SessionCache type="StorageService" StorageService="db" cacheAssertions="false"
- cacheTimeout="3600" inprocTimeout="900" cleanupInterval="900"/>
- <ReplayCache StorageService="db"/>
- <ArtifactMap StorageService="db" artifactTTL="180"/>
- -->
-
- <!--
- To customize behavior for specific resources on Apache, use web server options/commands
- instead of this mechanism, which is meant for IIS usage.
- -->
- <RequestMapper type="Native">
- <RequestMap>
- <!--
- The example requires a session for documents in /secure on the containing host with http and
- https on the default ports. Note that the name and port in the <Host> elements MUST match
- Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element above.
- -->
- <Host name="sp.example.org">
- <Path name="secure" authType="shibboleth" requireSession="true"/>
- </Host>
- <!-- Example of a second vhost mapped to a different applicationId. -->
- <!--
- <Host name="admin.example.org" applicationId="admin" authType="shibboleth" requireSession="true"/>
- -->
- </RequestMap>
- </RequestMapper>
-
- <!--
- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined.
- Resource requests are mapped by the RequestMapper to an applicationId that
- points into to this section (or to the defaults here).
- -->
- <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
- REMOTE_USER="eppn subject-id pairwise-id persistent-id"
- metadataAttributePrefix="Meta-"
- sessionHook="/Shibboleth.sso/AttrChecker"
- cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
-
- <!--
- Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
- Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
- and should be a relative path, with the SP computing the full value based on the virtual
- host. Using handlerSSL="true" will force the protocol to be https. You should also set
- cookieProps to "https" for SSL-only sites. Note that while we default checkAddress to
- "false", this makes an assertion stolen in transit easier for attackers to misuse.
- -->
- <Sessions lifetime="28800" timeout="3600" checkAddress="false"
- handlerURL="/Shibboleth.sso" handlerSSL="false" cookieProps="http" relayState="ss:mem"
- redirectLimit="exact"
- exportLocation="http://localhost/Shibboleth.sso/GetAssertion" exportACL="127.0.0.1"
- idpHistory="false" idpHistoryDays="7">
-
- <!--
- The "stripped down" files use the shorthand syntax for configuring handlers.
- This uses the old "every handler specified directly" syntax. You can supplement
- the new syntax following these examples but it is NOT advisable to use this
- approach wholesale.
- -->
-
- <!--
- SessionInitiators handle session requests and relay them to a Discovery page,
- or to an IdP if possible. Automatic/active session rules will use the default
- or first element (or requireSessionWith can specify a specific id to use).
- -->
-
- <!-- Default directs to a specific IdP. -->
- <SessionInitiator type="Chaining" Location="/Login" isDefault="true" id="Login"
- entityID="https://idp.example.org/idp/shibboleth">
-
- <SessionInitiator type="SAML2" template="bindingTemplate.html"/>
- <SessionInitiator type="Shib1"/>
-
- <!--
- To allow for >1 IdP, remove entityID property from Chaining element and add
- *either* of the SAMLDS or WAYF handlers below:
-
- <SessionInitiator type="SAMLDS" URL="https://ds.example.org/DS/WAYF"/>
- <SessionInitiator type="WAYF" URL="https://wayf.example.org/WAYF"/>
- -->
- </SessionInitiator>
-
- <!--
- md:AssertionConsumerService locations handle specific SSO protocol bindings,
- such as SAML 2.0 POST or SAML 1.1 Artifact. The isDefault and index attributes
- are used when sessions are initiated to determine how to tell the IdP where and
- how to return the response.
- -->
- <md:AssertionConsumerService Location="/SAML2/POST" index="1"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
- <md:AssertionConsumerService Location="/SAML2/POST-SimpleSign" index="2"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign"/>
- <md:AssertionConsumerService Location="/SAML2/Artifact" index="3"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
- <md:AssertionConsumerService Location="/SAML2/ECP" index="4"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS"/>
- <md:AssertionConsumerService Location="/SAML/POST" index="5"
- Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"/>
- <md:AssertionConsumerService Location="/SAML/Artifact" index="6"
- Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"/>
-
- <!-- LogoutInitiators enable SP-initiated local or global/single logout of sessions. -->
- <LogoutInitiator type="Chaining" Location="/Logout">
- <LogoutInitiator type="SAML2" template="bindingTemplate.html"/>
- <LogoutInitiator type="Local"/>
- </LogoutInitiator>
-
- <!-- Administrative logout, separate from user-driven logout above. -->
- <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
-
- <!-- md:SingleLogoutService locations handle single logout (SLO) protocol messages. -->
- <md:SingleLogoutService Location="/SLO/SOAP"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
- <md:SingleLogoutService Location="/SLO/Redirect" conf:template="bindingTemplate.html"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
- <md:SingleLogoutService Location="/SLO/POST" conf:template="bindingTemplate.html"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
- <md:SingleLogoutService Location="/SLO/Artifact" conf:template="bindingTemplate.html"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
-
- <!-- md:ManageNameIDService locations handle NameID management (NIM) protocol messages. -->
- <md:ManageNameIDService Location="/NIM/SOAP"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
- <md:ManageNameIDService Location="/NIM/Redirect" conf:template="bindingTemplate.html"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect"/>
- <md:ManageNameIDService Location="/NIM/POST" conf:template="bindingTemplate.html"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"/>
- <md:ManageNameIDService Location="/NIM/Artifact" conf:template="bindingTemplate.html"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact"/>
-
- <!--
- md:ArtifactResolutionService locations resolve artifacts issued when using the
- SAML 2.0 HTTP-Artifact binding on outgoing messages, generally uses SOAP.
- -->
- <md:ArtifactResolutionService Location="/Artifact/SOAP" index="1"
- Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP"/>
-
- <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
- <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
-
- <!-- Status reporting service. -->
- <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
-
- <!-- Session diagnostic service. -->
- <Handler type="Session" Location="/Session" showAttributeValues="false"/>
-
- <!-- JSON feed of discovery information. -->
- <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
-
- <!-- Checks for required attribute(s) before login completes. -->
- <Handler type="AttributeChecker" Location="/AttrChecker" template="attrChecker.html"
- attributes="eppn" flushSession="true"/>
- </Sessions>
-
- <!--
- Allows overriding of error template information/filenames. You can
- also add your own attributes with values that can be plugged into the
- templates, e.g., helpLocation below.
- -->
- <Errors supportContact="root at localhost"
- helpLocation="/about.html"
- styleSheet="/shibboleth-sp/main.css"/>
-
- <!--
- Uncomment and modify to tweak settings for specific IdPs or groups. Settings here
- generally match those allowed by the <ApplicationDefaults> element.
- -->
- <!--
- <RelyingParty Name="SpecialFederation" keyName="SpecialKey"/>
- -->
-
- <!-- Example of locally maintained metadata. -->
- <!--
- <MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
- -->
-
- <!-- Example of remotely supplied batch of signed metadata. -->
- <!--
- <MetadataProvider type="XML" validate="true"
- url="http://federation.org/federation-metadata.xml"
- backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/>
- <DiscoveryFilter type="Exclude" matcher="EntityAttributes" trimTags="true"
- attributeName="http://macedir.org/entity-category"
- attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
- attributeValue="http://refeds.org/category/hide-from-discovery" />
- </MetadataProvider>
- -->
-
- <!-- Example of remotely supplied "on-demand" signed metadata. -->
- <!--
- <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
- baseUrl="http://mdq.federation.org" ignoreTransport="true">
- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
- </MetadataProvider>
- -->
-
- <!-- TrustEngines run in order to evaluate peer keys and certificates. -->
- <TrustEngine type="ExplicitKey"/>
- <!-- <TrustEngine type="PKIX"/> -->
-
- <!-- Map to extract attributes from SAML assertions. -->
- <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
-
- <!-- Extracts support information for IdP from its metadata. -->
- <AttributeExtractor type="Metadata" errorURL="errorURL" DisplayName="displayName"/>
-
- <!-- Use a SAML query if no attributes are supplied during SSO. -->
- <AttributeResolver type="Query" subjectMatch="true"/>
-
- <!-- Simple file-based resolvers for separate signing/encryption keys. -->
- <CredentialResolver type="File" use="signing"
- key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
- <CredentialResolver type="File" use="encryption"
- key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
-
- <!--
- The default settings can be overridden by creating ApplicationOverride elements.
- Resource requests are mapped by web server commands, or the RequestMapper, to an
- applicationId setting.
-
- This "canonical" use case of overriding the SP's entityID alone is now obsolete;
- you can apply selfEntityID as a content setting based on host or path to control
- the SP's own identity.
-
- Avoid overrides: ask on the list or refer to the wiki for examples of how to do
- whatever you want to do without them.
- -->
- <!--
- <ApplicationOverride id="admin" entityID="https://admin.example.org/shibboleth"/>
- -->
- </ApplicationDefaults>
-
-</SPConfig>
diff --git a/configs/handlers.ini b/configs/handlers.ini
new file mode 100644
index 00000000..606fc329
--- /dev/null
+++ b/configs/handlers.ini
@@ -0,0 +1,4 @@
+[/Status]
+type = Status
+acl = 127.0.0.1 ::1
+
diff --git a/configs/metadataError.html b/configs/metadataError.html
deleted file mode 100644
index e0e6a1b0..00000000
--- a/configs/metadataError.html
+++ /dev/null
@@ -1,35 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html
- PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
- "DTD/xhtml1-strict.dtd">
-
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
-<head>
- <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
- <link rel="stylesheet" type="text/css" href="<shibmlp styleSheet/>" />
- <title>Unknown Identity Provider</title>
-</head>
-
-<body>
-
-<shibmlpif logoLocation>
-<img src="<shibmlp logoLocation/>" alt="Logo" />
-</shibmlpif>
-<h1>Unknown or Unusable Identity Provider</h1>
-
-<p>The identity provider supplying your login credentials is not authorized
-for use with this service or does not support the necessary capabilities.</p>
-
-<p>To report this problem, please contact the site administrator at
-<a href="mailto:<shibmlp supportContact/>"><shibmlp supportContact/></a>.
-</p>
-
-<p>Please include the following error message in any email:</p>
-<p class="error">Identity provider lookup failed at (<shibmlp requestURL/>)</p>
-<shibmlpif entityID>
-<p><strong>EntityID:</strong> <shibmlp entityID/></p>
-</shibmlpif>
-<p><shibmlp errorType/>: <shibmlp errorText/></p>
-
-</body>
-</html>
diff --git a/configs/request-map.xml b/configs/request-map.xml
new file mode 100644
index 00000000..40be73c4
--- /dev/null
+++ b/configs/request-map.xml
@@ -0,0 +1,9 @@
+<RequestMap>
+ <Host name="sp.example.org">
+ <Path name="secure">
+ <AccessControl>
+ <Rule require="user">jdoe</Rule>
+ </AccessControl>
+ </Path>
+ </Host>
+</RequestMap>
diff --git a/configs/sessionError.html b/configs/sessionError.html
deleted file mode 100644
index 7ccf17be..00000000
--- a/configs/sessionError.html
+++ /dev/null
@@ -1,45 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html
- PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
- "DTD/xhtml1-strict.dtd">
-
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
-<head>
- <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
- <link rel="stylesheet" type="text/css" href="<shibmlp styleSheet/>" />
- <title><shibmlp errorType/></title>
-</head>
-
-<body>
-
-<shibmlpif logoLocation>
-<img src="<shibmlp logoLocation/>" alt="Logo" />
-</shibmlpif>
-<h1><shibmlp errorType/></h1>
-
-<p>The system encountered an error at <shibmlp now /></p>
-
-<p>To report this problem, please contact the site administrator at
-<a href="mailto:<shibmlp supportContact/>"><shibmlp supportContact/></a>.
-</p>
-
-<p>Please include the following message in any email:</p>
-<p class="error"><shibmlp errorType/> at (<shibmlp requestURL/>)</p>
-
-<p><shibmlp errorText/></p>
-
-<shibmlpif statusCode>
- <p>Error from identity provider:</p>
- <blockquote>
- <strong>Status:</strong> <shibmlp statusCode/><br>
- <shibmlpif statusCode2>
- <strong>Sub-Status:</strong> <shibmlp statusCode2/><br/>
- </shibmlpif>
- <shibmlpif statusMessage>
- <strong>Message:</strong> <shibmlp statusMessage/><br/>
- </shibmlpif>
- </blockquote>
-</shibmlpif>
-
-</body>
-</html>
diff --git a/configs/shibboleth.ini b/configs/shibboleth.ini
new file mode 100644
index 00000000..9e6957c8
--- /dev/null
+++ b/configs/shibboleth.ini
@@ -0,0 +1,28 @@
+[global]
+
+
+[logging]
+
+
+[logging-categories]
+;Shibboleth.RequestMapper = DEBUG
+;Shibboleth.RemotingService = DEBUG
+;Shibboleth.libcurl = DEBUG
+
+
+[remoting]
+baseURL = https://localhost/idp/profile/sp
+agentID = sp.example.org
+authMethod = basic
+authCachingCookie = __Host-JSESSIONID
+tlsCAFile = trustfile.pem
+secretSourceType = File
+secretFile = agent.pwd
+
+[session-cache]
+type = Filesystem
+
+[request-map]
+path = request-map.xml
+reloadChanges = true
+
diff --git a/configs/shibboleth2.xml b/configs/shibboleth2.xml
deleted file mode 100644
index 50ec978c..00000000
--- a/configs/shibboleth2.xml
+++ /dev/null
@@ -1,106 +0,0 @@
-<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
- xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
- clockSkew="180">
-
- <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
-
- <!--
- By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
- are used. See example-shibboleth2.xml for samples of explicitly configuring them.
- -->
-
- <!-- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined. -->
- <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
- REMOTE_USER="eppn subject-id pairwise-id persistent-id"
- cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
-
- <!--
- Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
- Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
- and should be a relative path, with the SP computing the full value based on the virtual
- host. Use of TLS is now assumed because browsers are enforcing it due to SameSite
- restrictions. Note that while we default checkAddress to "false", this makes an assertion
- stolen in transit easier for attackers to misuse.
- -->
- <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
- checkAddress="false" handlerSSL="true" cookieProps="https"
- redirectLimit="exact">
-
- <!--
- Configures SSO for a default IdP. To properly allow for >1 IdP, remove
- entityID property and adjust discoveryURL to point to discovery service.
- You can also override entityID on /Login query string, or in RequestMap/htaccess.
- -->
- <SSO entityID="https://idp.example.org/idp/shibboleth"
- discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
- SAML2
- </SSO>
-
- <!-- SAML and local-only logout. -->
- <Logout>SAML2 Local</Logout>
-
- <!-- Administrative logout. -->
- <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
-
- <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
- <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
-
- <!-- Status reporting service. -->
- <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
-
- <!-- Session diagnostic service. -->
- <Handler type="Session" Location="/Session" showAttributeValues="false"/>
-
- <!-- JSON feed of discovery information. -->
- <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
- </Sessions>
-
- <!--
- Allows overriding of error template information/filenames. You can
- also add your own attributes with values that can be plugged into the
- templates, e.g., helpLocation below.
- -->
- <Errors supportContact="root at localhost"
- helpLocation="/about.html"
- styleSheet="/shibboleth-sp/main.css"/>
-
- <!-- Example of locally maintained metadata. -->
- <!--
- <MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
- -->
-
- <!-- Example of remotely supplied batch of signed metadata. -->
- <!--
- <MetadataProvider type="XML" validate="true"
- url="http://federation.org/federation-metadata.xml"
- backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/>
- <DiscoveryFilter type="Exclude" matcher="EntityAttributes" trimTags="true"
- attributeName="http://macedir.org/entity-category"
- attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
- attributeValue="http://refeds.org/category/hide-from-discovery" />
- </MetadataProvider>
- -->
-
- <!-- Example of remotely supplied "on-demand" signed metadata. -->
- <!--
- <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
- baseUrl="http://mdq.federation.org" ignoreTransport="true">
- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
- </MetadataProvider>
- -->
-
- <!-- Map to extract attributes from SAML assertions. -->
- <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
-
- <!-- Simple file-based resolvers for separate signing/encryption keys. -->
- <CredentialResolver type="File" use="signing"
- key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
- <CredentialResolver type="File" use="encryption"
- key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
-
- </ApplicationDefaults>
-
-</SPConfig>
diff --git a/configs/sslError.html b/configs/sslError.html
deleted file mode 100644
index 367366a6..00000000
--- a/configs/sslError.html
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE html
- PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
- "DTD/xhtml1-strict.dtd">
-
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
-<head>
- <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
- <link rel="stylesheet" type="text/css" href="<shibmlp styleSheet/>" />
- <title>POST Failed</title>
-</head>
-
-<body>
-
-<shibmlpif logoLocation>
-<img src="<shibmlp logoLocation/>" alt="Logo" />
-</shibmlpif>
-<h1>POST Failed</h1>
-
-<p>
-You have attemped to submit information without the protection
-of TLS to this site.<br/>
-</p>
-
-<p>
-For the protection of your submission and the integrity of the site,
-this is not permitted. Please try accessing the server with a
-URL starting with <strong>https://</strong> and report this problem
-to <a href="mailto:<shibmlp supportContact/>"><shibmlp supportContact/></a>
-</p>
-
-</body>
-</html>
diff --git a/configs/win-shibboleth2.xml b/configs/win-shibboleth2.xml
deleted file mode 100644
index 28f24810..00000000
--- a/configs/win-shibboleth2.xml
+++ /dev/null
@@ -1,155 +0,0 @@
-<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config"
- xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
- clockSkew="180">
-
- <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" />
-
- <!--
- The InProcess section contains settings affecting web server modules.
- Required for IIS, but can be removed when using other web servers.
- -->
- <InProcess>
- <ISAPI normalizeRequest="true" safeHeaderNames="true">
- <!--
- Maps IIS Instance ID values to the host scheme/name/port. The name is
- required so that the proper <Host> in the request map above is found without
- having to cover every possible DNS/IP combination the user might enter.
- -->
- <Site id="1" name="sp.example.org"/>
- <!--
- When the port and scheme are omitted, the HTTP request's port and scheme are used.
- If these are wrong because of virtualization, they can be explicitly set here to
- ensure proper redirect generation.
- -->
- <!--
- <Site id="42" name="virtual.example.org" scheme="https" port="443"/>
- -->
- </ISAPI>
- </InProcess>
-
- <!--
- By default, in-memory StorageService, ReplayCache, ArtifactMap, and SessionCache
- are used. See example-shibboleth2.xml for samples of explicitly configuring them.
- -->
-
- <!--
- To customize behavior for specific resources on IIS, use the XML syntax below.
- Apache users should rely on web server options/commands in most cases, and can remove the
- RequestMapper element.
- -->
- <RequestMapper type="Native">
- <RequestMap>
- <!--
- The example requires a session for documents in /secure on the containing host with http and
- https on the default ports. Note that the name and port in the <Host> elements MUST match
- Apache's ServerName and Port directives or the IIS Site name in the <ISAPI> element above.
- -->
- <Host name="sp.example.org">
- <Path name="secure" authType="shibboleth" requireSession="true"/>
- </Host>
- <!-- Example of a second vhost mapped to a different applicationId. -->
- <!--
- <Host name="admin.example.org" applicationId="admin" authType="shibboleth" requireSession="true"/>
- -->
- </RequestMap>
- </RequestMapper>
-
- <!--
- The ApplicationDefaults element is where most of Shibboleth's SAML bits are defined.
- With IIS, resource requests are mapped by the RequestMapper to an applicationId that
- points into to this section (or to the defaults here).
- -->
- <ApplicationDefaults entityID="https://sp.example.org/shibboleth"
- REMOTE_USER="eppn subject-id pairwise-id persistent-id"
- cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1">
-
- <!--
- Controls session lifetimes, address checks, cookie handling, and the protocol handlers.
- Each Application has an effectively unique handlerURL, which defaults to "/Shibboleth.sso"
- and should be a relative path, with the SP computing the full value based on the virtual
- host. Use of TLS is now assumed because browsers are enforcing it due to SameSite
- restrictions. Note that while we default checkAddress to "false", this makes an assertion
- stolen in transit easier for attackers to misuse.
- -->
- <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
- checkAddress="false" handlerSSL="true" cookieProps="https"
- redirectLimit="exact">
-
- <!--
- Configures SSO for a default IdP. To properly allow for >1 IdP, remove
- entityID property and adjust discoveryURL to point to discovery service.
- You can also override entityID on /Login query string, or in RequestMap/htaccess.
- -->
- <SSO entityID="https://idp.example.org/idp/shibboleth"
- discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF">
- SAML2
- </SSO>
-
- <!-- SAML and local-only logout. -->
- <Logout>SAML2 Local</Logout>
-
- <!-- Administrative logout. -->
- <LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" />
-
- <!-- Extension service that generates "approximate" metadata based on SP configuration. -->
- <Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>
-
- <!-- Status reporting service. -->
- <Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/>
-
- <!-- Session diagnostic service. -->
- <Handler type="Session" Location="/Session" showAttributeValues="false"/>
-
- <!-- JSON feed of discovery information. -->
- <Handler type="DiscoveryFeed" Location="/DiscoFeed"/>
- </Sessions>
-
- <!--
- Allows overriding of error template information/filenames. You can
- also add your own attributes with values that can be plugged into the
- templates, e.g., helpLocation below.
- -->
- <Errors supportContact="root at localhost"
- helpLocation="/about.html"
- styleSheet="/shibboleth-sp/main.css"/>
-
- <!-- Example of locally maintained metadata. -->
- <!--
- <MetadataProvider type="XML" validate="true" path="partner-metadata.xml"/>
- -->
-
- <!-- Example of remotely supplied batch of signed metadata. -->
- <!--
- <MetadataProvider type="XML" validate="true"
- url="http://federation.org/federation-metadata.xml"
- backingFilePath="federation-metadata.xml" maxRefreshDelay="7200">
- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="fedsigner.pem" verifyBackup="false"/>
- <DiscoveryFilter type="Exclude" matcher="EntityAttributes" trimTags="true"
- attributeName="http://macedir.org/entity-category"
- attributeNameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"
- attributeValue="http://refeds.org/category/hide-from-discovery" />
- </MetadataProvider>
- -->
-
- <!-- Example of remotely supplied "on-demand" signed metadata. -->
- <!--
- <MetadataProvider type="MDQ" validate="true" cacheDirectory="mdq"
- baseUrl="http://mdq.federation.org" ignoreTransport="true">
- <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
- <MetadataFilter type="Signature" certificate="mdqsigner.pem" />
- </MetadataProvider>
- -->
-
- <!-- Map to extract attributes from SAML assertions. -->
- <AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/>
-
- <!-- Simple file-based resolvers for separate signing/encryption keys. -->
- <CredentialResolver type="File" use="signing"
- key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/>
- <CredentialResolver type="File" use="encryption"
- key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/>
-
- </ApplicationDefaults>
-
-</SPConfig>
diff --git a/configure.ac b/configure.ac
index d1cbe566..61717ccc 100644
--- a/configure.ac
+++ b/configure.ac
@@ -132,9 +132,8 @@ else
fi
# output the underlying makefiles
-WANT_SUBDIRS="doc schemas configs shibsp"
-AC_CONFIG_FILES([Makefile doc/Makefile schemas/Makefile \
- configs/Makefile shibsp/Makefile])
+WANT_SUBDIRS="doc configs shibsp"
+AC_CONFIG_FILES([Makefile doc/Makefile configs/Makefile shibsp/Makefile])
#
# Build FastCGI support?
diff --git a/schemas/Makefile.am b/schemas/Makefile.am
deleted file mode 100644
index 1d48507f..00000000
--- a/schemas/Makefile.am
+++ /dev/null
@@ -1,46 +0,0 @@
-AUTOMAKE_OPTIONS = foreign
-
-pkgxmldir = $(datadir)/xml/@PACKAGE_NAME@
-
-schemafiles = \
- shibboleth.xsd \
- shibboleth-metadata-1.0.xsd \
- shibboleth-3.0-native-sp-config.xsd \
- shibboleth-2.0-native-sp-config.xsd \
- shibboleth-2.0-native-sp-protocols.xsd \
- shibboleth-2.0-sp-notify.xsd \
- shibboleth-2.0-afp.xsd \
- shibboleth-2.0-afp-mf-basic.xsd \
- shibboleth-2.0-afp-mf-saml.xsd \
- shibboleth-2.0-attribute-map.xsd \
- WS-Trust.xsd \
- MetadataExchange.xsd \
- oasis-200401-wss-wssecurity-secext-1.0.xsd \
- oasis-200401-wss-wssecurity-utility-1.0.xsd \
- ws-addr.xsd \
- ws-authorization.xsd \
- ws-federation.xsd \
- ws-securitypolicy-1.2.xsd
-
-
-pkgxml_DATA = \
- catalog.xml \
- $(schemafiles)
-
-#
-# Some of these need building
-#
-do-build-file:
- rm -f ${FILE}.tmp
- sed < ${srcdir}/${FILE}.in > ${FILE}.tmp \
- -e 's:@-PKGXMLDIR-@:${pkgxmldir}:g'
- cmp -s ${FILE} ${FILE}.tmp || mv ${FILE}.tmp ${FILE}
- rm -f ${FILE}.tmp
-
-catalog.xml: ${srcdir}/catalog.xml.in Makefile ${top_builddir}/config.status
- $(MAKE) do-build-file FILE=$@
-
-CLEANFILES = catalog.xml
-
-EXTRA_DIST = catalog.xml.in \
- $(schemafiles)
diff --git a/schemas/MetadataExchange.xsd b/schemas/MetadataExchange.xsd
deleted file mode 100644
index 06d2a6fd..00000000
--- a/schemas/MetadataExchange.xsd
+++ /dev/null
@@ -1,112 +0,0 @@
-<?xml version='1.0' encoding='UTF-8' ?>
-<!--
-(c) 2004-2006 BEA Systems Inc., Computer Associates International, Inc.,
-International Business Machines Corporation, Microsoft Corporation,
-Inc., SAP AG, Sun Microsystems, and webMethods. All rights reserved.
-
-Permission to copy and display the WS-MetadataExchange Specification
-(the "Specification"), in any medium without fee or royalty is hereby
-granted, provided that you include the following on ALL copies of the
-Specification that you make:
-
-1. A link or URL to the Specification at this location.
-2. The copyright notice as shown in the Specification.
-
-BEA Systems, Computer Associates, IBM, Microsoft, SAP, Sun, and
-webMethods (collectively, the "Authors") each agree to grant you a
-license, under royalty-free and otherwise reasonable,
-non-discriminatory terms and conditions, to their respective essential
-patent claims that they deem necessary to implement the
-WS-MetadataExchange Specification.
-
-THE SPECIFICATION IS PROVIDED "AS IS," AND THE AUTHORS MAKE NO
-REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT
-LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
-PURPOSE, NON-INFRINGEMENT, OR TITLE; THAT THE CONTENTS OF THE
-SPECIFICATION ARE SUITABLE FOR ANY PURPOSE; NOR THAT THE
-IMPLEMENTATION OF SUCH CONTENTS WILL NOT INFRINGE ANY THIRD PARTY
-PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS.
-
-THE AUTHORS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL,
-INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO ANY
-USE OR DISTRIBUTION OF THE SPECIFICATIONS.
-
-The name and trademarks of the Authors may NOT be used in any manner,
-including advertising or publicity pertaining to the Specifications or
-their contents without specific, written prior permission. Title to
-copyright in the Specifications will at all times remain with the
-Authors.
-
-No other rights are granted by implication, estoppel or otherwise.
--->
-
-<xs:schema
- targetNamespace='http://schemas.xmlsoap.org/ws/2004/09/mex'
- xmlns:tns='http://schemas.xmlsoap.org/ws/2004/09/mex'
- xmlns:wsa10='http://www.w3.org/2005/08/addressing'
- xmlns:wsa04='http://schemas.xmlsoap.org/ws/2004/08/addressing'
- xmlns:xs='http://www.w3.org/2001/XMLSchema'
- elementFormDefault='qualified'
- blockDefault='#all' >
-
- <!-- Get Metadata request -->
- <xs:element name='GetMetadata' >
- <xs:complexType>
- <xs:sequence>
- <xs:element ref='tns:Dialect' minOccurs='0' />
- <xs:element ref='tns:Identifier' minOccurs='0' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
- </xs:element>
-
- <xs:element name='Dialect' type='xs:anyURI' />
- <xs:element name='Identifier' type='xs:anyURI' />
-
- <!-- Get Metadata response -->
- <xs:element name='Metadata' >
- <xs:complexType>
- <xs:sequence>
- <xs:element ref='tns:MetadataSection'
- minOccurs='0'
- maxOccurs='unbounded' />
- <xs:any namespace='##other' processContents='lax'
- minOccurs='0'
- maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
- </xs:element>
-
- <xs:element name='MetadataSection' >
- <xs:complexType>
- <xs:choice>
- <xs:any namespace='##other' processContents='lax' />
- <xs:element ref='tns:MetadataReference' />
- <xs:element ref='tns:Location' />
- </xs:choice>
- <xs:attribute name='Dialect' type='xs:anyURI' use='required' />
- <xs:attribute name='Identifier' type='xs:anyURI' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
- </xs:element>
-
- <!--
- Ideally, the type of the MetadataReference would have been
- the union of wsa04:EndpointReferenceType and
- wsa10:EndpointReferenceType but unfortunately xs:union only
- works for simple types. As a result, we have to define
- the mex:MetadataReference using xs:any.
- -->
-
- <xs:element name='MetadataReference'>
- <xs:complexType>
- <xs:sequence>
- <xs:any minOccurs='1' maxOccurs='unbounded'
- processContents='lax' namespace='##other' />
- </xs:sequence>
- </xs:complexType>
- </xs:element>
- <xs:element name='Location'
- type='xs:anyURI' />
-</xs:schema>
diff --git a/schemas/WS-Trust.xsd b/schemas/WS-Trust.xsd
deleted file mode 100644
index d1e2a9f5..00000000
--- a/schemas/WS-Trust.xsd
+++ /dev/null
@@ -1,113 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-
-<!--
-Modified copy of WS-Trust schema that only contains WS-Fed PRP-relevant content.
- -->
-
-<!--
-
-Copyright Notice
-
-(c) 2001-2005 Actional Corporation, BEA Systems, Inc.,
-Computer Associates International, Inc., International Business Machines Corporation,
-Layer 7 Technologies, Microsoft Corporation, Netegrity, Inc., Oblix Inc.,
-OpenNetwork Technologies Inc., Ping Identity Corporation, Reactivity Inc.,
-RSA Security Inc., and VeriSign Inc.
-All rights reserved.
-
-Permission to copy and display the WS-Trust Specification (the "Specification", which
-includes WSDL and schema documents), in any medium without fee or royalty
-is hereby granted, provided that you include the following on ALL copies of the
-Specification, that you make:
-
-1. A link or URL to the Specification at one of the Authors' websites
-2. The copyright notice as shown in the Specification.
-
-IBM, Microsoft and Actional, BEA, Computer Associates, Layer 7, Netegrity, Oblix,
-OpenNetwork, Ping Identity, Reactivity, and Verisign (collectively, the "Authors") each
-agree to grant you a license, under royalty-free and otherwise reasonable,
-non-discriminatory terms and conditions, to their respective essential patent claims
-that they deem necessary to implement the Specification.
-
-THE SPECIFICATION IS PROVIDED "AS IS," AND THE AUTHORS MAKE
-NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT
-NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
-PARTICULAR PURPOSE, NON-INFRINGEMENT, OR TITLE; THAT THE CONTENTS OF
-THE SPECIFICATION ARE SUITABLE FOR ANY PURPOSE; NOR THAT THE
-IMPLEMENTATION OF SUCH CONTENTS WILL NOT INFRINGE ANY THIRD PARTY
-PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS.
-
-THE AUTHORS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL,
-INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO ANY
-USE OR DISTRIBUTION OF THE SPECIFICATION.
-
-The name and trademarks of the Authors may NOT be used in any manner,
-including advertising or publicity pertaining to the Specification or
-its contents without specific, written prior permission. Title to
-copyright in the Specification will at all times remain with the Authors.
-
-No other rights are granted by implication, estoppel or otherwise.
-
--->
-<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'
- xmlns:wst='http://schemas.xmlsoap.org/ws/2005/02/trust'
- targetNamespace='http://schemas.xmlsoap.org/ws/2005/02/trust'
- elementFormDefault='qualified' >
-
- <!-- WS-Trust Section 5.2 -->
- <xs:element name='RequestSecurityTokenResponse' type='wst:RequestSecurityTokenResponseType' />
- <xs:complexType name='RequestSecurityTokenResponseType' >
- <xs:annotation>
- <xs:documentation>
- Actual content model is non-deterministic, hence wildcard. The following shows intended content model:
-
- <xs:element ref='wst:TokenType' minOccurs='0' />
- <xs:element ref='wst:RequestType' />
- <xs:element ref='wst:RequestedSecurityToken' minOccurs='0' />
- <xs:element ref='wsp:AppliesTo' minOccurs='0' />
- <xs:element ref='wst:RequestedAttachedReference' minOccurs='0' />
- <xs:element ref='wst:RequestedUnattachedReference' minOccurs='0' />
- <xs:element ref='wst:RequestedProofToken' minOccurs='0' />
- <xs:element ref='wst:Entropy' minOccurs='0' />
- <xs:element ref='wst:Lifetime' minOccurs='0' />
- <xs:element ref='wst:Status' minOccurs='0' />
- <xs:element ref='wst:AllowPostdating' minOccurs='0' />
- <xs:element ref='wst:Renewing' minOccurs='0' />
- <xs:element ref='wst:OnBehalfOf' minOccurs='0' />
- <xs:element ref='wst:Issuer' minOccurs='0' />
- <xs:element ref='wst:AuthenticationType' minOccurs='0' />
- <xs:element ref='wst:Authenticator' minOccurs='0' />
- <xs:element ref='wst:KeyType' minOccurs='0' />
- <xs:element ref='wst:KeySize' minOccurs='0' />
- <xs:element ref='wst:SignatureAlgorithm' minOccurs='0' />
- <xs:element ref='wst:Encryption' minOccurs='0' />
- <xs:element ref='wst:EncryptionAlgorithm' minOccurs='0' />
- <xs:element ref='wst:CanonicalizationAlgorithm' minOccurs='0' />
- <xs:element ref='wst:ProofEncryption' minOccurs='0' />
- <xs:element ref='wst:UseKey' minOccurs='0' />
- <xs:element ref='wst:SignWith' minOccurs='0' />
- <xs:element ref='wst:EncryptWith' minOccurs='0' />
- <xs:element ref='wst:DelegateTo' minOccurs='0' />
- <xs:element ref='wst:Forwardable' minOccurs='0' />
- <xs:element ref='wst:Delegatable' minOccurs='0' />
- <xs:element ref='wsp:Policy' minOccurs='0' />
- <xs:element ref='wsp:PolicyReference' minOccurs='0' />
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
-
- </xs:documentation>
- </xs:annotation>
- <xs:sequence>
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:attribute name='Context' type='xs:anyURI' use='optional' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:element name='RequestedSecurityToken' type='wst:RequestedSecurityTokenType' />
- <xs:complexType name='RequestedSecurityTokenType' >
- <xs:sequence>
- <xs:any namespace='##any' processContents='lax' />
- </xs:sequence>
- </xs:complexType>
-
-</xs:schema>
diff --git a/schemas/catalog.xml.in b/schemas/catalog.xml.in
deleted file mode 100644
index 69fb26a3..00000000
--- a/schemas/catalog.xml.in
+++ /dev/null
@@ -1,21 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
- <system systemId="urn:mace:shibboleth:metadata:1.0" uri="@-PKGXMLDIR-@/shibboleth-metadata-1.0.xsd"/>
- <system systemId="urn:mace:shibboleth:3.0:native:sp:config" uri="@-PKGXMLDIR-@/shibboleth-3.0-native-sp-config.xsd"/>
- <system systemId="urn:mace:shibboleth:2.0:native:sp:config" uri="@-PKGXMLDIR-@/shibboleth-2.0-native-sp-config.xsd"/>
- <system systemId="urn:mace:shibboleth:2.0:native:sp:protocols" uri="@-PKGXMLDIR-@/shibboleth-2.0-native-sp-protocols.xsd"/>
- <system systemId="urn:mace:shibboleth:2.0:sp:notify" uri="@-PKGXMLDIR-@/shibboleth-2.0-sp-notify.xsd"/>
- <system systemId="urn:mace:shibboleth:2.0:afp" uri="@-PKGXMLDIR-@/shibboleth-2.0-afp.xsd"/>
- <system systemId="urn:mace:shibboleth:2.0:afp:mf:basic" uri="@-PKGXMLDIR-@/shibboleth-2.0-afp-mf-basic.xsd"/>
- <system systemId="urn:mace:shibboleth:2.0:afp:mf:saml" uri="@-PKGXMLDIR-@/shibboleth-2.0-afp-mf-saml.xsd"/>
- <system systemId="urn:mace:shibboleth:2.0:attribute-map" uri="@-PKGXMLDIR-@/shibboleth-2.0-attribute-map.xsd"/>
- <system systemId="urn:mace:shibboleth:1.0" uri="@-PKGXMLDIR-@/shibboleth.xsd"/>
- <system systemId="http://schemas.xmlsoap.org/ws/2005/02/trust" uri="@-PKGXMLDIR-@/WS-Trust.xsd"/>
- <system systemId="http://schemas.xmlsoap.org/ws/2004/09/mex" uri="@-PKGXMLDIR-@/MetadataExchange.xsd"/>
- <system systemId="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" uri="@-PKGXMLDIR-@/oasis-200401-wss-wssecurity-secext-1.0.xsd"/>
- <system systemId="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" uri="@-PKGXMLDIR-@/oasis-200401-wss-wssecurity-utility-1.0.xsd"/>
- <system systemId="http://www.w3.org/2005/08/addressing" uri="@-PKGXMLDIR-@/ws-addr.xsd"/>
- <system systemId="http://docs.oasis-open.org/wsfed/authorization/200706" uri="@-PKGXMLDIR-@/ws-authorization.xsd"/>
- <system systemId="http://docs.oasis-open.org/wsfed/federation/200706" uri="@-PKGXMLDIR-@/ws-federation.xsd"/>
- <system systemId="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702" uri="@-PKGXMLDIR-@/ws-securitypolicy-1.2.xsd"/>
-</catalog>
diff --git a/schemas/oasis-200401-wss-wssecurity-secext-1.0.xsd b/schemas/oasis-200401-wss-wssecurity-secext-1.0.xsd
deleted file mode 100644
index 78a73ef8..00000000
--- a/schemas/oasis-200401-wss-wssecurity-secext-1.0.xsd
+++ /dev/null
@@ -1,195 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS's procedures with respect to rights in OASIS specifications can be found at the OASIS website. [...]
-OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
-Copyright © OASIS Open 2002-2004. All Rights Reserved.
-This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself does not be modified in any way, such as by removing the copyright notice [...]
-The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
-This document and the information contained herein is provided on an “AS IS” basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
--->
-<xsd:schema targetNamespace="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:xsd="http://www.w3.org/2001/XMLSche [...]
- <xsd:import namespace="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" schemaLocation="oasis-200401-wss-wssecurity-utility-1.0.xsd"/>
- <xsd:import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="xml.xsd"/>
- <xsd:import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
- <xsd:complexType name="AttributedString">
- <xsd:annotation>
- <xsd:documentation>This type represents an element with arbitrary attributes.</xsd:documentation>
- </xsd:annotation>
- <xsd:simpleContent>
- <xsd:extension base="xsd:string">
- <xsd:attribute ref="wsu:Id"/>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:extension>
- </xsd:simpleContent>
- </xsd:complexType>
- <xsd:complexType name="PasswordString">
- <xsd:annotation>
- <xsd:documentation>This type is used for password elements per Section 4.1.</xsd:documentation>
- </xsd:annotation>
- <xsd:simpleContent>
- <xsd:extension base="wsse:AttributedString">
- <xsd:attribute name="Type" type="xsd:anyURI"/>
- </xsd:extension>
- </xsd:simpleContent>
- </xsd:complexType>
- <xsd:complexType name="EncodedString">
- <xsd:annotation>
- <xsd:documentation>This type is used for elements containing stringified binary data.</xsd:documentation>
- </xsd:annotation>
- <xsd:simpleContent>
- <xsd:extension base="wsse:AttributedString">
- <xsd:attribute name="EncodingType" type="xsd:anyURI"/>
- </xsd:extension>
- </xsd:simpleContent>
- </xsd:complexType>
- <xsd:complexType name="UsernameTokenType">
- <xsd:annotation>
- <xsd:documentation>This type represents a username token per Section 4.1</xsd:documentation>
- </xsd:annotation>
- <xsd:sequence>
- <xsd:element name="Username" type="wsse:AttributedString"/>
- <xsd:any processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </xsd:sequence>
- <xsd:attribute ref="wsu:Id"/>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:complexType>
- <xsd:complexType name="BinarySecurityTokenType">
- <xsd:annotation>
- <xsd:documentation>A security token that is encoded in binary</xsd:documentation>
- </xsd:annotation>
- <xsd:simpleContent>
- <xsd:extension base="wsse:EncodedString">
- <xsd:attribute name="ValueType" type="xsd:anyURI"/>
- </xsd:extension>
- </xsd:simpleContent>
- </xsd:complexType>
- <xsd:complexType name="KeyIdentifierType">
- <xsd:annotation>
- <xsd:documentation>A security token key identifier</xsd:documentation>
- </xsd:annotation>
- <xsd:simpleContent>
- <xsd:extension base="wsse:EncodedString">
- <xsd:attribute name="ValueType" type="xsd:anyURI"/>
- </xsd:extension>
- </xsd:simpleContent>
- </xsd:complexType>
- <xsd:simpleType name="tUsage">
- <xsd:annotation>
- <xsd:documentation>Typedef to allow a list of usages (as URIs).</xsd:documentation>
- </xsd:annotation>
- <xsd:list itemType="xsd:anyURI"/>
- </xsd:simpleType>
- <xsd:attribute name="Usage" type="tUsage">
- <xsd:annotation>
- <xsd:documentation>This global attribute is used to indicate the usage of a referenced or indicated token within the containing context</xsd:documentation>
- </xsd:annotation>
- </xsd:attribute>
- <xsd:complexType name="ReferenceType">
- <xsd:annotation>
- <xsd:documentation>This type represents a reference to an external security token.</xsd:documentation>
- </xsd:annotation>
- <xsd:attribute name="URI" type="xsd:anyURI"/>
- <xsd:attribute name="ValueType" type="xsd:anyURI"/>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:complexType>
- <xsd:complexType name="EmbeddedType">
- <xsd:annotation>
- <xsd:documentation>This type represents a reference to an embedded security token.</xsd:documentation>
- </xsd:annotation>
- <xsd:choice minOccurs="0" maxOccurs="unbounded">
- <xsd:any processContents="lax"/>
- </xsd:choice>
- <xsd:attribute name="ValueType" type="xsd:anyURI"/>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:complexType>
- <xsd:complexType name="SecurityTokenReferenceType">
- <xsd:annotation>
- <xsd:documentation>This type is used reference a security token.</xsd:documentation>
- </xsd:annotation>
- <xsd:choice minOccurs="0" maxOccurs="unbounded">
- <xsd:any processContents="lax"/>
- </xsd:choice>
- <xsd:attribute ref="wsu:Id"/>
- <xsd:attribute ref="wsse:Usage"/>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:complexType>
- <xsd:complexType name="SecurityHeaderType">
- <xsd:annotation>
- <xsd:documentation>This complexType defines header block to use for security-relevant data directed at a specific SOAP actor.</xsd:documentation>
- </xsd:annotation>
- <xsd:sequence>
- <xsd:any processContents="lax" minOccurs="0" maxOccurs="unbounded">
- <xsd:annotation>
- <xsd:documentation>The use of "any" is to allow extensibility and different forms of security data.</xsd:documentation>
- </xsd:annotation>
- </xsd:any>
- </xsd:sequence>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:complexType>
- <xsd:complexType name="TransformationParametersType">
- <xsd:annotation>
- <xsd:documentation>This complexType defines a container for elements to be specified from any namespace as properties/parameters of a DSIG transformation.</xsd:documentation>
- </xsd:annotation>
- <xsd:sequence>
- <xsd:any processContents="lax" minOccurs="0" maxOccurs="unbounded">
- <xsd:annotation>
- <xsd:documentation>The use of "any" is to allow extensibility from any namespace.</xsd:documentation>
- </xsd:annotation>
- </xsd:any>
- </xsd:sequence>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:complexType>
- <xsd:element name="UsernameToken" type="wsse:UsernameTokenType">
- <xsd:annotation>
- <xsd:documentation>This element defines the wsse:UsernameToken element per Section 4.1.</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="BinarySecurityToken" type="wsse:BinarySecurityTokenType">
- <xsd:annotation>
- <xsd:documentation>This element defines the wsse:BinarySecurityToken element per Section 4.2.</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="Reference" type="wsse:ReferenceType">
- <xsd:annotation>
- <xsd:documentation>This element defines a security token reference</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="Embedded" type="wsse:EmbeddedType">
- <xsd:annotation>
- <xsd:documentation>This element defines a security token embedded reference</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="KeyIdentifier" type="wsse:KeyIdentifierType">
- <xsd:annotation>
- <xsd:documentation>This element defines a key identifier reference</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="SecurityTokenReference" type="wsse:SecurityTokenReferenceType">
- <xsd:annotation>
- <xsd:documentation>This element defines the wsse:SecurityTokenReference per Section 4.3.</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="Security" type="wsse:SecurityHeaderType">
- <xsd:annotation>
- <xsd:documentation>This element defines the wsse:Security SOAP header element per Section 4.</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="TransformationParameters" type="wsse:TransformationParametersType">
- <xsd:annotation>
- <xsd:documentation>This element contains properties for transformations from any namespace, including DSIG.</xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="Password" type="wsse:PasswordString"/>
- <xsd:element name="Nonce" type="wsse:EncodedString"/>
- <xsd:simpleType name="FaultcodeEnum">
- <xsd:restriction base="xsd:QName">
- <xsd:enumeration value="wsse:UnsupportedSecurityToken"/>
- <xsd:enumeration value="wsse:UnsupportedAlgorithm"/>
- <xsd:enumeration value="wsse:InvalidSecurity"/>
- <xsd:enumeration value="wsse:InvalidSecurityToken"/>
- <xsd:enumeration value="wsse:FailedAuthentication"/>
- <xsd:enumeration value="wsse:FailedCheck"/>
- <xsd:enumeration value="wsse:SecurityTokenUnavailable"/>
- </xsd:restriction>
- </xsd:simpleType>
-</xsd:schema>
diff --git a/schemas/oasis-200401-wss-wssecurity-utility-1.0.xsd b/schemas/oasis-200401-wss-wssecurity-utility-1.0.xsd
deleted file mode 100644
index f2ed72d8..00000000
--- a/schemas/oasis-200401-wss-wssecurity-utility-1.0.xsd
+++ /dev/null
@@ -1,108 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!--
-OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; neither does it represent that it has made any effort to identify any such rights. Information on OASIS's procedures with respect to rights in OASIS specifications can be found at the OASIS website. [...]
-OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
-Copyright © OASIS Open 2002-2004. All Rights Reserved.
-This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself does not be modified in any way, such as by removing the copyright notice [...]
-The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
-This document and the information contained herein is provided on an “AS IS” basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
--->
-<xsd:schema targetNamespace="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xsd="http://www.w3.org/2001/XMLSchema"
-
-
-
-xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"
-elementFormDefault="qualified" attributeFormDefault="unqualified" version="0.1">
- <!-- // Fault Codes /////////////////////////////////////////// -->
- <xsd:simpleType name="tTimestampFault">
- <xsd:annotation>
- <xsd:documentation>
-This type defines the fault code value for Timestamp message expiration.
- </xsd:documentation>
- </xsd:annotation>
- <xsd:restriction base="xsd:QName">
- <xsd:enumeration value="wsu:MessageExpired"/>
- </xsd:restriction>
- </xsd:simpleType>
- <!-- // Global attributes //////////////////////////////////// -->
- <xsd:attribute name="Id" type="xsd:ID">
- <xsd:annotation>
- <xsd:documentation>
-This global attribute supports annotating arbitrary elements with an ID.
- </xsd:documentation>
- </xsd:annotation>
- </xsd:attribute>
- <xsd:attributeGroup name="commonAtts">
- <xsd:annotation>
- <xsd:documentation>
-Convenience attribute group used to simplify this schema.
- </xsd:documentation>
- </xsd:annotation>
- <xsd:attribute ref="wsu:Id" use="optional"/>
- <xsd:anyAttribute namespace="##other" processContents="lax"/>
- </xsd:attributeGroup>
- <!-- // Utility types //////////////////////////////////////// -->
- <xsd:complexType name="AttributedDateTime">
- <xsd:annotation>
- <xsd:documentation>
-This type is for elements whose [children] is a psuedo-dateTime and can have arbitrary attributes.
- </xsd:documentation>
- </xsd:annotation>
- <xsd:simpleContent>
- <xsd:extension base="xsd:string">
- <xsd:attributeGroup ref="wsu:commonAtts"/>
- </xsd:extension>
- </xsd:simpleContent>
- </xsd:complexType>
- <xsd:complexType name="AttributedURI">
- <xsd:annotation>
- <xsd:documentation>
-This type is for elements whose [children] is an anyURI and can have arbitrary attributes.
- </xsd:documentation>
- </xsd:annotation>
- <xsd:simpleContent>
- <xsd:extension base="xsd:anyURI">
- <xsd:attributeGroup ref="wsu:commonAtts"/>
- </xsd:extension>
- </xsd:simpleContent>
- </xsd:complexType>
- <!-- // Timestamp header components /////////////////////////// -->
- <xsd:complexType name="TimestampType">
- <xsd:annotation>
- <xsd:documentation>
-This complex type ties together the timestamp related elements into a composite type.
- </xsd:documentation>
- </xsd:annotation>
- <xsd:sequence>
- <xsd:element ref="wsu:Created" minOccurs="0"/>
- <xsd:element ref="wsu:Expires" minOccurs="0"/>
- <xsd:choice minOccurs="0" maxOccurs="unbounded">
- <xsd:any namespace="##other" processContents="lax"/>
- </xsd:choice>
- </xsd:sequence>
- <xsd:attributeGroup ref="wsu:commonAtts"/>
- </xsd:complexType>
- <xsd:element name="Timestamp" type="wsu:TimestampType">
- <xsd:annotation>
- <xsd:documentation>
-This element allows Timestamps to be applied anywhere element wildcards are present,
-including as a SOAP header.
- </xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <!-- global element decls to allow individual elements to appear anywhere -->
- <xsd:element name="Expires" type="wsu:AttributedDateTime">
- <xsd:annotation>
- <xsd:documentation>
-This element allows an expiration time to be applied anywhere element wildcards are present.
- </xsd:documentation>
- </xsd:annotation>
- </xsd:element>
- <xsd:element name="Created" type="wsu:AttributedDateTime">
- <xsd:annotation>
- <xsd:documentation>
-This element allows a creation time to be applied anywhere element wildcards are present.
- </xsd:documentation>
- </xsd:annotation>
- </xsd:element>
-</xsd:schema>
diff --git a/schemas/shibboleth-2.0-afp-mf-basic.xsd b/schemas/shibboleth-2.0-afp-mf-basic.xsd
deleted file mode 100644
index 608b1c8b..00000000
--- a/schemas/shibboleth-2.0-afp-mf-basic.xsd
+++ /dev/null
@@ -1,336 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<schema targetNamespace="urn:mace:shibboleth:2.0:afp:mf:basic"
- xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic"
- xmlns:afp="urn:mace:shibboleth:2.0:afp"
- elementFormDefault="qualified"
- version="2.1">
-
- <import namespace="urn:mace:shibboleth:2.0:afp" schemaLocation="classpath:/schema/shibboleth-2.0-afp.xsd" />
-
- <!-- Blanket Match Function -->
- <complexType name="ANY">
- <annotation>
- <documentation>A match function that evaluates to true.</documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType" />
- </complexContent>
- </complexType>
-
- <!-- Boolean Match Functions -->
- <complexType name="AND">
- <annotation>
- <documentation>
- A match function that performs a logical AND on the results of all contained matching functions.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <choice maxOccurs="unbounded">
- <element name="Rule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- The set of match function rules to be ANDed.
- </documentation>
- </annotation>
- </element>
- <element name="RuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- The set of match function rules to be ANDed.
- </documentation>
- </annotation>
- </element>
- </choice>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="OR">
- <annotation>
- <documentation>
- A match function that performs a logical OR on the results of all contained matching functions.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <choice maxOccurs="unbounded">
- <element name="Rule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- The set of match function rules to be ORed.
- </documentation>
- </annotation>
- </element>
- <element name="RuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- The set of match function rules to be ORed.
- </documentation>
- </annotation>
- </element>
- </choice>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="NOT">
- <annotation>
- <documentation>
- A match function that performs a logical NOT on the result of the contained matching function.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <choice>
- <element name="Rule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- The set of match function rules to be negated.
- </documentation>
- </annotation>
- </element>
- <element name="RuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- The set of match function rules to be negated.
- </documentation>
- </annotation>
- </element>
- </choice>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- Literal String Match Functions -->
- <complexType name="AttributeRequesterString">
- <annotation>
- <documentation>
- A match function that matches the attribute request against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:StringMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerString">
- <annotation>
- <documentation>
- A match function that matches the attribute issuer against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:StringMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="PrincipalNameString">
- <annotation>
- <documentation>A match function that matches the principal name against the specified value.</documentation>
- </annotation>
- <complexContent>
- <extension base="basic:StringMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AuthenticationMethodString">
- <annotation>
- <documentation>
- A match function that matches the authentication method against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:StringMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeValueString">
- <annotation>
- <documentation>
- A match function that matches the value of an attribute against the specified value. This match
- evaluates to true if the attribute contains the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:AttributeTargetedStringMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeScopeString">
- <annotation>
- <documentation>
- A match function that matches the attribute scope against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:AttributeTargetedStringMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeTargetedStringMatchType" abstract="true">
- <complexContent>
- <extension base="basic:StringMatchType">
- <attribute name="attributeID" type="string">
- <annotation>
- <documentation>
- The ID of the attribute whose value should be matched. If no attribute ID is specified the
- ID of the containing attribute rule is assumed.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="StringMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="value" type="string" use="required">
- <annotation>
- <documentation>The string value to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="ignoreCase" type="boolean">
- <annotation>
- <documentation>
- A boolean flag indicating whether case should be ignored when evaluating the match.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- Regular Expression Match Functions -->
- <complexType name="AttributeRequesterRegex">
- <annotation>
- <documentation>
- A match function that matches the attribute requester against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:RegexMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerRegex">
- <annotation>
- <documentation>
- A match function that matches the attribute issuer against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:RegexMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="PrincipalNameRegex">
- <annotation>
- <documentation>
- A match function that matches the principal name against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:RegexMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AuthenticationMethodRegex">
- <annotation>
- <documentation>
- A match function that matches the authentication method against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:RegexMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeValueRegex">
- <annotation>
- <documentation>
- A match function that matches an attribute value against the specified regular expression. This function
- evaluates to true if any value matches the given expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:AttributeTargetedRegexMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeScopeRegex">
- <annotation>
- <documentation>
- A match function that matches the attribute scope against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="basic:AttributeTargetedRegexMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeTargetedRegexMatchType" abstract="true">
- <complexContent>
- <extension base="basic:RegexMatchType">
- <attribute name="attributeID" type="string">
- <annotation>
- <documentation>
- The ID of the attribute whose value should be matched. If no attribute ID is specified the
- ID of the containing attribute rule is assumed.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="RegexMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="regex" type="string" use="required">
- <annotation>
- <documentation>The regular expression values are matched against.</documentation>
- </annotation>
- </attribute>
- <attribute name="options" type="string">
- <annotation>
- <documentation>The regular expression options to apply.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="NumberOfAttributeValues">
- <annotation>
- <documentation>
- A match function that evaluates to true if the given attribute has as a number of values that falls
- between the minimum and maximum. This method may be used as a sanity check to ensure that an unexpected
- number of values did not come from the attribute resolver and be released.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeID" type="string" use="required">
- <annotation>
- <documentation>The ID of the attribute whose value should be matched.</documentation>
- </annotation>
- </attribute>
- <attribute name="minimum" type="nonNegativeInteger">
- <annotation>
- <documentation>Minimum number of values an attribute may have.</documentation>
- </annotation>
- </attribute>
- <attribute name="maximum" type="positiveInteger">
- <annotation>
- <documentation>Maximum number of values an attribute may have.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
-</schema>
\ No newline at end of file
diff --git a/schemas/shibboleth-2.0-afp-mf-saml.xsd b/schemas/shibboleth-2.0-afp-mf-saml.xsd
deleted file mode 100644
index 4161f58d..00000000
--- a/schemas/shibboleth-2.0-afp-mf-saml.xsd
+++ /dev/null
@@ -1,381 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<schema xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml"
- xmlns:afp="urn:mace:shibboleth:2.0:afp"
- targetNamespace="urn:mace:shibboleth:2.0:afp:mf:saml"
- elementFormDefault="qualified"
- version="2.6">
-
- <import namespace="urn:mace:shibboleth:2.0:afp" schemaLocation="classpath:/schema/shibboleth-2.0-afp.xsd" />
-
- <annotation>
- <documentation>
- A set of SAML specific match functions. These match functions only operate against a
- SAMLFilterContext.
- </documentation>
- </annotation>
-
- <complexType name="AttributeIssuerEntityAttributeExactMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute issuer contains an entity attribute with the
- specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityAttributeExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityAttributeExactMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester contains an entity attribute with the
- specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityAttributeExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeRequesterEntityAttributeExactMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester contains an entity attribute with the
- specified value.
-
- Deprecated in favor of "EntityAttributeExactMatch".
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityAttributeExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityAttributeExactMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeName" type="string" use="required">
- <annotation>
- <documentation>The name of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeNameFormat" type="string" use="optional">
- <annotation>
- <documentation>The name format of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeValue" type="string" use="required">
- <annotation>
- <documentation>The value of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerEntityAttributeRegexMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute issuer contains an entity attribute with a
- value that matches the given regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityAttributeRegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityAttributeRegexMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester contains an entity attribute with a
- value that matches the given regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityAttributeRegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeRequesterEntityAttributeRegexMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester contains an entity attribute with a
- value that matches the given regular expression.
-
- Deprecated in favor of "EntityAttributeRegexMatch".
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityAttributeRegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityAttributeRegexMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeName" type="string" use="required">
- <annotation>
- <documentation>The name of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeNameFormat" type="string" use="optional">
- <annotation>
- <documentation>The name format of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeValueRegex" type="string" use="required">
- <annotation>
- <documentation>The regular expression that must match the value of the entity attribute to
- match.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerNameIDFormatExactMatch">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute issuer supports a specified
- NameID format.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:NameIDFormatExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="NameIDFormatExactMatch">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute requester supports a specified
- NameID format.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:NameIDFormatExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeRequesterNameIDFormatExactMatch">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute requester supports a specified
- NameID format.
-
- Deprecated in favor of "NameIDFormatExactMatch".
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:NameIDFormatExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="NameIDFormatExactMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="nameIdFormat" type="string" use="required">
- <annotation>
- <documentation>The NameID format that needs to be supported by the entity.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeRequesterInEntityGroup">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute requester is found in metadata and is a member
- of the given entity group.
-
- Deprecated in favor of "InEntityGroup".
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityGroupMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="InEntityGroup">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute requester is found in metadata and
- is a member of the given entity group.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityGroupMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerInEntityGroup">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute issuer is found in metadata and is a member
- of the given entity group.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityGroupMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="EntityGroupMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="groupID" type="string" use="required">
- <annotation>
- <documentation>The entity group ID that an entity must be in.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeScopeMatchesShibMDScope">
- <annotation>
- <documentation>
- A match function that ensures that an attribute value's scope matches a scope given in metadata for the entity or role.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeValueMatchesShibMDScope">
- <annotation>
- <documentation>
- A match function that ensures that an attribute's value matches a scope given in metadata for the entity or role.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType" />
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerRegistrationAuthority">
- <annotation>
- <documentation>
- A match function that matches the attribute issuer's MDRPI content against a list of potential values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:RegistrationAuthorityMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="RegistrationAuthority">
- <annotation>
- <documentation>
- A match function that matches the SP (requester) MDRPI against a list of potential values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:RegistrationAuthorityMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="RegistrationAuthorityMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="registrars" type="saml:anyURIListType" use="required">
- <annotation>
- <documentation>The string values to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="matchIfMetadataSilent" type="boolean">
- <annotation>
- <documentation>
- A boolean flag indicating whether a match should occur if the metadata does
- not contain an MDRPI statement (coded) default is false.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="NameIDQualifierString">
- <annotation>
- <documentation>
- A match function that ensures that a NameID-valued attribute's qualifier(s), if set, match particular values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeID" type="string">
- <annotation>
- <documentation>
- The ID of the attribute whose qualifiers should be matched. If no attribute ID is specified the
- ID of the containing attribute rule is assumed.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="NameQualifier" type="string">
- <annotation>
- <documentation>
- A value to require in the NameQualifier field, or if omitted, require that it match the issuing IdP's entityID.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="SPNameQualifier" type="string">
- <annotation>
- <documentation>
- A value to require in the SPNameQualifier field, or if omitted, require that it match the SP's entityID.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerEntityMatcher">
- <annotation>
- <documentation>
- A match function that checks if the attribute issuer matches pluggable criteria.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityMatcherType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeRequesterEntityMatcher">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester matches pluggable criteria.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="saml:EntityMatcherType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityMatcherType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="matcher" type="string" use="required">
- <annotation>
- <documentation>
- The type of plugin to apply as a matching mechanism.
- </documentation>
- </annotation>
- </attribute>
- <anyAttribute namespace="##any" processContents="lax"/>
- </extension>
- </complexContent>
- </complexType>
-
- <simpleType name="anyURIListType">
- <list itemType="string"/>
- </simpleType>
-
-</schema>
\ No newline at end of file
diff --git a/schemas/shibboleth-2.0-afp.xsd b/schemas/shibboleth-2.0-afp.xsd
deleted file mode 100644
index 6f20a606..00000000
--- a/schemas/shibboleth-2.0-afp.xsd
+++ /dev/null
@@ -1,853 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<schema xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:afp="urn:mace:shibboleth:2.0:afp"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- targetNamespace="urn:mace:shibboleth:2.0:afp"
- version="3.1.0"
- elementFormDefault="qualified">
-
- <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"/>
-
- <annotation>
- <documentation>Schema for the attribute filter policies.</documentation>
- </annotation>
-
- <element name="AttributeFilterPolicyGroup" type="afp:AttributeFilterPolicyGroupType">
- <annotation>
- <documentation>
- Root element of the attribute filter policy. Represents a named group of filter policies.
- </documentation>
- </annotation>
- </element>
- <complexType name="AttributeFilterPolicyGroupType">
- <complexContent>
- <extension base="afp:IdentityType">
- <sequence>
- <element ref="afp:PolicyRequirementRule" minOccurs="0" maxOccurs="unbounded">
- <annotation>
- <documentation>
- Defines a set of applications requirements that may be reused across multiple filter
- policies.
- </documentation>
- </annotation>
- </element>
- <element ref="afp:PermitValueRule" minOccurs="0" maxOccurs="unbounded">
- <annotation>
- <documentation>
- Defines a permit value rule that may be reused across multiple attribute rules.
- </documentation>
- </annotation>
- </element>
- <element ref="afp:DenyValueRule" minOccurs="0" maxOccurs="unbounded">
- <annotation>
- <documentation>
- Defines a deny value rule that may be reused across multiple attribute rules.
- </documentation>
- </annotation>
- </element>
- <element ref="afp:AttributeRule" minOccurs="0" maxOccurs="unbounded">
- <annotation>
- <documentation>
- Defines an attribute rule that may be reused across multiple filter policies.
- </documentation>
- </annotation>
- </element>
- <element ref="afp:AttributeFilterPolicy" minOccurs="0" maxOccurs="unbounded">
- <annotation>
- <documentation>
- A policy that defines the set of attribute value filters that will be applied if its
- application requirements are met.
- </documentation>
- </annotation>
- </element>
- <element ref="ds:Signature" minOccurs="0">
- <annotation>
- <documentation>
- Digital signature for the policy. Policies that are fetched from an external source,
- such as a federation site, should be signed.
- </documentation>
- </annotation>
- </element>
- </sequence>
- </extension>
- </complexContent>
- </complexType>
-
- <element name="AttributeFilterPolicy" type="afp:AttributeFilterPolicyType">
- <annotation>
- <documentation>
- A policy that defines a set of attribute value filters rules that should be used if given requirements
- are met.
- </documentation>
- </annotation>
- </element>
- <complexType name="AttributeFilterPolicyType">
- <complexContent>
- <extension base="afp:IdentityType">
- <sequence>
- <choice>
- <element ref="afp:PolicyRequirementRule">
- <annotation>
- <documentation>
- A requirement that if met signals that this filter policy should be used.
- </documentation>
- </annotation>
- </element>
- <element name="PolicyRequirementRuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- Reference to a PolicyRequirement defined within this policy group or another.
- </documentation>
- </annotation>
- </element>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element ref="afp:AttributeRule">
- <annotation>
- <documentation>
- A rule that describes how values of an attribute will be filtered.
- </documentation>
- </annotation>
- </element>
- <element name="AttributeRuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- Reference to a AttributeRule defined within this policy group or another.
- </documentation>
- </annotation>
- </element>
- </choice>
- </sequence>
- </extension>
- </complexContent>
- </complexType>
-
- <element name="AttributeRule" type="afp:AttributeRuleType">
- <annotation>
- <documentation>A rule that describes how values of an attribute will be filtered.</documentation>
- </annotation>
- </element>
- <complexType name="AttributeRuleType">
- <complexContent>
- <extension base="afp:IdentityType">
- <choice>
- <choice minOccurs="0">
- <element ref="afp:PermitValueRule" />
- <element name="PermitValueRuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- Reference to a PermitValueRule defined within this policy group or another.
- </documentation>
- </annotation>
- </element>
- </choice>
- <choice minOccurs="0">
- <element ref="afp:DenyValueRule" />
- <element name="DenyValueRuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- Reference to a DenyValueRule defined within this policy group or another.
- </documentation>
- </annotation>
- </element>
- </choice>
- </choice>
- <attribute name="attributeID" type="afp:string" use="required">
- <annotation>
- <documentation>The ID of the attribute to which this rule applies.</documentation>
- </annotation>
- </attribute>
- <attribute name="permitAny" type="boolean">
- <annotation>
- <documentation>If present, and true injects an implicit permit value rule of type ANY</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <element name="PolicyRequirementRule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>A requirement that if met signals that a filter policy should be used.</documentation>
- </annotation>
- </element>
- <element name="PermitValueRule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- A filter for attribute values. If the filter evaluates to true the value is permitted to be released.
- </documentation>
- </annotation>
- </element>
- <element name="DenyValueRule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- A filter for attribute values. If the filter evaluates to true the value is denied and may not be released.
- </documentation>
- </annotation>
- </element>
- <complexType name="MatchFunctorType" abstract="true">
- <complexContent>
- <extension base="afp:IdentityType" />
- </complexContent>
- </complexType>
-
- <complexType name="IdentityType">
- <attribute name="id" type="afp:string">
- <annotation>
- <documentation>An ID, unique within the policy and component type.</documentation>
- </annotation>
- </attribute>
- </complexType>
-
- <complexType name="ReferenceType">
- <attribute name="ref" type="afp:string">
- <annotation>
- <documentation>Used to reference a globally defined policy component.</documentation>
- </annotation>
- </attribute>
- </complexType>
-
- <!-- Blanket Match Function -->
- <complexType name="ANY">
- <annotation>
- <documentation>A match function that evaluates to true.</documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType"/>
- </complexContent>
- </complexType>
-
- <!-- Boolean Match Functions -->
- <complexType name="AND">
- <annotation>
- <documentation>
- A match function that performs a logical AND on the results of all contained matching functions.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <choice maxOccurs="unbounded">
- <element name="Rule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- The set of match function rules to be ANDed.
- </documentation>
- </annotation>
- </element>
- <element name="RuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- The set of match function rules to be ANDed.
- </documentation>
- </annotation>
- </element>
- </choice>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="OR">
- <annotation>
- <documentation>
- A match function that performs a logical OR on the results of all contained matching functions.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <choice maxOccurs="unbounded">
- <element name="Rule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- The set of match function rules to be ORed.
- </documentation>
- </annotation>
- </element>
- <element name="RuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- The set of match function rules to be ORed.
- </documentation>
- </annotation>
- </element>
- </choice>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="NOT">
- <annotation>
- <documentation>
- A match function that performs a logical NOT on the result of the contained matching function.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <choice>
- <element name="Rule" type="afp:MatchFunctorType">
- <annotation>
- <documentation>
- The set of match function rules to be negated.
- </documentation>
- </annotation>
- </element>
- <element name="RuleReference" type="afp:ReferenceType">
- <annotation>
- <documentation>
- The set of match function rules to be negated.
- </documentation>
- </annotation>
- </element>
- </choice>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- Literal String Match Functions -->
- <complexType name="Requester">
- <annotation>
- <documentation>
- A match function that matches the attribute requester against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:StringMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="Issuer">
- <annotation>
- <documentation>
- A match function that matches the attribute issuer against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:StringMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AuthenticationMethod">
- <annotation>
- <documentation>
- A match function that matches the authentication method against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:StringMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="Value">
- <annotation>
- <documentation>
- A match function that matches the value of an attribute against the specified value. This match
- evaluates to true if the attribute contains the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:TargetedStringMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="Scope">
- <annotation>
- <documentation>
- A match function that matches the attribute scope against the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:TargetedStringMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="TargetedStringMatchType" abstract="true">
- <complexContent>
- <extension base="afp:StringMatchType">
- <attribute name="attributeID" type="afp:string">
- <annotation>
- <documentation>
- The ID of the attribute whose value should be matched. If no attribute ID is specified the
- ID of the containing attribute rule is assumed.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="StringMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="value" type="afp:string" use="required">
- <annotation>
- <documentation>The string value to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="caseSensitive" type="boolean">
- <annotation>
- <documentation>
- A boolean flag indicating whether the match evaluation should be case sensitive.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- Regular Expression Match Functions -->
- <complexType name="RequesterRegex">
- <annotation>
- <documentation>
- A match function that matches the attribute requester against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:RegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="IssuerRegex">
- <annotation>
- <documentation>
- A match function that matches the attribute issuer against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:RegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AuthenticationMethodRegex">
- <annotation>
- <documentation>
- A match function that matches the authentication method against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:RegexMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="ValueRegex">
- <annotation>
- <documentation>
- A match function that matches an attribute value against the specified regular expression. This function
- evaluates to true if any value matches the given expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:TargetedRegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="ScopeRegex">
- <annotation>
- <documentation>
- A match function that matches the attribute scope against the specified regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:TargetedRegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="TargetedRegexMatchType" abstract="true">
- <complexContent>
- <extension base="afp:RegexMatchType">
- <attribute name="attributeID" type="afp:string">
- <annotation>
- <documentation>
- The ID of the attribute whose value should be matched. If no attribute ID is specified the
- ID of the containing attribute rule is assumed.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="RegexMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="regex" type="afp:string" use="required">
- <annotation>
- <documentation>The regular expression values are matched against.</documentation>
- </annotation>
- </attribute>
- <attribute name="caseSensitive" type="boolean">
- <annotation>
- <documentation>Whether the comparison is case sensitive, default TRUE</documentation>
- </annotation>
- </attribute>
- <attribute name="options" type="afp:string">
- <annotation>
- <documentation>The regular expression options to apply.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- Misc. Functions -->
-
- <complexType name="NumberOfAttributeValues">
- <annotation>
- <documentation>
- A match function that evaluates to true if the given attribute has as a number of values that falls
- between the minimum and maximum. This method may be used as a sanity check to ensure that an unexpected
- number of values did not come from the attribute resolver and be released.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeID" type="afp:string" use="required">
- <annotation>
- <documentation>The ID of the attribute whose value should be matched.</documentation>
- </annotation>
- </attribute>
- <attribute name="minimum" type="nonNegativeInteger">
- <annotation>
- <documentation>Minimum number of values an attribute may have.</documentation>
- </annotation>
- </attribute>
- <attribute name="maximum" type="positiveInteger">
- <annotation>
- <documentation>Maximum number of values an attribute may have.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- SAML-specific. -->
-
- <complexType name="EntityAttributeExactMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester's metadata
- contains an entity attribute with the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityAttributeExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="IssuerEntityAttributeExactMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute issuer's metadata
- contains an entity attribute with the specified value.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityAttributeExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityAttributeExactMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeName" type="afp:string" use="required">
- <annotation>
- <documentation>The name of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeValue" type="afp:string" use="required">
- <annotation>
- <documentation>The value of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeNameFormat" type="afp:string">
- <annotation>
- <documentation>The NameFormat of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="EntityAttributeRegexMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester's metadata
- contains an entity attribute with a value that matches the given regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityAttributeRegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="IssuerEntityAttributeRegexMatch">
- <annotation>
- <documentation>
- A match function that checks if the attribute issuer's metadata
- contains an entity attribute with a value that matches the given regular expression.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityAttributeRegexMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityAttributeRegexMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeName" type="afp:string" use="required">
- <annotation>
- <documentation>The name of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeValueRegex" type="afp:string" use="required">
- <annotation>
- <documentation>The regular expression that must match the value of the entity attribute to
- match.</documentation>
- </annotation>
- </attribute>
- <attribute name="attributeNameFormat" type="afp:string">
- <annotation>
- <documentation>The name format of the entity attribute to match.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- TODO: implement NameID functions or remove -->
-
- <complexType name="NameIDFormatExactMatch">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute requester supports a specified
- NameID format.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:NameIDFormatExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="IssuerNameIDFormatExactMatch">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute issuer supports a specified
- NameID format.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:NameIDFormatExactMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="NameIDFormatExactMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="nameIdFormat" type="afp:string" use="required">
- <annotation>
- <documentation>The NameID format that needs to be supported by the entity.</documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="InEntityGroup">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute requester is found in metadata and
- is a member of the given entity group.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityGroupMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="IssuerInEntityGroup">
- <annotation>
- <documentation>
- A match function that evaluates to true if the attribute issuer is found in metadata and
- is a member of the given entity group.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityGroupMatchType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityGroupMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="groupID" type="afp:string" use="required">
- <annotation>
- <documentation>The entity group ID that an entity must be in.</documentation>
- </annotation>
- </attribute>
- <attribute name="checkAffiliations" type="boolean">
- <annotation>
- <documentation>
- Whether to check for membership in metadata-based AffiliationDescriptors.
-
- Defaults to false.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="RegistrationAuthority">
- <annotation>
- <documentation>
- A match function that matches the SP (requester) MDRPI against a list of potential values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:RegistrationAuthorityMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="IssuerRegistrationAuthority">
- <annotation>
- <documentation>
- A match function that matches the attribute issuer's MDRPI content against a list of potential values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:RegistrationAuthorityMatchType" />
- </complexContent>
- </complexType>
-
- <complexType name="RegistrationAuthorityMatchType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="registrars" type="afp:anyURIListType" use="required">
- <annotation>
- <documentation>The string values to match.</documentation>
- </annotation>
- </attribute>
- <attribute name="matchIfMetadataSilent" type="boolean">
- <annotation>
- <documentation>
- A boolean flag indicating whether a match should occur if the metadata does
- not contain an MDRPI statement (coded) default is false.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="ScopeMatchesShibMDScope">
- <annotation>
- <documentation>
- A match function that ensures that an attribute value's scope matches a scope given in
- metadata for the entity or role of the attribute issuer.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType"/>
- </complexContent>
- </complexType>
-
- <complexType name="ValueMatchesShibMDScope">
- <annotation>
- <documentation>
- A match function that ensures that an attribute value's scope matches a scope given in
- metadata for the entity or role of the attribute issuer.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType"/>
- </complexContent>
- </complexType>
-
- <!-- SP-only matchers -->
-
- <complexType name="NameIDQualifierString">
- <annotation>
- <documentation>
- A match function that ensures that a NameID-valued attribute's qualifier(s), if set, match particular values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <attribute name="attributeID" type="afp:string">
- <annotation>
- <documentation>
- The ID of the attribute whose qualifiers should be matched. If no attribute ID is specified the
- ID of the containing attribute rule is assumed.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="NameQualifier" type="afp:string">
- <annotation>
- <documentation>
- A value to require in the NameQualifier field, or if omitted, require that it match the issuing IdP's entityID.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="SPNameQualifier" type="afp:string">
- <annotation>
- <documentation>
- A value to require in the SPNameQualifier field, or if omitted, require that it match the SP's entityID.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeIssuerEntityMatcher">
- <annotation>
- <documentation>
- A match function that checks if the attribute issuer matches pluggable criteria.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityMatcherType"/>
- </complexContent>
- </complexType>
-
- <complexType name="AttributeRequesterEntityMatcher">
- <annotation>
- <documentation>
- A match function that checks if the attribute requester matches pluggable criteria.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="afp:EntityMatcherType"/>
- </complexContent>
- </complexType>
-
- <complexType name="EntityMatcherType" abstract="true">
- <complexContent>
- <extension base="afp:MatchFunctorType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="matcher" type="afp:string" use="required">
- <annotation>
- <documentation>
- The type of plugin to apply as a matching mechanism.
- </documentation>
- </annotation>
- </attribute>
- <anyAttribute namespace="##any" processContents="lax"/>
- </extension>
- </complexContent>
- </complexType>
-
- <!-- Utility types -->
-
- <simpleType name="anyURIListType">
- <list itemType="string"/>
- </simpleType>
-
- <simpleType name="string">
- <restriction base="string">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
-</schema>
diff --git a/schemas/shibboleth-2.0-attribute-map.xsd b/schemas/shibboleth-2.0-attribute-map.xsd
deleted file mode 100644
index 31ff798f..00000000
--- a/schemas/shibboleth-2.0-attribute-map.xsd
+++ /dev/null
@@ -1,358 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<schema targetNamespace="urn:mace:shibboleth:2.0:attribute-map"
- xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:am="urn:mace:shibboleth:2.0:attribute-map"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- elementFormDefault="qualified"
- version="2.5">
-
- <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd" />
-
- <annotation>
- <documentation>
- This schema maps SAML attributes into Shibboleth internal attributes.
- </documentation>
- </annotation>
-
- <simpleType name="string">
- <restriction base="string">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <simpleType name="anyURI">
- <restriction base="anyURI">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <simpleType name="listOfStrings">
- <list itemType="am:string"/>
- </simpleType>
-
- <complexType name="PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="type" type="am:string" use="required"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <element name="GSSAPIContext" type="base64Binary">
- <annotation>
- <documentation>A wrapper element for GSS-API contexts.</documentation>
- </annotation>
- </element>
-
- <element name="GSSAPIName" type="base64Binary">
- <annotation>
- <documentation>A wrapper element for GSS-API composite names.</documentation>
- </annotation>
- </element>
-
- <element name="Attributes">
- <annotation>
- <documentation>The set of SAML or GSS-API attribute mappings.</documentation>
- </annotation>
- <complexType>
- <sequence>
- <element name="MetadataProvider" type="am:PluggableType" minOccurs="0"/>
- <element name="TrustEngine" type="am:PluggableType" minOccurs="0"/>
- <element name="AttributeFilter" type="am:PluggableType" minOccurs="0"/>
- <choice maxOccurs="unbounded">
- <element name="Attribute" type="am:AttributeType"/>
- <element name="GSSAPIAttribute" type="am:GSSAPIAttributeType"/>
- </choice>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- <attribute name="metadataAttributeCaching" type="boolean"/>
- <attribute name="metadataPolicyId" type="am:string"/>
- </complexType>
- </element>
-
- <complexType name="AttributeType">
- <annotation>
- <documentation>Rule for mapping a SAML attribute to an internal attribute.</documentation>
- </annotation>
- <sequence>
- <element name="AttributeDecoder" type="am:AttributeDecoderType" minOccurs="0"/>
- </sequence>
- <attribute name="id" type="am:string" use="required">
- <annotation>
- <documentation>The internal attribute ID to which this SAML attribute maps.</documentation>
- </annotation>
- </attribute>
- <attribute name="aliases" type="am:listOfStrings">
- <annotation>
- <documentation>DEPRECATED: Aliases for the internal attribute to which this SAML attribute maps.</documentation>
- </annotation>
- </attribute>
- <attribute name="name" type="am:string" use="required">
- <annotation>
- <documentation>The SAML 1 AttributeName or SAML 2 Name of the attribute.</documentation>
- </annotation>
- </attribute>
- <attribute name="nameFormat" type="am:string">
- <annotation>
- <documentation>The SAML 1 Namespace or SAML 2 NameFormat of the attribute.</documentation>
- </annotation>
- </attribute>
- <attribute name="isRequested" type="boolean">
- <annotation>
- <documentation>Marks an attribute as requested by the service.</documentation>
- </annotation>
- </attribute>
- <attribute name="isRequired" type="boolean">
- <annotation>
- <documentation>Marks an attribute as required by the service.</documentation>
- </annotation>
- </attribute>
- </complexType>
-
- <complexType name="GSSAPIAttributeType">
- <annotation>
- <documentation>Rule for mapping a GSS-API naming attribute to an internal attribute.</documentation>
- </annotation>
- <attribute name="id" type="am:string" use="required">
- <annotation>
- <documentation>The internal attribute ID to which this SAML attribute maps.</documentation>
- </annotation>
- </attribute>
- <attribute name="aliases" type="am:listOfStrings">
- <annotation>
- <documentation>Optional aliases for the internal attribute to which this SAML attribute maps.</documentation>
- </annotation>
- </attribute>
- <attribute name="name" type="am:string" use="required">
- <annotation>
- <documentation>The name of the naming attribute.</documentation>
- </annotation>
- </attribute>
- <attribute name="authenticated" type="boolean">
- <annotation>
- <documentation>If true, only an authenticated GSS-API naming attribute will be mapped.</documentation>
- </annotation>
- </attribute>
- <attribute name="binary" type="boolean">
- <annotation>
- <documentation>If true, the GSS-API naming attribute will be base64-encoded for internal use.</documentation>
- </annotation>
- </attribute>
- <attribute name="scopeDelimiter" type="am:string">
- <annotation>
- <documentation>
- The character(s) used to delimit the scoped information from the scope.
- </documentation>
- </annotation>
- </attribute>
- </complexType>
-
- <complexType name="AttributeDecoderType" abstract="true">
- <annotation>
- <documentation>
- Decodes a SAML attribute into its Shibboleth-internal representation.
- </documentation>
- </annotation>
- <attribute name="caseSensitive" type="boolean">
- <annotation>
- <documentation>
- Flag controlling case sensitivity when comparisons to the attribute's values are done.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="internal" type="boolean">
- <annotation>
- <documentation>
- Flag controlling whether the resulting attribute should be exported for CGI use.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="langAware" type="boolean">
- <annotation>
- <documentation>
- Flag controlling whether the decoder should select only the best matching value by language.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="hashAlg" type="am:string">
- <annotation>
- <documentation>
- Crypto-provider-specific name of hash algorithm to use,
- turning the decoded result into a simple string.
- </documentation>
- </annotation>
- </attribute>
- </complexType>
-
- <complexType name="StringAttributeDecoder">
- <annotation>
- <documentation>
- Decoder for attributes with string values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:AttributeDecoderType" />
- </complexContent>
- </complexType>
-
- <complexType name="ScopedAttributeDecoder">
- <annotation>
- <documentation>
- Decoder for attributes with scoped values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:AttributeDecoderType">
- <attribute name="scopeDelimiter" type="am:string">
- <annotation>
- <documentation>
- The character(s) used to delimit the scoped information from the scope.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="NameIDAttributeDecoder">
- <annotation>
- <documentation>
- Decoder for attributes with NameID values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:AttributeDecoderType">
- <attribute name="formatter" type="am:string">
- <annotation>
- <documentation>
- The pattern used to generate string versions of the attribute's values.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="defaultQualifiers" type="boolean">
- <annotation>
- <documentation>
- Flag controlling whether to default in values for NameQualifier/SPNameQualifier if not set.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="NameIDFromScopedAttributeDecoder">
- <annotation>
- <documentation>
- Decoder for attributes with scoped values that produces a NameID attribute with
- the scope dropped and the NameQualifiers defaulted.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:ScopedAttributeDecoder">
- <attribute name="format" type="am:anyURI">
- <annotation>
- <documentation>
- Value to use as the NameID Format.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="defaultQualifiers" type="boolean">
- <annotation>
- <documentation>
- Flag controlling whether to default in values for NameQualifier/SPNameQualifier if not set.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="formatter" type="am:string">
- <annotation>
- <documentation>
- The pattern used to generate string versions of the attribute's values.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="KeyInfoAttributeDecoder">
- <annotation>
- <documentation>
- Decoder for attributes with ds:KeyInfo values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:AttributeDecoderType">
- <sequence>
- <element name="KeyInfoResolver" type="am:PluggableType" minOccurs="0"/>
- </sequence>
- <attribute name="hash" type="boolean">
- <annotation>
- <documentation>
- Flag controlling whether to hash keys before base64-encoding them.
- </documentation>
- </annotation>
- </attribute>
- <attribute name="keyInfoHashAlg" type="am:string">
- <annotation>
- <documentation>
- Crypto-provider-specific name of hash algorithm to use.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="XMLAttributeDecoder">
- <annotation>
- <documentation>
- Decoder for directly serializing XML values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:AttributeDecoderType"/>
- </complexContent>
- </complexType>
-
- <complexType name="DOMAttributeDecoder">
- <annotation>
- <documentation>
- Decoder for extracting information from XML values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:AttributeDecoderType">
- <sequence>
- <element name="Mapping" minOccurs="0">
- <annotation>
- <documentation>Optional transform to turn qualified XML names into string names.</documentation>
- </annotation>
- <complexType>
- <attribute name="from" type="QName" use="required"/>
- <attribute name="to" type="am:string" use="required"/>
- </complexType>
- </element>
- </sequence>
- <attribute name="formatter" type="am:string">
- <annotation>
- <documentation>
- The pattern used to generate strings from the XML.
- </documentation>
- </annotation>
- </attribute>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="Base64AttributeDecoder">
- <annotation>
- <documentation>
- Decoder for attributes with base64-encoded string values.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="am:AttributeDecoderType" />
- </complexContent>
- </complexType>
-
-</schema>
diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
deleted file mode 100644
index 50ae8db1..00000000
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ /dev/null
@@ -1,850 +0,0 @@
-<?xml version="1.0" encoding="US-ASCII"?>
-<schema targetNamespace="urn:mace:shibboleth:2.0:native:sp:config"
- xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
- xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
- xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
- elementFormDefault="qualified"
- attributeFormDefault="unqualified"
- blockDefault="substitution"
- version="2.6">
-
- <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd" />
- <import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="saml-schema-assertion-2.0.xsd"/>
- <import namespace="urn:oasis:names:tc:SAML:2.0:protocol" schemaLocation="saml-schema-protocol-2.0.xsd"/>
- <import namespace="urn:oasis:names:tc:SAML:2.0:metadata" schemaLocation="saml-schema-metadata-2.0.xsd"/>
-
- <annotation>
- <documentation>
- 2.0 schema for XML-based configuration of Shibboleth Native SP instances.
- First appearing in Shibboleth 2.0 release.
- </documentation>
- </annotation>
-
- <simpleType name="string">
- <restriction base="string">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <simpleType name="listOfStrings">
- <list itemType="conf:string"/>
- </simpleType>
-
- <simpleType name="anyURI">
- <restriction base="anyURI">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <simpleType name="listOfURIs">
- <list itemType="conf:anyURI"/>
- </simpleType>
-
- <simpleType name="bindingBoolean">
- <restriction base="string">
- <enumeration value="true"/>
- <enumeration value="false"/>
- <enumeration value="front"/>
- <enumeration value="back"/>
- <enumeration value="conditional" />
- </restriction>
- </simpleType>
-
- <simpleType name="redirectLimitType">
- <restriction base="string">
- <enumeration value="none"/>
- <enumeration value="exact"/>
- <enumeration value="host"/>
- <enumeration value="whitelist"/>
- <enumeration value="exact+whitelist"/>
- <enumeration value="host+whitelist"/>
- </restriction>
- </simpleType>
-
- <complexType name="PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="type" type="conf:string" use="required"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <complexType name="ExtensionsType">
- <annotation>
- <documentation>Container for extension libraries and custom configuration</documentation>
- </annotation>
- <sequence>
- <element name="Library" minOccurs="0" maxOccurs="unbounded">
- <complexType>
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="path" type="conf:anyURI" use="required"/>
- <attribute name="fatal" type="boolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- </element>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- </complexType>
-
- <complexType name="StorageServiceType">
- <annotation>
- <documentation>References StorageService plugins</documentation>
- </annotation>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="id" type="ID" use="required"/>
- <attribute name="cleanupInterval" type="unsignedInt"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </restriction>
- </complexContent>
- </complexType>
-
- <complexType name="SessionCacheType">
- <annotation>
- <documentation>References SessionCache plugins</documentation>
- </annotation>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="StorageService" type="IDREF"/>
- <attribute name="cacheAllowance" type="unsignedInt"/>
- <attribute name="cacheTimeout" type="unsignedInt"/> <!-- deprecated -->
- <attribute name="maintainReverseIndex" type="boolean"/>
- <attribute name="excludeReverseIndex" type="conf:listOfStrings"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </restriction>
- </complexContent>
- </complexType>
-
- <complexType name="ReplayCacheType">
- <annotation>
- <documentation>Ties ReplayCache to a custom StorageService</documentation>
- </annotation>
- <sequence/>
- <attribute name="StorageService" type="IDREF"/>
- </complexType>
-
- <complexType name="ArtifactMapType">
- <annotation>
- <documentation>Customizes an ArtifactMap</documentation>
- </annotation>
- <sequence/>
- <attribute name="StorageService" type="IDREF"/>
- <attribute name="context" type="conf:string"/>
- <attribute name="artifactTTL" type="unsignedInt"/>
- </complexType>
-
- <complexType name="OutOfProcessType">
- <annotation>
- <documentation>Container for out-of-process (shibd) configuration</documentation>
- </annotation>
- <sequence>
- <element name="Extensions" type="conf:ExtensionsType" minOccurs="0"/>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="logger" type="conf:anyURI"/>
- <attribute name="tranLogFormat" type="conf:string"/>
- <attribute name="tranLogFiller" type="conf:string"/>
- <attribute name="catchAll" type="boolean"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <complexType name="InProcessType">
- <annotation>
- <documentation>
- Container for configuration of locally integrated or platform-specific
- features (e.g. web server filters)
- </documentation>
- </annotation>
- <sequence>
- <element name="Extensions" type="conf:ExtensionsType" minOccurs="0"/>
- <element name="ISAPI" minOccurs="0">
- <complexType>
- <choice maxOccurs="unbounded" minOccurs="0">
- <element name="Site">
- <complexType>
- <sequence>
- <element name="Alias" type="conf:string" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="id" type="unsignedInt" use="required"/>
- <attribute name="name" type="conf:string" use="required"/>
- <attribute name="port" type="unsignedInt"/>
- <attribute name="sslport" type="unsignedInt"/>
- <attribute name="scheme" type="conf:string"/>
- </complexType>
- </element>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </choice>
- <attribute name="normalizeRequest" type="boolean"/>
- <attribute name="safeHeaderNames" type="boolean"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
- </element>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="logger" type="conf:anyURI"/>
- <attribute name="unsetHeaderValue" type="conf:string"/>
- <attribute name="checkSpoofing" type="boolean"/>
- <attribute name="spoofKey" type="conf:string"/>
- <attribute name="catchAll" type="boolean"/>
- <attribute name="extraAuthTypes" type="conf:listOfStrings"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <element name="AccessControl" type="conf:UniOperatorType">
- <annotation>
- <documentation>
- A simple example access policy language extension that supersedes Apache .htaccess
- </documentation>
- </annotation>
- </element>
- <complexType name="UniOperatorType">
- <choice>
- <element name="AND" type="conf:MultiOperatorType"/>
- <element name="OR" type="conf:MultiOperatorType"/>
- <element name="NOT" type="conf:UniOperatorType"/>
- <element name="Rule" type="conf:RuleType"/>
- <element name="RuleRegex" type="conf:RuleRegexType"/>
- </choice>
- </complexType>
- <complexType name="MultiOperatorType">
- <choice minOccurs="2" maxOccurs="unbounded">
- <element name="AND" type="conf:MultiOperatorType"/>
- <element name="OR" type="conf:MultiOperatorType"/>
- <element name="NOT" type="conf:UniOperatorType"/>
- <element name="Rule" type="conf:RuleType"/>
- <element name="RuleRegex" type="conf:RuleRegexType"/>
- </choice>
- </complexType>
- <complexType name="RuleType">
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="require" type="conf:string" use="required"/>
- <attribute name="list" type="boolean"/>
- </extension>
- </simpleContent>
- </complexType>
- <complexType name="RuleRegexType">
- <simpleContent>
- <extension base="conf:string">
- <attribute name="require" type="conf:string" use="required"/>
- <attribute name="ignoreCase" type="boolean"/>
- <attribute name="caseSensitive" type="boolean"/>
- </extension>
- </simpleContent>
- </complexType>
-
- <attributeGroup name="ContentSettings">
- <attribute name="applicationId" type="conf:string"/>
- <attribute name="authType" type="conf:string"/>
- <attribute name="requireSession" type="boolean"/>
- <attribute name="requireSessionWith" type="conf:string"/>
- <attribute name="requireLogoutWith" type="conf:anyURI"/>
- <attribute name="exportAssertion" type="boolean"/>
- <attribute name="exportStdVars" type="boolean"/>
- <attribute name="exportCookie" type="boolean"/>
- <attribute name="exportDuplicateValues" type="boolean"/>
- <attribute name="redirectToSSL" type="unsignedInt"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <attribute name="discoveryURL" type="conf:anyURI"/>
- <attribute name="discoveryPolicy" type="conf:string"/>
- <attribute name="isPassive" type="boolean"/>
- <attribute name="returnOnError" type="boolean"/>
- <attribute name="forceAuthn" type="boolean"/>
- <attribute name="authnContextClassRef" type="conf:listOfURIs"/>
- <attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
- <attribute name="NameIDFormat" type="conf:anyURI"/>
- <attribute name="SPNameQualifier" type="conf:string"/>
- <attribute name="redirectErrors" type="conf:anyURI"/>
- <attribute name="sessionError" type="conf:anyURI"/>
- <attribute name="metadataError" type="conf:anyURI"/>
- <attribute name="accessError" type="conf:anyURI"/>
- <attribute name="sslError" type="conf:anyURI"/>
- <attribute name="target" type="conf:anyURI"/>
- <attribute name="acsIndex" type="unsignedShort"/>
- <attribute name="REMOTE_ADDR" type="conf:string"/>
- <attribute name="encoding" type="conf:string"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </attributeGroup>
-
- <element name="RequestMap">
- <annotation>
- <documentation>
- Built-in request mapping syntax, decomposes URLs into Host/Path/Path/...
- </documentation>
- </annotation>
- <complexType>
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Host" type="conf:HostType"/>
- <element name="HostRegex" type="conf:HostRegexType"/>
- </choice>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- <attribute name="unicodeAware" type="boolean"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
- </element>
-
- <complexType name="HostType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Path" type="conf:PathType"/>
- <element name="PathRegex" type="conf:PathRegexType"/>
- <element name="Query" type="conf:QueryType"/>
- </choice>
- </sequence>
- <attribute name="scheme">
- <simpleType>
- <restriction base="conf:string">
- <enumeration value="http"/>
- <enumeration value="https"/>
- <enumeration value="ftp"/>
- <enumeration value="ldap"/>
- <enumeration value="ldaps"/>
- </restriction>
- </simpleType>
- </attribute>
- <attribute name="name" type="conf:string" use="required"/>
- <attribute name="port" type="unsignedInt"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="HostRegexType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Path" type="conf:PathType"/>
- <element name="PathRegex" type="conf:PathRegexType"/>
- <element name="Query" type="conf:QueryType"/>
- </choice>
- </sequence>
- <attribute name="regex" type="conf:string" use="required"/>
- <attribute name="ignoreCase" type="boolean"/>
- <attribute name="caseSensitive" type="boolean"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="PathType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Path" type="conf:PathType"/>
- <element name="PathRegex" type="conf:PathRegexType"/>
- <element name="Query" type="conf:QueryType"/>
- </choice>
- </sequence>
- <attribute name="name" type="conf:string" use="required"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="PathRegexType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <element name="Query" type="conf:QueryType" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="regex" type="conf:string" use="required"/>
- <attribute name="ignoreCase" type="boolean"/>
- <attribute name="caseSensitive" type="boolean"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="QueryType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <element name="Query" type="conf:QueryType" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="name" type="conf:string" use="required"/>
- <attribute name="regex" type="conf:string"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="ApplicationDefaultsType">
- <annotation>
- <documentation>Container for default settings and application-specific overrides</documentation>
- </annotation>
- <sequence>
- <element name="Sessions" type="conf:SessionsType"/>
- <element name="Errors" type="conf:ErrorsType" minOccurs="0"/>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="RelyingParty" type="conf:RelyingPartyType"/>
- <element name="Notify" type="conf:NotifyType"/>
- <element ref="saml:Audience"/>
- <element name="MetadataProvider" type="conf:PluggableType"/>
- <element name="TrustEngine" type="conf:PluggableType"/>
- <element name="AttributeExtractor" type="conf:PluggableType"/>
- <element name="AttributeResolver" type="conf:PluggableType"/>
- <element name="AttributeFilter" type="conf:PluggableType"/>
- <element name="CredentialResolver" type="conf:PluggableType"/>
- <element name="ApplicationOverride" type="conf:ApplicationOverrideType"/>
- </choice>
- </sequence>
- <attribute name="id" type="conf:string" fixed="default"/>
- <attribute name="entityID" type="conf:anyURI" use="required"/>
- <attributeGroup ref="conf:ApplicationGroup"/>
- <attributeGroup ref="conf:RelyingPartyGroup"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <complexType name="ApplicationOverrideType">
- <annotation>
- <documentation>Container for application-specific overrides</documentation>
- </annotation>
- <sequence>
- <element name="Sessions" type="conf:SessionsType" minOccurs="0"/>
- <element name="Errors" type="conf:ErrorsType" minOccurs="0"/>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="RelyingParty" type="conf:RelyingPartyType"/>
- <element name="Notify" type="conf:NotifyType"/>
- <element ref="saml:Audience"/>
- <element name="MetadataProvider" type="conf:PluggableType"/>
- <element name="TrustEngine" type="conf:PluggableType"/>
- <element name="AttributeExtractor" type="conf:PluggableType"/>
- <element name="AttributeResolver" type="conf:PluggableType"/>
- <element name="AttributeFilter" type="conf:PluggableType"/>
- <element name="CredentialResolver" type="conf:PluggableType"/>
- </choice>
- </sequence>
- <attribute name="id" type="conf:string" use="required"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <attributeGroup ref="conf:ApplicationGroup"/>
- <attributeGroup ref="conf:RelyingPartyGroup"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <attributeGroup name="ApplicationGroup">
- <attribute name="homeURL" type="conf:anyURI"/>
- <attribute name="policyId" type="conf:string"/>
- <attribute name="REMOTE_USER" type="conf:listOfStrings"/>
- <attribute name="unsetHeaders" type="conf:listOfStrings"/>
- <attribute name="metadataAttributePrefix" type="conf:string"/>
- <attribute name="attributePrefix" type="conf:string"/>
- <attribute name="requireAuthenticatedEncryption" type="boolean"/>
- </attributeGroup>
-
- <attributeGroup name="RelyingPartyGroup">
- <attribute name="authType" type="conf:string"/>
- <attribute name="authUsername" type="conf:string"/>
- <attribute name="authPassword" type="conf:string"/>
- <attribute name="signing" type="conf:bindingBoolean"/>
- <attribute name="signingAlg" type="conf:anyURI"/>
- <attribute name="digestAlg" type="conf:anyURI"/>
- <attribute name="encryption" type="conf:bindingBoolean"/>
- <attribute name="encryptionAlg" type="conf:anyURI"/>
- <attribute name="keyName" type="conf:string"/>
- <attribute name="artifactEndpointIndex" type="unsignedShort"/>
- <attribute name="chunkedEncoding" type="boolean"/>
- <attribute name="connectTimeout" type="unsignedShort"/>
- <attribute name="timeout" type="unsignedShort"/>
- <attribute name="cipherSuites" type="string"/>
- <attribute name="requireConfidentiality" type="boolean"/>
- <attribute name="requireTransportAuth" type="boolean"/>
- <attribute name="requireSignedAssertions" type="boolean"/>
- <attribute name="sessionHook" type="conf:anyURI"/>
- <attribute name="artifactByFilesystem" type="boolean"/>
- <attribute name="authnContextClassRef" type="conf:listOfURIs"/>
- <attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
- <attribute name="NameIDFormat" type="conf:anyURI"/>
- <attribute name="SPNameQualifier" type="conf:string"/>
- <attribute name="requestDelegation" type="boolean"/>
- </attributeGroup>
-
- <complexType name="SessionsType">
- <annotation>
- <documentation>Container for specifying protocol handlers and session policy</documentation>
- </annotation>
- <sequence>
- <element name="SSO" minOccurs="0">
- <complexType>
- <annotation>
- <documentation>Implicitly configures SessionInitiator and AssertionConsumerService handlers</documentation>
- </annotation>
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="policyId" type="conf:string"/>
- <attribute name="ignoreNoPassive" type="boolean"/>
- <attribute name="discoveryProtocol" type="conf:string"/>
- <attribute name="discoveryURL" type="conf:anyURI"/>
- <attributeGroup ref="conf:SessionInitiatorGroup"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <element name="Logout" minOccurs="0">
- <complexType>
- <annotation>
- <documentation>Implicitly configures LogoutInitiator and SingleLogoutService handlers</documentation>
- </annotation>
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="policyId" type="conf:string"/>
- <attributeGroup ref="conf:LogoutInitiatorGroup"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <element name="NameIDMgmt" minOccurs="0">
- <complexType>
- <annotation>
- <documentation>Implicitly configures ManageNameIDService handlers</documentation>
- </annotation>
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="policyId" type="conf:string"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element ref="conf:SessionInitiator"/>
- <element ref="conf:LogoutInitiator"/>
- <element ref="md:AssertionConsumerService"/>
- <element ref="md:ArtifactResolutionService"/>
- <element ref="md:SingleLogoutService"/>
- <element ref="md:ManageNameIDService"/>
- <element ref="conf:Handler"/>
- </choice>
- </sequence>
- <attribute name="handlerURL" type="conf:anyURI"/>
- <attribute name="handlerSSL" type="boolean"/>
- <attribute name="exportLocation" type="conf:string"/>
- <attribute name="exportACL" type="conf:listOfStrings"/>
- <attribute name="cookieName" type="conf:string"/>
- <attribute name="cookieProps" type="conf:string"/>
- <attribute name="cookieLifetime" type="unsignedInt"/>
- <attribute name="idpHistory" type="boolean"/>
- <attribute name="idpHistoryDays" type="unsignedInt"/>
- <attribute name="idpHistoryProps" type="conf:string"/>
- <attribute name="lifetime" type="unsignedInt"/>
- <attribute name="timeout" type="unsignedInt"/>
- <attribute name="maxTimeSinceAuthn" type="unsignedInt"/>
- <attribute name="checkAddress" type="boolean"/>
- <attribute name="consistentAddress" type="boolean"/>
- <attribute name="postData" type="conf:string"/>
- <attribute name="postLimit" type="positiveInteger"/>
- <attribute name="postTemplate" type="conf:string"/>
- <attribute name="postExpire" type="boolean"/>
- <attribute name="relayState" type="conf:string"/>
- <attribute name="relayStateLimit" type="conf:redirectLimitType"/>
- <attribute name="relayStateWhitelist" type="conf:listOfURIs"/>
- <attribute name="redirectLimit" type="conf:redirectLimitType"/>
- <attribute name="redirectWhitelist" type="conf:listOfURIs"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <attribute name="policyId" type="conf:string">
- <annotation>
- <documentation>Used to override Policy from profile endpoints</documentation>
- </annotation>
- </attribute>
-
- <attribute name="ignoreNoPassive" type="boolean">
- <annotation>
- <documentation>Used to ignore NoPassive errors in AssertionConsumerService endpoints</documentation>
- </annotation>
- </attribute>
-
- <attribute name="signing" type="conf:bindingBoolean">
- <annotation>
- <documentation>Used to override signing property in SingleLogoutService/etc endpoints</documentation>
- </annotation>
- </attribute>
-
- <attribute name="encryption" type="conf:bindingBoolean">
- <annotation>
- <documentation>Used to override encryption property in SingleLogoutService/etc endpoints</documentation>
- </annotation>
- </attribute>
-
- <attributeGroup name="SessionInitiatorGroup">
- <annotation>
- <documentation>Options common to explicit and implicit SessionInitiators</documentation>
- </annotation>
- <attribute name="relayState" type="conf:string"/>
- <attribute name="entityIDParam" type="conf:string"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <attribute name="outgoingBindings" type="conf:listOfURIs"/>
- <attribute name="preservedOptions" type="conf:listOfStrings"/>
- <attribute name="template" type="conf:anyURI"/>
- <attribute name="postArtifact" type="boolean"/>
- <attribute name="acsByIndex" type="boolean"/>
- <attribute name="isPassive" type="boolean"/>
- <attribute name="returnOnError" type="boolean"/>
- <attribute name="forceAuthn" type="boolean"/>
- <attribute name="authnContextClassRef" type="conf:anyURI"/>
- <attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
- <attribute name="NameIDFormat" type="conf:anyURI"/>
- <attribute name="SPNameQualifier" type="conf:string"/>
- <attribute name="requestDelegation" type="boolean"/>
- <attribute name="target" type="conf:anyURI"/>
- <attribute name="discoveryPolicy" type="conf:string"/>
- <attribute name="signing" type="conf:bindingBoolean"/>
- <attribute name="encryption" type="conf:bindingBoolean"/>
- <attribute name="externalInput" type="boolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </attributeGroup>
-
- <element name="SessionInitiator">
- <annotation>
- <documentation>Used to specify handlers that can issue AuthnRequests or perform discovery</documentation>
- </annotation>
- <complexType>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Location" type="conf:anyURI"/>
- <attribute name="id" type="conf:string"/>
- <attribute name="isDefault" type="boolean"/>
- <attribute name="URL" type="conf:anyURI"/>
- <attribute name="acsIndex" type="unsignedShort"/>
- <attribute name="defaultACSIndex" type="unsignedShort"/> <!-- deprecated -->
- <attributeGroup ref="conf:SessionInitiatorGroup"/>
- </restriction>
- </complexContent>
- </complexType>
- </element>
-
- <attributeGroup name="LogoutInitiatorGroup">
- <annotation>
- <documentation>Options common to explicit and implicit LogoutInitiators</documentation>
- </annotation>
- <attribute name="relayState" type="conf:string"/>
- <attribute name="outgoingBindings" type="conf:listOfURIs"/>
- <attribute name="template" type="conf:anyURI"/>
- <attribute name="postArtifact" type="boolean"/>
- <attribute name="signing" type="conf:bindingBoolean"/>
- <attribute name="encryption" type="conf:bindingBoolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </attributeGroup>
-
- <element name="LogoutInitiator">
- <annotation>
- <documentation>Used to specify handlers that can issue LogoutRequests</documentation>
- </annotation>
- <complexType>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Location" type="conf:anyURI"/>
- <attributeGroup ref="conf:LogoutInitiatorGroup"/>
- </restriction>
- </complexContent>
- </complexType>
- </element>
-
- <element name="Handler">
- <annotation>
- <documentation>Used to specify custom handlers</documentation>
- </annotation>
- <complexType>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Location" type="conf:anyURI" use="required"/>
- <attribute name="acl" type="conf:listOfStrings"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </restriction>
- </complexContent>
- </complexType>
- </element>
-
- <complexType name="ErrorsType">
- <annotation>
- <documentation>Container for error templates and associated details</documentation>
- </annotation>
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="redirectErrors" type="conf:anyURI"/>
- <attribute name="session" type="conf:anyURI"/>
- <attribute name="metadata" type="conf:anyURI"/>
- <attribute name="access" type="conf:anyURI"/>
- <attribute name="ssl" type="conf:anyURI"/>
- <attribute name="localLogout" type="conf:anyURI"/>
- <attribute name="globalLogout" type="conf:anyURI"/>
- <attribute name="partialLogout" type="conf:anyURI"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <complexType name="RelyingPartyType">
- <annotation>
- <documentation>Container for specifying settings to use with particular peers</documentation>
- </annotation>
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Name" type="conf:string"/>
- <attribute name="type" type="conf:string"/>
- <attributeGroup ref="conf:RelyingPartyGroup"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <complexType name="NotifyType">
- <annotation>
- <documentation>Used to specify locations to receive application notifications</documentation>
- </annotation>
- <sequence/>
- <attribute name="Channel" use="required">
- <simpleType>
- <restriction base="string">
- <enumeration value="front"/>
- <enumeration value="back"/>
- </restriction>
- </simpleType>
- </attribute>
- <attribute name="Location" type="conf:anyURI" use="required"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <element name="SecurityPolicies">
- <complexType>
- <annotation>
- <documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>
- </annotation>
- <sequence>
- <element name="Policy" minOccurs="1" maxOccurs="unbounded">
- <annotation>
- <documentation>Specifies a set of SecurityPolicyRule plugins</documentation>
- </annotation>
- <complexType>
- <choice>
- <element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
- <element name="PolicyRule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
- </choice>
- <attribute name="id" type="conf:string" use="required"/>
- <attribute name="validate" type="boolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- </element>
- <choice minOccurs="0">
- <element name="AlgorithmWhitelist" type="conf:listOfURIs"/>
- <element name="AlgorithmBlacklist">
- <complexType>
- <simpleContent>
- <extension base="conf:listOfURIs">
- <attribute name="includeDefaultBlacklist" type="boolean"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- </choice>
- </sequence>
- </complexType>
- </element>
-
- <element name="TransportOption">
- <annotation>
- <documentation>Implementation-specific option to pass to SOAPTransport provider.</documentation>
- </annotation>
- <complexType>
- <simpleContent>
- <extension base="anySimpleType">
- <attribute name="provider" type="conf:string" use="required"/>
- <attribute name="option" type="conf:string" use="required"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
-
- <element name="SPConfig">
- <complexType>
- <annotation>
- <documentation>Root of configuration</documentation>
- </annotation>
- <sequence>
- <element name="Extensions" type="conf:ExtensionsType" minOccurs="0"/>
- <element name="OutOfProcess" type="conf:OutOfProcessType" minOccurs="0"/>
- <element name="InProcess" type="conf:InProcessType" minOccurs="0"/>
- <choice minOccurs="0">
- <element name="UnixListener">
- <complexType>
- <attribute name="address" type="conf:string"/>
- <attribute name="clientAddress" type="conf:string"/>
- <attribute name="stackSize" type="unsignedInt"/>
- </complexType>
- </element>
- <element name="TCPListener">
- <complexType>
- <attribute name="address" type="conf:string"/>
- <attribute name="port" type="unsignedInt"/>
- <attribute name="clientAddress" type="conf:string"/>
- <attribute name="clientPort" type="unsignedInt"/>
- <attribute name="acl" type="conf:listOfStrings"/>
- <attribute name="stackSize" type="unsignedInt"/>
- </complexType>
- </element>
- <element name="Listener" type="conf:PluggableType"/>
- </choice>
- <element name="StorageService" type="conf:StorageServiceType" minOccurs="0" maxOccurs="unbounded"/>
- <element name="SessionCache" type="conf:SessionCacheType" minOccurs="0"/>
- <element name="ReplayCache" type="conf:ReplayCacheType" minOccurs="0"/>
- <element name="ArtifactMap" type="conf:ArtifactMapType" minOccurs="0"/>
- <element name="RequestMapper" type="conf:PluggableType" minOccurs="0"/>
- <element name="ApplicationDefaults" type="conf:ApplicationDefaultsType"/>
- <choice>
- <element name="SecurityPolicyProvider" type="conf:PluggableType"/>
- <element ref="conf:SecurityPolicies"/> <!-- deprecated -->
- </choice>
- <element name="ProtocolProvider" type="conf:PluggableType" minOccurs="0"/>
- <element ref="conf:TransportOption" minOccurs="0" maxOccurs="unbounded"/>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- <attribute name="logger" type="conf:anyURI"/>
- <attribute name="clockSkew" type="unsignedInt"/>
- <attribute name="unsafeChars" type="conf:string"/>
- <attribute name="allowedSchemes" type="conf:listOfStrings"/>
- <attribute name="langFromClient" type="boolean"/>
- <attribute name="langPriority" type="conf:listOfStrings"/>
- <attribute name="contactPriority" type="conf:listOfStrings"/>
-
- <!-- Unsupported. -->
- <attribute name="disableDTD" type="boolean"/>
-
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
- </element>
-
-</schema>
diff --git a/schemas/shibboleth-2.0-native-sp-protocols.xsd b/schemas/shibboleth-2.0-native-sp-protocols.xsd
deleted file mode 100644
index 63ae444e..00000000
--- a/schemas/shibboleth-2.0-native-sp-protocols.xsd
+++ /dev/null
@@ -1,59 +0,0 @@
-<?xml version="1.0" encoding="US-ASCII"?>
-<schema targetNamespace="urn:mace:shibboleth:2.0:native:sp:protocols"
- xmlns:prot="urn:mace:shibboleth:2.0:native:sp:protocols"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- xmlns="http://www.w3.org/2001/XMLSchema"
- attributeFormDefault="unqualified"
- elementFormDefault="qualified"
- blockDefault="substitution"
- version="2.4">
-
- <annotation>
- <documentation>
- Schema for specifying protocols, services, and bindings, and defaults for the locations of handlers.
- First appearing in Shibboleth 2.4 release.
- </documentation>
- </annotation>
-
- <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd" />
-
- <simpleType name="string">
- <restriction base="string">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <element name="Protocols">
- <complexType>
- <sequence>
- <element name="Protocol" maxOccurs="unbounded">
- <complexType>
- <sequence>
- <element name="Service" maxOccurs="unbounded">
- <complexType>
- <sequence>
- <element name="Initiator" minOccurs="0">
- <complexType>
- <attribute name="id" type="prot:string" use="required" />
- </complexType>
- </element>
- <element name="Binding" minOccurs="0" maxOccurs="unbounded">
- <complexType>
- <attribute name="id" type="prot:string" use="required" />
- <attribute name="path" type="prot:string" use="required" />
- </complexType>
- </element>
- </sequence>
- <attribute name="id" type="prot:string" use="required" />
- </complexType>
- </element>
- </sequence>
- <attribute name="id" type="prot:string" use="required" />
- </complexType>
- </element>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- </complexType>
- </element>
-
-</schema>
diff --git a/schemas/shibboleth-2.0-sp-notify.xsd b/schemas/shibboleth-2.0-sp-notify.xsd
deleted file mode 100644
index 6a46bfb8..00000000
--- a/schemas/shibboleth-2.0-sp-notify.xsd
+++ /dev/null
@@ -1,64 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<schema targetNamespace="urn:mace:shibboleth:2.0:sp:notify"
- xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:notify="urn:mace:shibboleth:2.0:sp:notify"
- xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
- xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
- elementFormDefault="qualified">
-
- <annotation>
- <documentation>
- Defines local application notification protocol used by SP.
- </documentation>
- </annotation>
-
- <import namespace="urn:oasis:names:tc:SAML:2.0:assertion"
- schemaLocation="saml-schema-assertion-2.0.xsd"/>
-
- <import namespace="urn:oasis:names:tc:SAML:2.0:protocol"
- schemaLocation="saml-schema-protocol-2.0.xsd"/>
-
- <simpleType name="string">
- <restriction base="string">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <element name="OK" type="notify:OKType"/>
- <complexType name="OKType">
- <sequence/>
- </complexType>
-
- <element name="LogoutNotification" type="notify:LogoutNotificationType"/>
- <complexType name="LogoutNotificationType">
- <annotation>
- <documentation>Notifies application of a logout event.</documentation>
- </annotation>
- <sequence>
- <element name="SessionID" type="notify:string" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="type">
- <simpleType>
- <restriction base="string">
- <enumeration value="local"/>
- <enumeration value="global"/>
- </restriction>
- </simpleType>
- </attribute>
- </complexType>
-
- <element name="NameIDNotification" type="notify:NameIDNotificationType"/>
- <complexType name="NameIDNotificationType">
- <annotation>
- <documentation>Notifies application of a NameID management event.</documentation>
- </annotation>
- <sequence>
- <element ref="saml:NameID"/>
- <choice>
- <element ref="samlp:NewID"/>
- <element ref="samlp:Terminate"/>
- </choice>
- </sequence>
- </complexType>
-
-</schema>
diff --git a/schemas/shibboleth-3.0-native-sp-config.xsd b/schemas/shibboleth-3.0-native-sp-config.xsd
deleted file mode 100644
index 9eb7a4bb..00000000
--- a/schemas/shibboleth-3.0-native-sp-config.xsd
+++ /dev/null
@@ -1,908 +0,0 @@
-<?xml version="1.0" encoding="US-ASCII"?>
-<schema targetNamespace="urn:mace:shibboleth:3.0:native:sp:config"
- xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
- xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
- xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
- elementFormDefault="qualified"
- attributeFormDefault="unqualified"
- blockDefault="substitution"
- version="3.4">
-
- <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd" />
- <import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="saml-schema-assertion-2.0.xsd"/>
- <import namespace="urn:oasis:names:tc:SAML:2.0:protocol" schemaLocation="saml-schema-protocol-2.0.xsd"/>
- <import namespace="urn:oasis:names:tc:SAML:2.0:metadata" schemaLocation="saml-schema-metadata-2.0.xsd"/>
-
- <annotation>
- <documentation>
- 3.x schema for XML-based configuration of Shibboleth Native SP instances.
- First appearing in Shibboleth 3.0 release.
- </documentation>
- </annotation>
-
- <simpleType name="string">
- <restriction base="string">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <simpleType name="listOfStrings">
- <list itemType="conf:string"/>
- </simpleType>
-
- <simpleType name="anyURI">
- <restriction base="anyURI">
- <minLength value="1"/>
- </restriction>
- </simpleType>
-
- <simpleType name="listOfURIs">
- <list itemType="conf:anyURI"/>
- </simpleType>
-
- <simpleType name="bindingBoolean">
- <restriction base="string">
- <enumeration value="true"/>
- <enumeration value="false"/>
- <enumeration value="front"/>
- <enumeration value="back"/>
- <enumeration value="conditional" />
- </restriction>
- </simpleType>
-
- <simpleType name="redirectLimitType">
- <restriction base="string">
- <enumeration value="none"/>
- <enumeration value="exact"/>
- <enumeration value="host"/>
- <enumeration value="whitelist"/>
- <enumeration value="exact+whitelist"/>
- <enumeration value="host+whitelist"/>
- <enumeration value="allow"/>
- <enumeration value="exact+allow"/>
- <enumeration value="host+allow"/>
- </restriction>
- </simpleType>
-
- <simpleType name="sameSiteType">
- <restriction base="string">
- <enumeration value="None"/>
- <enumeration value="Lax"/>
- <enumeration value="Strict"/>
- </restriction>
- </simpleType>
-
- <complexType name="PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="type" type="conf:string" use="required"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <complexType name="ExtensionsType">
- <annotation>
- <documentation>Container for extension libraries and custom configuration</documentation>
- </annotation>
- <sequence>
- <element name="Library" minOccurs="0" maxOccurs="unbounded">
- <complexType>
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="path" type="conf:anyURI" use="required"/>
- <attribute name="fatal" type="boolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- </element>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- </complexType>
-
- <complexType name="DataSealerType">
- <annotation>
- <documentation>References DataSealer plugins</documentation>
- </annotation>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <anyAttribute namespace="##any" processContents="lax"/>
- </restriction>
- </complexContent>
- </complexType>
-
- <complexType name="StorageServiceType">
- <annotation>
- <documentation>References StorageService plugins</documentation>
- </annotation>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="id" type="ID" use="required"/>
- <attribute name="cleanupInterval" type="unsignedInt"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </restriction>
- </complexContent>
- </complexType>
-
- <complexType name="SessionCacheType">
- <annotation>
- <documentation>References SessionCache plugins</documentation>
- </annotation>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="StorageService" type="IDREF"/>
- <attribute name="cacheAllowance" type="unsignedInt"/>
- <attribute name="maintainReverseIndex" type="boolean"/>
- <attribute name="reverseIndexMaxSize" type="unsignedInt"/>
- <attribute name="excludeReverseIndex" type="conf:listOfStrings"/>
- <attribute name="persistedAttributes" type="conf:listOfStrings"/>
- <attribute name="unreliableNetworks" type="conf:listOfStrings"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </restriction>
- </complexContent>
- </complexType>
-
- <complexType name="ReplayCacheType">
- <annotation>
- <documentation>Ties ReplayCache to a custom StorageService</documentation>
- </annotation>
- <sequence/>
- <attribute name="StorageService" type="IDREF"/>
- </complexType>
-
- <complexType name="ArtifactMapType">
- <annotation>
- <documentation>Customizes an ArtifactMap</documentation>
- </annotation>
- <sequence/>
- <attribute name="StorageService" type="IDREF"/>
- <attribute name="context" type="conf:string"/>
- <attribute name="artifactTTL" type="unsignedInt"/>
- </complexType>
-
- <complexType name="OutOfProcessType">
- <annotation>
- <documentation>Container for out-of-process (shibd) configuration</documentation>
- </annotation>
- <sequence>
- <element name="Extensions" type="conf:ExtensionsType" minOccurs="0"/>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="logger" type="conf:anyURI"/>
- <attribute name="tranLogFormat" type="conf:string"/>
- <attribute name="tranLogFiller" type="conf:string"/>
- <attribute name="catchAll" type="boolean"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <complexType name="InProcessType">
- <annotation>
- <documentation>
- Container for configuration of locally integrated or platform-specific
- features (e.g. web server filters)
- </documentation>
- </annotation>
- <sequence>
- <element name="Extensions" type="conf:ExtensionsType" minOccurs="0"/>
- <element name="ISAPI" minOccurs="0">
- <complexType>
- <choice maxOccurs="unbounded" minOccurs="0">
- <element name="Site">
- <complexType>
- <sequence>
- <element name="Alias" type="conf:string" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="id" type="unsignedInt" use="required"/>
- <attribute name="name" type="conf:string" use="required"/>
- <attribute name="port" type="unsignedInt"/>
- <attribute name="useHeaders" type="boolean"/>
- <attribute name="useVariables" type="boolean"/>
- <attribute name="sslport" type="unsignedInt"/>
- <attribute name="scheme" type="conf:string"/>
- </complexType>
- </element>
- <element name="Roles">
- <complexType>
- <attribute name="authNRole" type="string" use="optional"/>
- <attribute name="roleAttributes" type="string" use="optional"/>
- </complexType>
- </element>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </choice>
- <attribute name="normalizeRequest" type="boolean"/>
- <attribute name="safeHeaderNames" type="boolean"/>
- <attribute name="useHeaders" type="boolean"/>
- <attribute name="useVariables" type="boolean"/>
- <attribute name="handlerPrefix" type="conf:string" use="optional"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
- </element>
- <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="logger" type="conf:anyURI"/>
- <attribute name="unsetHeaderValue" type="conf:string"/>
- <attribute name="checkSpoofing" type="boolean"/>
- <attribute name="spoofKey" type="conf:string"/>
- <attribute name="catchAll" type="boolean"/>
- <attribute name="extraAuthTypes" type="conf:listOfStrings"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <element name="AccessControl" type="conf:UniOperatorType">
- <annotation>
- <documentation>
- A simple example access policy language extension that supersedes Apache .htaccess
- </documentation>
- </annotation>
- </element>
- <complexType name="UniOperatorType">
- <choice>
- <element name="AND" type="conf:MultiOperatorType"/>
- <element name="OR" type="conf:MultiOperatorType"/>
- <element name="NOT" type="conf:UniOperatorType"/>
- <element name="Rule" type="conf:RuleType"/>
- <element name="RuleRegex" type="conf:RuleRegexType"/>
- </choice>
- </complexType>
- <complexType name="MultiOperatorType">
- <choice minOccurs="2" maxOccurs="unbounded">
- <element name="AND" type="conf:MultiOperatorType"/>
- <element name="OR" type="conf:MultiOperatorType"/>
- <element name="NOT" type="conf:UniOperatorType"/>
- <element name="Rule" type="conf:RuleType"/>
- <element name="RuleRegex" type="conf:RuleRegexType"/>
- </choice>
- </complexType>
- <complexType name="RuleType">
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="require" type="conf:string" use="required"/>
- <attribute name="list" type="boolean"/>
- </extension>
- </simpleContent>
- </complexType>
- <complexType name="RuleRegexType">
- <simpleContent>
- <extension base="conf:string">
- <attribute name="require" type="conf:string" use="required"/>
- <attribute name="caseSensitive" type="boolean"/>
- </extension>
- </simpleContent>
- </complexType>
-
- <attributeGroup name="ContentSettings">
- <attribute name="applicationId" type="conf:string"/>
- <attribute name="authType" type="conf:string"/>
- <attribute name="requireSession" type="boolean"/>
- <attribute name="requireSessionWith" type="conf:string"/>
- <attribute name="requireLogoutWith" type="conf:anyURI"/>
- <attribute name="exportAssertion" type="boolean"/>
- <attribute name="exportStdVars" type="boolean"/>
- <attribute name="exportCookie" type="boolean"/>
- <attribute name="exportDuplicateValues" type="boolean"/>
- <attribute name="redirectToSSL" type="unsignedInt"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <attribute name="entityIDSelf" type="conf:anyURI"/>
- <attribute name="discoveryURL" type="conf:anyURI"/>
- <attribute name="discoveryPolicy" type="conf:string"/>
- <attribute name="isPassive" type="boolean"/>
- <attribute name="returnOnError" type="boolean"/>
- <attribute name="forceAuthn" type="boolean"/>
- <attribute name="authnContextClassRef" type="conf:listOfURIs"/>
- <attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
- <attribute name="NameIDFormat" type="conf:anyURI"/>
- <attribute name="SPNameQualifier" type="conf:string"/>
- <attribute name="redirectErrors" type="conf:anyURI"/>
- <attribute name="sessionError" type="conf:anyURI"/>
- <attribute name="metadataError" type="conf:anyURI"/>
- <attribute name="accessError" type="conf:anyURI"/>
- <attribute name="sslError" type="conf:anyURI"/>
- <attribute name="target" type="conf:anyURI"/>
- <attribute name="acsIndex" type="unsignedShort"/>
- <attribute name="attributeIndex" type="conf:string"/>
- <attribute name="REMOTE_ADDR" type="conf:string"/>
- <attribute name="encoding" type="conf:string"/>
- <attribute name="attributeValueDelimiter" type="conf:string"/>
- <attribute name="unset" type="conf:listOfStrings"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </attributeGroup>
-
- <element name="RequestMap">
- <annotation>
- <documentation>
- Built-in request mapping syntax, decomposes URLs into Host/Path/Path/...
- </documentation>
- </annotation>
- <complexType>
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Host" type="conf:HostType"/>
- <element name="HostRegex" type="conf:HostRegexType"/>
- </choice>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- <attribute name="unicodeAware" type="boolean"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
- </element>
-
- <complexType name="HostType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Path" type="conf:PathType"/>
- <element name="PathRegex" type="conf:PathRegexType"/>
- <element name="Query" type="conf:QueryType"/>
- </choice>
- </sequence>
- <attribute name="scheme">
- <simpleType>
- <restriction base="conf:string">
- <enumeration value="http"/>
- <enumeration value="https"/>
- <enumeration value="ftp"/>
- <enumeration value="ldap"/>
- <enumeration value="ldaps"/>
- </restriction>
- </simpleType>
- </attribute>
- <attribute name="name" type="conf:string" use="required"/>
- <attribute name="port" type="unsignedInt"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="HostRegexType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Path" type="conf:PathType"/>
- <element name="PathRegex" type="conf:PathRegexType"/>
- <element name="Query" type="conf:QueryType"/>
- </choice>
- </sequence>
- <attribute name="regex" type="conf:string" use="required"/>
- <attribute name="caseSensitive" type="boolean"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="PathType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="Path" type="conf:PathType"/>
- <element name="PathRegex" type="conf:PathRegexType"/>
- <element name="Query" type="conf:QueryType"/>
- </choice>
- </sequence>
- <attribute name="name" type="conf:string" use="required"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="PathRegexType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <element name="Query" type="conf:QueryType" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="regex" type="conf:string" use="required"/>
- <attribute name="caseSensitive" type="boolean"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="QueryType">
- <sequence>
- <choice minOccurs="0">
- <element name="htaccess" type="conf:PluggableType"/>
- <element ref="conf:AccessControl"/>
- <element name="AccessControlProvider" type="conf:PluggableType"/>
- </choice>
- <element name="Query" type="conf:QueryType" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="name" type="conf:string" use="required"/>
- <attribute name="regex" type="conf:string"/>
- <attributeGroup ref="conf:ContentSettings"/>
- </complexType>
-
- <complexType name="ApplicationDefaultsType">
- <annotation>
- <documentation>Container for default settings and application-specific overrides</documentation>
- </annotation>
- <sequence>
- <element name="Sessions" type="conf:SessionsType"/>
- <element name="Errors" type="conf:ErrorsType" minOccurs="0"/>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="RelyingParty" type="conf:RelyingPartyType"/>
- <element name="Notify" type="conf:NotifyType"/>
- <element name="MetadataProvider" type="conf:PluggableType"/>
- <element name="TrustEngine" type="conf:PluggableType"/>
- <element name="AttributeExtractor" type="conf:PluggableType"/>
- <element name="AttributeResolver" type="conf:PluggableType"/>
- <element name="AttributeFilter" type="conf:PluggableType"/>
- <element name="CredentialResolver" type="conf:PluggableType"/>
- <element ref="conf:ApplicationOverride"/>
- <element name="ExternalApplicationOverrides" type="conf:ExternalApplicationOverridesType"/>
- </choice>
- </sequence>
- <attribute name="id" type="conf:string" fixed="default"/>
- <attribute name="entityID" type="conf:anyURI" use="required"/>
- <attributeGroup ref="conf:ApplicationGroup"/>
- <attributeGroup ref="conf:RelyingPartyGroup"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <element name="ApplicationOverride" type="conf:ApplicationOverrideType"/>
-
- <complexType name="ApplicationOverrideType">
- <annotation>
- <documentation>Container for application-specific overrides</documentation>
- </annotation>
- <sequence>
- <element name="Sessions" type="conf:SessionsType" minOccurs="0"/>
- <element name="Errors" type="conf:ErrorsType" minOccurs="0"/>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element name="RelyingParty" type="conf:RelyingPartyType"/>
- <element name="Notify" type="conf:NotifyType"/>
- <element name="MetadataProvider" type="conf:PluggableType"/>
- <element name="TrustEngine" type="conf:PluggableType"/>
- <element name="AttributeExtractor" type="conf:PluggableType"/>
- <element name="AttributeResolver" type="conf:PluggableType"/>
- <element name="AttributeFilter" type="conf:PluggableType"/>
- <element name="CredentialResolver" type="conf:PluggableType"/>
- </choice>
- </sequence>
- <attribute name="id" type="conf:string" use="required"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <attributeGroup ref="conf:ApplicationGroup"/>
- <attributeGroup ref="conf:RelyingPartyGroup"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <complexType name="ExternalApplicationOverridesType">
- <annotation>
- <documentation>Externalized application overrides.</documentation>
- </annotation>
- <sequence/>
- <attribute name="path" type="conf:string" use="required" />
- </complexType>
-
- <attributeGroup name="ApplicationGroup">
- <attribute name="homeURL" type="conf:anyURI"/>
- <attribute name="policyId" type="conf:string"/>
- <attribute name="REMOTE_USER" type="conf:listOfStrings"/>
- <attribute name="unsetHeaders" type="conf:listOfStrings"/>
- <attribute name="metadataAttributePrefix" type="conf:string"/>
- <attribute name="attributePrefix" type="conf:string"/>
- <attribute name="requireAuthenticatedEncryption" type="boolean"/>
- </attributeGroup>
-
- <attributeGroup name="RelyingPartyGroup">
- <attribute name="authType" type="conf:string"/>
- <attribute name="authUsername" type="conf:string"/>
- <attribute name="authPassword" type="conf:string"/>
- <attribute name="signing" type="conf:bindingBoolean"/>
- <attribute name="signingAlg" type="conf:anyURI"/>
- <attribute name="digestAlg" type="conf:anyURI"/>
- <attribute name="encryption" type="conf:bindingBoolean"/>
- <attribute name="encryptionAlg" type="conf:anyURI"/>
- <attribute name="keyName" type="conf:string"/>
- <attribute name="artifactEndpointIndex" type="unsignedShort"/>
- <attribute name="chunkedEncoding" type="boolean"/>
- <attribute name="connectTimeout" type="unsignedShort"/>
- <attribute name="timeout" type="unsignedShort"/>
- <attribute name="cipherSuites" type="string"/>
- <attribute name="requireConfidentiality" type="boolean"/>
- <attribute name="requireTransportAuth" type="boolean"/>
- <attribute name="requireSignedAssertions" type="boolean"/>
- <attribute name="sessionHook" type="conf:anyURI"/>
- <attribute name="artifactByFilesystem" type="boolean"/>
- <attribute name="authnContextClassRef" type="conf:listOfURIs"/>
- <attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
- <attribute name="NameIDFormat" type="conf:anyURI"/>
- <attribute name="SPNameQualifier" type="conf:string"/>
- <attribute name="attributeIndex" type="conf:string"/>
- <attribute name="requestDelegation" type="boolean"/>
- </attributeGroup>
-
- <complexType name="SessionsType">
- <annotation>
- <documentation>Container for specifying protocol handlers and session policy</documentation>
- </annotation>
- <sequence>
- <element name="SSO" minOccurs="0">
- <complexType>
- <annotation>
- <documentation>Implicitly configures SessionInitiator and AssertionConsumerService handlers</documentation>
- </annotation>
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="policyId" type="conf:string"/>
- <attribute name="ignoreNoPassive" type="boolean"/>
- <attribute name="discoveryProtocol" type="conf:string"/>
- <attribute name="discoveryURL" type="conf:anyURI"/>
- <attributeGroup ref="conf:SessionInitiatorGroup"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <element name="Logout" minOccurs="0">
- <complexType>
- <annotation>
- <documentation>Implicitly configures LogoutInitiator and SingleLogoutService handlers</documentation>
- </annotation>
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="policyId" type="conf:string"/>
- <attributeGroup ref="conf:LogoutInitiatorGroup"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <element name="NameIDMgmt" minOccurs="0">
- <complexType>
- <annotation>
- <documentation>Implicitly configures ManageNameIDService handlers</documentation>
- </annotation>
- <simpleContent>
- <extension base="conf:listOfStrings">
- <attribute name="policyId" type="conf:string"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <choice minOccurs="0" maxOccurs="unbounded">
- <element ref="conf:SessionInitiator"/>
- <element ref="conf:LogoutInitiator"/>
- <element ref="md:AssertionConsumerService"/>
- <element ref="md:ArtifactResolutionService"/>
- <element ref="md:SingleLogoutService"/>
- <element ref="md:ManageNameIDService"/>
- <element ref="conf:Handler"/>
- </choice>
- </sequence>
- <attribute name="handlerURL" type="conf:anyURI"/>
- <attribute name="handlerSSL" type="boolean"/>
- <attribute name="exportLocation" type="conf:string"/>
- <attribute name="exportACL" type="conf:listOfStrings"/>
- <attribute name="cookieName" type="conf:string"/>
- <attribute name="cookieProps" type="conf:string"/>
- <attribute name="sameSiteSession" type="conf:sameSiteType"/>
- <attribute name="sameSiteFallback" type="boolean"/>
- <attribute name="cookieLifetime" type="unsignedInt"/>
- <attribute name="idpHistory" type="boolean"/>
- <attribute name="idpHistoryDays" type="unsignedInt"/>
- <attribute name="idpHistoryProps" type="conf:string"/>
- <attribute name="lifetime" type="unsignedInt"/>
- <attribute name="timeout" type="unsignedInt"/>
- <attribute name="maxTimeSinceAuthn" type="unsignedInt"/>
- <attribute name="checkAddress" type="boolean"/>
- <attribute name="consistentAddress" type="boolean"/>
- <attribute name="postData" type="conf:string"/>
- <attribute name="postLimit" type="positiveInteger"/>
- <attribute name="postTemplate" type="conf:string"/>
- <attribute name="postExpire" type="boolean"/>
- <attribute name="relayState" type="conf:string"/>
- <attribute name="relayStateLimit" type="conf:redirectLimitType"/>
- <attribute name="relayStateWhitelist" type="conf:listOfURIs"/>
- <attribute name="redirectLimit" type="conf:redirectLimitType"/>
- <attribute name="redirectWhitelist" type="conf:listOfURIs"/>
- <attribute name="redirectAllow" type="conf:listOfURIs"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <attribute name="policyId" type="conf:string">
- <annotation>
- <documentation>Used to override Policy from profile endpoints</documentation>
- </annotation>
- </attribute>
-
- <attribute name="ignoreNoPassive" type="boolean">
- <annotation>
- <documentation>Used to ignore NoPassive errors in AssertionConsumerService endpoints</documentation>
- </annotation>
- </attribute>
-
- <attribute name="signing" type="conf:bindingBoolean">
- <annotation>
- <documentation>Used to override signing property in SingleLogoutService/etc endpoints</documentation>
- </annotation>
- </attribute>
-
- <attribute name="encryption" type="conf:bindingBoolean">
- <annotation>
- <documentation>Used to override encryption property in SingleLogoutService/etc endpoints</documentation>
- </annotation>
- </attribute>
-
- <attributeGroup name="SessionInitiatorGroup">
- <annotation>
- <documentation>Options common to explicit and implicit SessionInitiators</documentation>
- </annotation>
- <attribute name="relayState" type="conf:string"/>
- <attribute name="entityIDParam" type="conf:string"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <attribute name="outgoingBindings" type="conf:listOfURIs"/>
- <attribute name="preservedOptions" type="conf:listOfStrings"/>
- <attribute name="template" type="conf:anyURI"/>
- <attribute name="postArtifact" type="boolean"/>
- <attribute name="acsByIndex" type="boolean"/>
- <attribute name="isPassive" type="boolean"/>
- <attribute name="returnOnError" type="boolean"/>
- <attribute name="forceAuthn" type="boolean"/>
- <attribute name="authnContextClassRef" type="conf:anyURI"/>
- <attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
- <attribute name="NameIDFormat" type="conf:anyURI"/>
- <attribute name="SPNameQualifier" type="conf:string"/>
- <attribute name="attributeIndex" type="conf:string"/>
- <attribute name="requestDelegation" type="boolean"/>
- <attribute name="target" type="conf:anyURI"/>
- <attribute name="discoveryPolicy" type="conf:string"/>
- <attribute name="signing" type="conf:bindingBoolean"/>
- <attribute name="encryption" type="conf:bindingBoolean"/>
- <attribute name="externalInput" type="boolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </attributeGroup>
-
- <element name="SessionInitiator">
- <annotation>
- <documentation>Used to specify handlers that can issue AuthnRequests or perform discovery</documentation>
- </annotation>
- <complexType>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Location" type="conf:anyURI"/>
- <attribute name="id" type="conf:string"/>
- <attribute name="isDefault" type="boolean"/>
- <attribute name="URL" type="conf:anyURI"/>
- <attribute name="acsIndex" type="unsignedShort"/>
- <attributeGroup ref="conf:SessionInitiatorGroup"/>
- </restriction>
- </complexContent>
- </complexType>
- </element>
-
- <attributeGroup name="LogoutInitiatorGroup">
- <annotation>
- <documentation>Options common to explicit and implicit LogoutInitiators</documentation>
- </annotation>
- <attribute name="relayState" type="conf:string"/>
- <attribute name="outgoingBindings" type="conf:listOfURIs"/>
- <attribute name="template" type="conf:anyURI"/>
- <attribute name="postArtifact" type="boolean"/>
- <attribute name="signing" type="conf:bindingBoolean"/>
- <attribute name="encryption" type="conf:bindingBoolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </attributeGroup>
-
- <element name="LogoutInitiator">
- <annotation>
- <documentation>Used to specify handlers that can issue LogoutRequests</documentation>
- </annotation>
- <complexType>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Location" type="conf:anyURI"/>
- <attributeGroup ref="conf:LogoutInitiatorGroup"/>
- </restriction>
- </complexContent>
- </complexType>
- </element>
-
- <element name="Handler">
- <annotation>
- <documentation>Used to specify custom handlers</documentation>
- </annotation>
- <complexType>
- <complexContent>
- <restriction base="conf:PluggableType">
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Location" type="conf:anyURI" use="required"/>
- <attribute name="acl" type="conf:listOfStrings"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </restriction>
- </complexContent>
- </complexType>
- </element>
-
- <complexType name="ErrorsType">
- <annotation>
- <documentation>Container for error templates and associated details</documentation>
- </annotation>
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="redirectErrors" type="conf:anyURI"/>
- <attribute name="session" type="conf:anyURI"/>
- <attribute name="metadata" type="conf:anyURI"/>
- <attribute name="access" type="conf:anyURI"/>
- <attribute name="ssl" type="conf:anyURI"/>
- <attribute name="localLogout" type="conf:anyURI"/>
- <attribute name="globalLogout" type="conf:anyURI"/>
- <attribute name="partialLogout" type="conf:anyURI"/>
- <attribute name="externalParameters" type="boolean" />
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <complexType name="RelyingPartyType">
- <annotation>
- <documentation>Container for specifying settings to use with particular peers</documentation>
- </annotation>
- <sequence>
- <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Name" type="conf:string"/>
- <attribute name="type" type="conf:string"/>
- <attributeGroup ref="conf:RelyingPartyGroup"/>
- <attribute name="entityID" type="conf:anyURI"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <complexType name="NotifyType">
- <annotation>
- <documentation>Used to specify locations to receive application notifications</documentation>
- </annotation>
- <sequence/>
- <attribute name="Channel" use="required">
- <simpleType>
- <restriction base="string">
- <enumeration value="front"/>
- <enumeration value="back"/>
- </restriction>
- </simpleType>
- </attribute>
- <attribute name="Location" type="conf:anyURI" use="required"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <element name="SecurityPolicies">
- <complexType>
- <annotation>
- <documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>
- </annotation>
- <sequence>
- <element name="Policy" minOccurs="1" maxOccurs="unbounded">
- <annotation>
- <documentation>Specifies a set of SecurityPolicyRule plugins</documentation>
- </annotation>
- <complexType>
- <choice>
- <element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
- <element name="PolicyRule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
- </choice>
- <attribute name="id" type="conf:string" use="required"/>
- <attribute name="validate" type="boolean"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- </element>
- <choice minOccurs="0">
- <element name="AlgorithmWhitelist" type="conf:listOfURIs"/>
- <element name="AlgorithmBlacklist">
- <complexType>
- <simpleContent>
- <extension base="conf:listOfURIs">
- <attribute name="includeDefaultBlacklist" type="boolean"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <element name="IncludedAlgorithms" type="conf:listOfURIs"/>
- <element name="ExcludedAlgorithms">
- <complexType>
- <simpleContent>
- <extension base="conf:listOfURIs">
- <attribute name="excludeDefaults" type="boolean"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- </choice>
- </sequence>
- </complexType>
- </element>
-
- <element name="TransportOption">
- <annotation>
- <documentation>Implementation-specific option to pass to SOAPTransport provider.</documentation>
- </annotation>
- <complexType>
- <simpleContent>
- <extension base="anySimpleType">
- <attribute name="provider" type="conf:string" use="required"/>
- <attribute name="option" type="conf:string" use="required"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
-
- <element name="SPConfig">
- <complexType>
- <annotation>
- <documentation>Root of configuration</documentation>
- </annotation>
- <sequence>
- <element name="Extensions" type="conf:ExtensionsType" minOccurs="0"/>
- <element name="OutOfProcess" type="conf:OutOfProcessType" minOccurs="0"/>
- <element name="InProcess" type="conf:InProcessType" minOccurs="0"/>
- <choice minOccurs="0">
- <element name="UnixListener">
- <complexType>
- <attribute name="address" type="conf:string"/>
- <attribute name="clientAddress" type="conf:string"/>
- <attribute name="stackSize" type="unsignedInt"/>
- </complexType>
- </element>
- <element name="TCPListener">
- <complexType>
- <attribute name="address" type="conf:string"/>
- <attribute name="port" type="unsignedInt"/>
- <attribute name="clientAddress" type="conf:string"/>
- <attribute name="clientPort" type="unsignedInt"/>
- <attribute name="acl" type="conf:listOfStrings"/>
- <attribute name="stackSize" type="unsignedInt"/>
- <attribute name="retryErrors" type="conf:string"/>
- </complexType>
- </element>
- <element name="Listener" type="conf:PluggableType"/>
- </choice>
- <element name="StorageService" type="conf:StorageServiceType" minOccurs="0" maxOccurs="unbounded"/>
- <element name="DataSealer" type="conf:DataSealerType" minOccurs="0" />
- <element name="SessionCache" type="conf:SessionCacheType" minOccurs="0"/>
- <element name="ReplayCache" type="conf:ReplayCacheType" minOccurs="0"/>
- <element name="ArtifactMap" type="conf:ArtifactMapType" minOccurs="0"/>
- <element name="RequestMapper" type="conf:PluggableType" minOccurs="0"/>
- <element name="ApplicationDefaults" type="conf:ApplicationDefaultsType"/>
- <element name="SecurityPolicyProvider" type="conf:PluggableType"/>
- <element name="ProtocolProvider" type="conf:PluggableType" minOccurs="0"/>
- <element ref="conf:TransportOption" minOccurs="0" maxOccurs="unbounded"/>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- <attribute name="logger" type="conf:anyURI"/>
- <attribute name="clockSkew" type="unsignedInt"/>
- <attribute name="unsafeChars" type="conf:string"/>
- <attribute name="allowedSchemes" type="conf:listOfStrings"/>
- <attribute name="langFromClient" type="boolean"/>
- <attribute name="langPriority" type="conf:listOfStrings"/>
- <attribute name="contactPriority" type="conf:listOfStrings"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
- </element>
-
-</schema>
diff --git a/schemas/shibboleth-metadata-1.0.xsd b/schemas/shibboleth-metadata-1.0.xsd
deleted file mode 100644
index be1441dd..00000000
--- a/schemas/shibboleth-metadata-1.0.xsd
+++ /dev/null
@@ -1,42 +0,0 @@
-<?xml version="1.0" encoding="US-ASCII"?>
-<schema targetNamespace="urn:mace:shibboleth:metadata:1.0"
- xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- elementFormDefault="unqualified"
- attributeFormDefault="unqualified"
- version="1.0">
-
- <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
-
- <element name="Scope">
- <annotation>
- <documentation>
- SAML metadata extension used to regulate allowable attribute scopes.
- </documentation>
- </annotation>
- <complexType>
- <simpleContent>
- <extension base="string">
- <attribute name="regexp" type="boolean" use="optional" default="false"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
-
- <element name="KeyAuthority">
- <annotation>
- <documentation>
- Binds keying authorities to the system entity/entities to which the enclosing
- metadata element applies.
- </documentation>
- </annotation>
- <complexType>
- <sequence>
- <element ref="ds:KeyInfo" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="VerifyDepth" type="unsignedByte" use="optional" default="1"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
- </element>
-
-</schema>
diff --git a/schemas/shibboleth.xsd b/schemas/shibboleth.xsd
deleted file mode 100644
index 307e3b67..00000000
--- a/schemas/shibboleth.xsd
+++ /dev/null
@@ -1,300 +0,0 @@
-<?xml version="1.0" encoding="US-ASCII"?>
-<schema targetNamespace="urn:mace:shibboleth:1.0"
- xmlns="http://www.w3.org/2001/XMLSchema"
- xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
- xmlns:xml="http://www.w3.org/XML/1998/namespace"
- xmlns:shib="urn:mace:shibboleth:1.0"
- elementFormDefault="qualified"
- attributeFormDefault="unqualified"
- version="1.3">
-
- <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
- <import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="xml.xsd"/>
-
- <!-- Status-Related Information -->
-
- <!--
- The following SAML sub-status codes are defined in this namespace:
-
- "InvalidHandle"
- Used with samlp:Requester, signals AA did not recognize handle as valid
- -->
-
- <!--
- Relaxes SAML AttributeValue type definition. Xerces-C has a bug that prevents
- anyAttribute content appearing on anyType. It works in 2.2 but not in later versions.
- -->
-
- <complexType name="AttributeValueType" mixed="true">
- <annotation>
- <documentation xml:lang="en">
- By convention, all Shibboleth 1.1 origin attribute values carry this unconstrained xsi:type.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="anyType"/>
- </complexContent>
- </complexType>
-
- <!-- Attribute Acceptance Policies -->
-
- <simpleType name="AttributeRuleValueType">
- <restriction base="string">
- <enumeration value="literal"/>
- <enumeration value="regexp"/>
- <enumeration value="xpath"/>
- </restriction>
- </simpleType>
-
- <complexType name="SiteRuleType">
- <sequence>
- <element name="Scope" minOccurs="0" maxOccurs="unbounded">
- <complexType>
- <simpleContent>
- <extension base="string">
- <attribute name="Accept" type="boolean" use="optional" default="true"/>
- <attribute name="Type" type="shib:AttributeRuleValueType" use="optional" default="literal"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <choice minOccurs="0">
- <element name="AnyValue">
- <complexType>
- <sequence/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
- </element>
- <element name="Value" maxOccurs="unbounded">
- <complexType>
- <simpleContent>
- <extension base="string">
- <attribute name="Accept" type="boolean" use="optional" default="true"/>
- <attribute name="Type" type="shib:AttributeRuleValueType" use="optional" default="literal"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- </choice>
- </sequence>
- </complexType>
-
- <element name="AnySite" type="shib:SiteRuleType"/>
- <element name="SiteRule">
- <complexType>
- <complexContent>
- <extension base="shib:SiteRuleType">
- <attribute name="Name" type="string" use="required"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </extension>
- </complexContent>
- </complexType>
- </element>
-
- <complexType name="AttributeRuleType">
- <sequence>
- <element ref="shib:AnySite" minOccurs="0"/>
- <element ref="shib:SiteRule" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Name" type="string" use="required"/>
- <attribute name="Namespace" type="string" use="optional"/>
- <attribute name="Alias" type="string" use="optional"/>
- <attribute name="Header" type="string" use="optional"/>
- <attribute name="Scoped" type="boolean" use="optional" default="false"/>
- <attribute name="CaseSensitive" type="boolean" use="optional" default="true"/>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
-
- <element name="AttributeRule" type="shib:AttributeRuleType">
- <key name="SiteRuleKey">
- <selector xpath="./shib:SiteRule"/>
- <field xpath="@Name"/>
- </key>
- </element>
-
- <element name="AttributeAcceptancePolicy">
- <complexType>
- <sequence>
- <element name="AnyAttribute" minOccurs="0">
- <complexType>
- <sequence/>
- </complexType>
- </element>
- <element ref="shib:AttributeRule" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <anyAttribute namespace="##other" processContents="lax"/>
- </complexType>
- </element>
-
-
- <!-- Shibboleth Metadata -->
-
- <complexType name="SiteType">
- <annotation>
- <documentation xml:lang="en">All sites have a Name attribute, plus optional i18n-ized aliases.</documentation>
- </annotation>
- <sequence>
- <element name="Alias" minOccurs="0" maxOccurs="unbounded">
- <complexType>
- <simpleContent>
- <extension base="string">
- <attribute ref="xml:lang"/>
- </extension>
- </simpleContent>
- </complexType>
- </element>
- <element name="Contact" type="shib:ContactType" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <attribute name="Name" type="string" use="required"/>
- <attribute name="ErrorURL" type="anyURI" use="optional"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <simpleType name="ContactTypeType">
- <restriction base="string">
- <enumeration value="technical"/>
- <enumeration value="support"/>
- <enumeration value="administrative"/>
- <enumeration value="billing"/>
- <enumeration value="other"/>
- </restriction>
- </simpleType>
-
- <complexType name="ContactType">
- <annotation><documentation xml:lang="en">A human contact for a site.</documentation></annotation>
- <sequence/>
- <attribute name="Type" type="shib:ContactTypeType" use="required"/>
- <attribute name="Name" type="string" use="required"/>
- <attribute name="Email" type="string" use="optional"/>
- </complexType>
-
- <complexType name="regexp_string">
- <annotation>
- <documentation xml:lang="en">A string element with an optional attribute signaling regexp content.</documentation>
- </annotation>
- <simpleContent>
- <extension base="string">
- <attribute name="regexp" type="boolean" use="optional" default="false"/>
- </extension>
- </simpleContent>
- </complexType>
-
- <complexType name="AuthorityType">
- <annotation>
- <documentation xml:lang="en">Metadata about a SAML authority.</documentation>
- </annotation>
- <sequence/>
- <attribute name="Name" type="string" use="required"/>
- <attribute name="Location" type="anyURI" use="required"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <complexType name="OriginSiteType">
- <annotation>
- <documentation xml:lang="en">
- Origin sites add at least one handle service (with a name), plus optional domains trusted for attribute scoping.
- </documentation>
- </annotation>
- <complexContent>
- <extension base="shib:SiteType">
- <sequence>
- <element name="HandleService" type="shib:AuthorityType" maxOccurs="unbounded"/>
- <element name="AttributeAuthority" type="shib:AuthorityType" minOccurs="0" maxOccurs="unbounded"/>
- <element ref="shib:Domain" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- </extension>
- </complexContent>
- </complexType>
-
- <element name="Domain" type="shib:regexp_string">
- <annotation>
- <documentation xml:lang="en">A metadata extension used to regulate allowable attribute scopes.</documentation>
- </annotation>
- </element>
-
- <complexType name="DestinationSiteType">
- <annotation>
- <documentation xml:lang="en">
- Destination sites add at least one attribute requester (with a name).
- </documentation>
- </annotation>
- <complexContent>
- <extension base="shib:SiteType">
- <sequence>
- <element name="AssertionConsumerServiceURL" maxOccurs="unbounded">
- <complexType>
- <attribute name="Location" type="string" use="required"/>
- <attribute name="Id" type="string" use="optional"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- </element>
- <element name="AttributeRequester" maxOccurs="unbounded">
- <complexType>
- <attribute name="Name" type="string" use="required"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- </element>
- </sequence>
- </extension>
- </complexContent>
- </complexType>
-
- <complexType name="SiteGroupType">
- <annotation>
- <documentation xml:lang="en">Used to logically group sites together, optionally signed.</documentation>
- </annotation>
- <sequence>
- <choice maxOccurs="unbounded">
- <element ref="shib:OriginSite"/>
- <element ref="shib:DestinationSite"/>
- <element ref="shib:SiteGroup"/>
- </choice>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- <attribute name="Name" type="string" use="required"/>
- <attribute name="lastChanged" type="dateTime" use="optional"/>
- <attribute name="validUntil" type="dateTime" use="optional"/>
- <attribute name="cacheDuration" type="duration" use="optional"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
-
- <element name="OriginSite" type="shib:OriginSiteType"/>
- <element name="DestinationSite" type="shib:DestinationSiteType"/>
- <element name="SiteGroup" type="shib:SiteGroupType"/>
-
-
- <!-- Old (pre 1.2) Trust Metadata -->
-
- <complexType name="KeyAuthorityType">
- <annotation>
- <documentation xml:lang="en">
- Binds a set of keying material to one or more named system entities.
- </documentation>
- </annotation>
- <sequence>
- <element ref="ds:KeyInfo"/>
- <element name="Subject" type="shib:regexp_string" minOccurs="0" maxOccurs="unbounded"/>
- </sequence>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- <element name="KeyAuthority" type="shib:KeyAuthorityType"/>
-
- <element name="Trust">
- <annotation>
- <documentation xml:lang="en">An optionally signed collection of KeyAuthority data.</documentation>
- </annotation>
- <complexType>
- <sequence>
- <element ref="shib:KeyAuthority" maxOccurs="unbounded"/>
- <element ref="ds:Signature" minOccurs="0"/>
- </sequence>
- <attribute name="lastChanged" type="dateTime" use="optional"/>
- <attribute name="validUntil" type="dateTime" use="optional"/>
- <attribute name="cacheDuration" type="duration" use="optional"/>
- <anyAttribute namespace="##any" processContents="lax"/>
- </complexType>
- </element>
-
-</schema>
diff --git a/schemas/ws-addr.xsd b/schemas/ws-addr.xsd
deleted file mode 100644
index f6fc9c53..00000000
--- a/schemas/ws-addr.xsd
+++ /dev/null
@@ -1,137 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
- W3C XML Schema defined in the Web Services Addressing 1.0 specification
- http://www.w3.org/TR/ws-addr-core
-
- Copyright © 2005 World Wide Web Consortium,
-
- (Massachusetts Institute of Technology, European Research Consortium for
- Informatics and Mathematics, Keio University). All Rights Reserved. This
- work is distributed under the W3C® Software License [1] in the hope that
- it will be useful, but WITHOUT ANY WARRANTY; without even the implied
- warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
-
- [1] http://www.w3.org/Consortium/Legal/2002/copyright-software-20021231
-
- $Id: ws-addr.xsd,v 1.2 2008/07/23 13:38:16 plehegar Exp $
--->
-<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:tns="http://www.w3.org/2005/08/addressing" targetNamespace="http://www.w3.org/2005/08/addressing" blockDefault="#all" elementFormDefault="qualified" finalDefault="" attributeFormDefault="unqualified">
-
- <!-- Constructs from the WS-Addressing Core -->
-
- <xs:element name="EndpointReference" type="tns:EndpointReferenceType"/>
- <xs:complexType name="EndpointReferenceType" mixed="false">
- <xs:sequence>
- <xs:element name="Address" type="tns:AttributedURIType"/>
- <xs:element ref="tns:ReferenceParameters" minOccurs="0"/>
- <xs:element ref="tns:Metadata" minOccurs="0"/>
- <xs:any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </xs:sequence>
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:complexType>
-
- <xs:element name="ReferenceParameters" type="tns:ReferenceParametersType"/>
- <xs:complexType name="ReferenceParametersType" mixed="false">
- <xs:sequence>
- <xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </xs:sequence>
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:complexType>
-
- <xs:element name="Metadata" type="tns:MetadataType"/>
- <xs:complexType name="MetadataType" mixed="false">
- <xs:sequence>
- <xs:any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
- </xs:sequence>
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:complexType>
-
- <xs:element name="MessageID" type="tns:AttributedURIType"/>
- <xs:element name="RelatesTo" type="tns:RelatesToType"/>
- <xs:complexType name="RelatesToType" mixed="false">
- <xs:simpleContent>
- <xs:extension base="xs:anyURI">
- <xs:attribute name="RelationshipType" type="tns:RelationshipTypeOpenEnum" use="optional" default="http://www.w3.org/2005/08/addressing/reply"/>
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <xs:simpleType name="RelationshipTypeOpenEnum">
- <xs:union memberTypes="tns:RelationshipType xs:anyURI"/>
- </xs:simpleType>
-
- <xs:simpleType name="RelationshipType">
- <xs:restriction base="xs:anyURI">
- <xs:enumeration value="http://www.w3.org/2005/08/addressing/reply"/>
- </xs:restriction>
- </xs:simpleType>
-
- <xs:element name="ReplyTo" type="tns:EndpointReferenceType"/>
- <xs:element name="From" type="tns:EndpointReferenceType"/>
- <xs:element name="FaultTo" type="tns:EndpointReferenceType"/>
- <xs:element name="To" type="tns:AttributedURIType"/>
- <xs:element name="Action" type="tns:AttributedURIType"/>
-
- <xs:complexType name="AttributedURIType" mixed="false">
- <xs:simpleContent>
- <xs:extension base="xs:anyURI">
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <!-- Constructs from the WS-Addressing SOAP binding -->
-
- <xs:attribute name="IsReferenceParameter" type="xs:boolean"/>
-
- <xs:simpleType name="FaultCodesOpenEnumType">
- <xs:union memberTypes="tns:FaultCodesType xs:QName"/>
- </xs:simpleType>
-
- <xs:simpleType name="FaultCodesType">
- <xs:restriction base="xs:QName">
- <xs:enumeration value="tns:InvalidAddressingHeader"/>
- <xs:enumeration value="tns:InvalidAddress"/>
- <xs:enumeration value="tns:InvalidEPR"/>
- <xs:enumeration value="tns:InvalidCardinality"/>
- <xs:enumeration value="tns:MissingAddressInEPR"/>
- <xs:enumeration value="tns:DuplicateMessageID"/>
- <xs:enumeration value="tns:ActionMismatch"/>
- <xs:enumeration value="tns:MessageAddressingHeaderRequired"/>
- <xs:enumeration value="tns:DestinationUnreachable"/>
- <xs:enumeration value="tns:ActionNotSupported"/>
- <xs:enumeration value="tns:EndpointUnavailable"/>
- </xs:restriction>
- </xs:simpleType>
-
- <xs:element name="RetryAfter" type="tns:AttributedUnsignedLongType"/>
- <xs:complexType name="AttributedUnsignedLongType" mixed="false">
- <xs:simpleContent>
- <xs:extension base="xs:unsignedLong">
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <xs:element name="ProblemHeaderQName" type="tns:AttributedQNameType"/>
- <xs:complexType name="AttributedQNameType" mixed="false">
- <xs:simpleContent>
- <xs:extension base="xs:QName">
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <xs:element name="ProblemIRI" type="tns:AttributedURIType"/>
-
- <xs:element name="ProblemAction" type="tns:ProblemActionType"/>
- <xs:complexType name="ProblemActionType" mixed="false">
- <xs:sequence>
- <xs:element ref="tns:Action" minOccurs="0"/>
- <xs:element name="SoapAction" minOccurs="0" type="xs:anyURI"/>
- </xs:sequence>
- <xs:anyAttribute namespace="##other" processContents="lax"/>
- </xs:complexType>
-
-</xs:schema>
diff --git a/schemas/ws-authorization.xsd b/schemas/ws-authorization.xsd
deleted file mode 100644
index 51dc059e..00000000
--- a/schemas/ws-authorization.xsd
+++ /dev/null
@@ -1,145 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the
-implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available;
-neither does it represent that it has made any effort to identify any such rights. Information on OASIS's procedures with respect to rights in OASIS
-specifications can be found at the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made
-available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users
-of this specification, can be obtained from the OASIS Executive Director.
-OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may
-cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
-Copyright © OASIS Open 2002-2007. All Rights Reserved.
-This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist
-in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the
-above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself does not be modified
-in any way, such as by removing the copyright notice or references to OASIS, except as needed for the purpose of developing OASIS specifications,
-in which case the procedures for copyrights defined in the OASIS Intellectual Property Rights document must be followed, or as required to translate
-it into languages other than English.
-The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
-This document and the information contained herein is provided on an AS IS basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
-INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
- -->
-
-<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'
- xmlns:xenc='http://www.w3.org/2001/04/xmlenc#'
- xmlns:tns='http://docs.oasis-open.org/wsfed/authorization/200706'
- targetNamespace='http://docs.oasis-open.org/wsfed/authorization/200706'
- elementFormDefault='qualified' >
- <xs:import namespace='http://www.w3.org/2001/04/xmlenc#'
- schemaLocation='xenc-schema.xsd'/>
-
- <!-- Section 9.2 -->
- <xs:element name='AdditionalContext' type='tns:AdditionalContextType' />
- <xs:complexType name='AdditionalContextType' >
- <xs:sequence>
- <xs:element name='ContextItem' type='tns:ContextItemType' minOccurs='0' maxOccurs='unbounded' />
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='ContextItemType' >
- <xs:choice minOccurs='0'>
- <xs:element name='Value' type='xs:string' minOccurs='1' maxOccurs='1' />
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='1' />
- </xs:choice>
- <xs:attribute name='Name' type='xs:anyURI' use='required' />
- <xs:attribute name='Scope' type='xs:anyURI' use='optional' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 9.3 -->
- <xs:element name='ClaimType' type='tns:ClaimType' />
- <xs:complexType name='ClaimType' >
- <xs:sequence>
- <xs:element name="DisplayName" type="tns:DisplayNameType" minOccurs="0" maxOccurs="1" />
- <xs:element name="Description" type="tns:DescriptionType" minOccurs="0" maxOccurs="1" />
- <xs:element name="DisplayValue" type="tns:DisplayValueType" minOccurs="0" maxOccurs="1" />
- <xs:choice minOccurs='0'>
- <xs:element name='Value' type='xs:string' minOccurs='1' maxOccurs='1' />
- <xs:element name='EncryptedValue' type='tns:EncryptedValueType' minOccurs='1' maxOccurs='1' />
- <xs:element name='StructuredValue' type='tns:StructuredValueType' minOccurs='1' maxOccurs='1' />
- <xs:element name='ConstrainedValue' type='tns:ConstrainedValueType' minOccurs='1' maxOccurs='1' />
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='1' />
- </xs:choice>
- </xs:sequence>
- <xs:attribute name='Uri' type='xs:anyURI' use='required' />
- <xs:attribute name='Optional' type='xs:boolean' use='optional' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name="DisplayNameType">
- <xs:simpleContent>
- <xs:extension base="xs:string">
- <xs:anyAttribute namespace="##other" processContents="lax" />
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
- <xs:complexType name="DescriptionType">
- <xs:simpleContent>
- <xs:extension base="xs:string">
- <xs:anyAttribute namespace="##other" processContents="lax" />
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
- <xs:complexType name="DisplayValueType">
- <xs:simpleContent>
- <xs:extension base="xs:string">
- <xs:anyAttribute namespace="##other" processContents="lax" />
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <xs:complexType name="EncryptedValueType">
- <xs:sequence>
- <xs:element ref="xenc:EncryptedData" minOccurs="1" maxOccurs="1"/>
- </xs:sequence>
- <xs:attribute name="DecryptionCondition" type="xs:anyURI" use="optional"/>
- </xs:complexType>
-
- <xs:complexType name="StructuredValueType">
- <xs:sequence>
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 9.3.1 -->
-
- <xs:complexType name='ConstrainedValueType'>
- <xs:sequence>
- <xs:choice minOccurs='1'>
- <xs:element name='ValueLessThan' type='tns:ConstrainedSingleValueType' minOccurs='1' maxOccurs='1'/>
- <xs:element name='ValueLessThanOrEqual' type='tns:ConstrainedSingleValueType' minOccurs='1' maxOccurs='1'/>
- <xs:element name='ValueGreaterThan' type='tns:ConstrainedSingleValueType' minOccurs='1' maxOccurs='1'/>
- <xs:element name='ValueGreaterThanOrEqual' type='tns:ConstrainedSingleValueType' minOccurs='1' maxOccurs='1'/>
- <xs:element name='ValueInRangen' type='tns:ValueInRangeType' minOccurs='1' maxOccurs='1'/>
- <xs:element name='ValueOneOf' type='tns:ConstrainedManyValueType' minOccurs='1' maxOccurs='1'/>
- </xs:choice>
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:attribute name='AssertConstraint' type='xs:boolean' use='optional' />
- </xs:complexType>
- <xs:complexType name='ValueInRangeType'>
- <xs:sequence>
- <xs:element name='ValueUpperBound' type='tns:ConstrainedSingleValueType' minOccurs='1' maxOccurs='1'/>
- <xs:element name='ValueLowerBound' type='tns:ConstrainedSingleValueType' minOccurs='1' maxOccurs='1'/>
- </xs:sequence>
- </xs:complexType>
-
- <xs:complexType name='ConstrainedSingleValueType'>
- <xs:choice minOccurs='0'>
- <xs:element name='Value' type='xs:string' minOccurs='1' maxOccurs='1' />
- <xs:element name='StructuredValue' type='tns:StructuredValueType' minOccurs='1' maxOccurs='1' />
- </xs:choice>
- </xs:complexType>
-
- <xs:complexType name='ConstrainedManyValueType'>
- <xs:choice minOccurs='0'>
- <xs:element name='Value' type='xs:string' minOccurs='1' maxOccurs='unbounded' />
- <xs:element name='StructuredValue' type='tns:StructuredValueType' minOccurs='1' maxOccurs='unbounded' />
- </xs:choice>
- </xs:complexType>
-
-</xs:schema>
diff --git a/schemas/ws-federation.xsd b/schemas/ws-federation.xsd
deleted file mode 100644
index d7b3dcf5..00000000
--- a/schemas/ws-federation.xsd
+++ /dev/null
@@ -1,471 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" ?>
-<!--
-OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the
-implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available;
-neither does it represent that it has made any effort to identify any such rights. Information on OASIS's procedures with respect to rights in OASIS
-specifications can be found at the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made
-available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users
-of this specification, can be obtained from the OASIS Executive Director.
-OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may
-cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
-Copyright © OASIS Open 2002-2007. All Rights Reserved.
-This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist
-in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the
-above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself does not be modified
-in any way, such as by removing the copyright notice or references to OASIS, except as needed for the purpose of developing OASIS specifications,
-in which case the procedures for copyrights defined in the OASIS Intellectual Property Rights document must be followed, or as required to translate
-it into languages other than English.
-The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
-This document and the information contained herein is provided on an AS IS basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
-INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
- -->
-<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'
- xmlns:sp='http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702'
- xmlns:tns='http://docs.oasis-open.org/wsfed/federation/200706'
- xmlns:wsa='http://www.w3.org/2005/08/addressing'
- xmlns:mex='http://schemas.xmlsoap.org/ws/2004/09/mex'
- xmlns:wsse='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'
- xmlns:wsu='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'
- xmlns:md='urn:oasis:names:tc:SAML:2.0:metadata'
- xmlns:auth='http://docs.oasis-open.org/wsfed/authorization/200706'
- targetNamespace='http://docs.oasis-open.org/wsfed/federation/200706'
- elementFormDefault='qualified' >
-
- <xs:import namespace='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'
- schemaLocation='oasis-200401-wss-wssecurity-secext-1.0.xsd' />
- <xs:import namespace='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'
- schemaLocation='oasis-200401-wss-wssecurity-utility-1.0.xsd' />
- <xs:import namespace='http://www.w3.org/2005/08/addressing'
- schemaLocation='ws-addr.xsd' />
- <xs:import namespace='http://schemas.xmlsoap.org/ws/2004/09/mex'
- schemaLocation='MetadataExchange.xsd' />
- <xs:import namespace='urn:oasis:names:tc:SAML:2.0:metadata'
- schemaLocation='saml-schema-metadata-2.0.xsd' />
- <xs:import namespace='http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702'
- schemaLocation='ws-securitypolicy-1.2.xsd'/>
- <xs:import namespace='http://docs.oasis-open.org/wsfed/authorization/200706'
- schemaLocation='ws-authorization.xsd'/>
-
- <!-- Section 3.1 -->
- <!-- Note: Use of this root element is discouraged in favor of use of md:EntitiesDescriptor or md EntityDescriptor -->
- <xs:element name='FederationMetadata' type='tns:FederationMetadataType' />
-
- <xs:complexType name='FederationMetadataType' >
- <xs:sequence>
- <!--
- *** Accurate content model is nondeterministic ***
- <xs:element name='Federation' type='tns:FederationType' minOccurs='1' maxOccurs='unbounded' />
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- -->
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='FederationType' >
- <xs:sequence>
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:attribute name='FederationID' type='xs:anyURI' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 3.1.2.1 -->
- <xs:complexType name="WebServiceDescriptorType" abstract="true">
- <xs:complexContent>
- <xs:extension base="md:RoleDescriptorType">
- <xs:sequence>
- <xs:element ref="tns:LogicalServiceNamesOffered" minOccurs="0" maxOccurs="1" />
- <xs:element ref="tns:TokenTypesOffered" minOccurs="0" maxOccurs="1" />
- <xs:element ref="tns:ClaimDialectsOffered" minOccurs="0" maxOccurs="1" />
- <xs:element ref="tns:ClaimTypesOffered" minOccurs="0" maxOccurs="1" />
- <xs:element ref="tns:ClaimTypesRequested" minOccurs="0" maxOccurs="1" />
- <xs:element ref="tns:AutomaticPseudonyms" minOccurs="0" maxOccurs="1"/>
- <xs:element ref="tns:TargetScopes" minOccurs="0" maxOccurs="1"/>
- </xs:sequence>
- <xs:attribute name="ServiceDisplayName" type="xs:string" use="optional"/>
- <xs:attribute name="ServiceDescription" type="xs:string" use="optional"/>
- </xs:extension>
- </xs:complexContent>
- </xs:complexType>
-
- <xs:element name='LogicalServiceNamesOffered' type='tns:LogicalServiceNamesOfferedType' />
- <xs:element name='TokenTypesOffered' type='tns:TokenTypesOfferedType' />
- <xs:element name='ClaimDialectsOffered' type='tns:ClaimDialectsOfferedType' />
- <xs:element name='ClaimTypesOffered' type='tns:ClaimTypesOfferedType' />
- <xs:element name='ClaimTypesRequested' type='tns:ClaimTypesRequestedType' />
- <xs:element name="AutomaticPseudonyms" type="xs:boolean"/>
- <xs:element name='TargetScopes' type='tns:EndpointType'/>
-
- <!-- Section 3.1.2.2 -->
- <xs:complexType name="SecurityTokenServiceType">
- <xs:complexContent>
- <xs:extension base="tns:WebServiceDescriptorType">
- <xs:sequence>
- <xs:element ref="tns:SecurityTokenServiceEndpoint" minOccurs="1" maxOccurs="unbounded"/>
- <xs:element ref="tns:SingleSignOutSubscriptionEndpoint" minOccurs="0" maxOccurs="unbounded"/>
- <xs:element ref="tns:SingleSignOutNotificationEndpoint" minOccurs="0" maxOccurs="unbounded"/>
- <xs:element ref="tns:PassiveRequestorEndpoint" minOccurs="0" maxOccurs="unbounded"/>
- </xs:sequence>
- </xs:extension>
- </xs:complexContent>
- </xs:complexType>
- <xs:element name="SecurityTokenServiceEndpoint" type="tns:EndpointType"/>
- <xs:element name="SingleSignOutSubscriptionEndpoint" type="tns:EndpointType"/>
- <xs:element name="SingleSignOutNotificationEndpoint" type="tns:EndpointType"/>
- <xs:element name="PassiveRequestorEndpoint" type="tns:EndpointType"/>
-
- <!-- Section 3.1.2.3 -->
- <xs:complexType name="PseudonymServiceType">
- <xs:complexContent>
- <xs:extension base="tns:WebServiceDescriptorType">
- <xs:sequence>
- <xs:element ref="tns:PseudonymServiceEndpoint" minOccurs="1" maxOccurs="unbounded"/>
- <xs:element ref="tns:SingleSignOutNotificationEndpoint" minOccurs="0" maxOccurs="unbounded"/>
- </xs:sequence>
- </xs:extension>
- </xs:complexContent>
- </xs:complexType>
-
- <xs:element name="PseudonymServiceEndpoint" type="tns:EndpointType"/>
- <!-- Defined above -->
- <!-- <xs:element name="SingleSignOutNotificationEndpoint" type="tns:EndpointType"/> -->
-
- <!-- Section 3.1.2.4 -->
- <xs:complexType name="AttributeServiceType">
- <xs:complexContent>
- <xs:extension base="tns:WebServiceDescriptorType">
- <xs:sequence>
- <xs:element ref="tns:AttributeServiceEndpoint" minOccurs="1" maxOccurs="unbounded"/>
- <xs:element ref="tns:SingleSignOutNotificationEndpoint" minOccurs="0" maxOccurs="unbounded"/>
- </xs:sequence>
- </xs:extension>
- </xs:complexContent>
- </xs:complexType>
- <xs:element name="AttributeServiceEndpoint" type="tns:EndpointType"/>
- <!-- Defined above -->
- <!-- <xs:element name="SingleSignOutNotificationEndpoint" type="tns:EndpointType"/> -->
-
- <!-- Section 3.1.2.5 -->
- <xs:complexType name="ApplicationServiceType">
- <xs:complexContent>
- <xs:extension base="tns:WebServiceDescriptorType">
- <xs:sequence>
- <xs:element ref="tns:ApplicationServiceEndpoint" minOccurs="1" maxOccurs="unbounded"/>
- <xs:element ref="tns:SingleSignOutNotificationEndpoint" minOccurs="0" maxOccurs="unbounded"/>
- <xs:element ref="tns:PassiveRequestorEndpoint" minOccurs="0" maxOccurs="unbounded"/>
- </xs:sequence>
- </xs:extension>
- </xs:complexContent>
- </xs:complexType>
- <xs:element name="ApplicationServiceEndpoint" type="tns:EndpointType"/>
- <!-- Defined above -->
- <!-- <xs:element name="SingleSignOutNotificationEndpoint" type="tns:EndpointType"/> -->
- <!-- <xs:element name="PassiveRequestorEndpoint" type="tns:EndpointType"/> -->
-
-
- <!-- Section 3.1.3 -->
- <!-- Defined above -->
- <!--<xs:element name='LogicalServiceNamesOffered' type='tns:LogicalServiceNamesOfferedType' />-->
-
- <xs:complexType name='LogicalServiceNamesOfferedType' >
- <xs:sequence>
- <xs:element name='IssuerName' type='tns:IssuerNameType' minOccurs='1' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='IssuerNameType' >
- <xs:attribute name='Uri' type='xs:anyURI' use='required' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 3.1.4 -->
- <xs:element name='PsuedonymServiceEndpoints' type='tns:EndpointType' />
- <xs:complexType name='EndpointType' >
- <xs:sequence>
- <xs:element ref='wsa:EndpointReference' minOccurs='1' maxOccurs='unbounded'/>
- </xs:sequence>
- </xs:complexType>
-
- <!-- Section 3.1.5 -->
- <xs:element name='AttributeServiceEndpoints' type='tns:EndpointType' />
-
- <!-- Section 3.1.6 -->
- <xs:element name='SingleSignOutSubscriptionEndpoints' type='tns:EndpointType' />
-
- <!-- Section 3.1.7 -->
- <xs:element name='SingleSignOutNotificationEndpoints' type='tns:EndpointType' />
-
- <!-- Section 3.1.8 -->
- <!-- Defined above -->
- <!--<xs:element name='TokenTypesOffered' type='tns:TokenTypesOfferedType' />-->
- <xs:complexType name='TokenTypesOfferedType' >
- <xs:sequence>
- <xs:element name='TokenType' type='tns:TokenType' minOccurs='1' maxOccurs='unbounded' />
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='TokenType' >
- <xs:sequence>
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:attribute name='Uri' type='xs:anyURI' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 3.1.9 -->
- <!-- Defined above -->
- <!-- <xs:element name='ClaimTypesOffered' type='tns:ClaimTypesOfferedType' /> -->
- <xs:complexType name='ClaimTypesOfferedType'>
- <xs:sequence>
- <xs:element ref='auth:ClaimType' minOccurs='1' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 3.1.10 -->
- <!-- Defined above -->
- <!-- <xs:element name='ClaimTypesRequested' ype='tns:ClaimTypesRequestedType' /> -->
- <xs:complexType name='ClaimTypesRequestedType'>
- <xs:sequence>
- <xs:element ref='auth:ClaimType' minOccurs='1' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 3.1.11 -->
- <!-- Defined above -->
- <!--<xs:element name='ClaimDialectsOffered' type='tns:ClaimDialectsOfferedType' />-->
- <xs:complexType name='ClaimDialectsOfferedType'>
- <xs:sequence>
- <xs:element name='ClaimDialect' type='tns:ClaimDialectType' minOccurs='1' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='ClaimDialectType' >
- <xs:sequence>
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:attribute name='Uri' type='xs:anyURI' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 3.1.12 -->
- <!-- Defined above -->
- <!-- <xs:element name='AutomaticPseudonyms' type='xs:boolean' /> -->
-
- <!-- Section 3.1.13 -->
- <xs:element name='PassiveRequestorEnpoints' type='tns:EndpointType'/>
-
- <!-- Section 3.1.14 -->
- <!-- Defined above -->
- <!--<xs:element name='TargetScopes' type='tns:EndpointType'/>-->
-
- <!-- Section 3.2.4 -->
- <xs:element name='FederationMetadataHandler' type='tns:FederationMetadataHandlerType' />
- <xs:complexType name='FederationMetadataHandlerType' >
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 4.1 -->
- <xs:element name='SignOut' type='tns:SignOutType' />
- <xs:complexType name='SignOutType' >
- <xs:sequence>
- <xs:element ref='tns:Realm' minOccurs='0' />
- <xs:element name='SignOutBasis' type='tns:SignOutBasisType' minOccurs='1' maxOccurs='1' />
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:attribute ref='wsu:Id' use='optional' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='SignOutBasisType' >
- <xs:sequence>
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 4.2 -->
- <xs:element name='Realm' type='xs:anyURI' />
-
- <!-- Section 6.1 -->
- <xs:element name='FilterPseudonyms' type='tns:FilterPseudonymsType' />
- <xs:complexType name='FilterPseudonymsType' >
- <xs:sequence>
- <xs:element ref='tns:PseudonymBasis' minOccurs='0' maxOccurs='1' />
- <xs:element ref='tns:RelativeTo' minOccurs='0' maxOccurs='1' />
- <xs:any namespace='##other' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:element name='PseudonymBasis' type='tns:PseudonymBasisType' />
- <xs:complexType name='PseudonymBasisType' >
- <xs:sequence>
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='1' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:element name='RelativeTo' type='tns:RelativeToType' />
- <xs:complexType name='RelativeToType' >
- <xs:sequence>
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 6.2 -->
- <xs:element name='Pseudonym' type='tns:PseudonymType' />
-
- <xs:complexType name='PseudonymType' >
- <xs:sequence>
- <!--
- *** Accurate content model is nondeterministic ***
- <xs:element ref='tns:PseudonymBasis' minOccurs='1' maxOccurs='1' />
- <xs:element ref='tns:RelativeTo' minOccurs='1' maxOccurs='1' />
- <xs:element ref='wsu:Expires' minOccurs='0' maxOccurs='1' />
- <xs:element ref='tns:SecurityToken' minOccurs='0' maxOccurs='unbounded' />
- <xs:element ref='tns:ProofToken' minOccurs='0' maxOccurs='unbounded' />
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- -->
-
- <xs:element ref='tns:PseudonymBasis' minOccurs='1' maxOccurs='1' />
- <xs:element ref='tns:RelativeTo' minOccurs='1' maxOccurs='1' />
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:element name='SecurityToken' type='tns:SecurityTokenType' />
- <xs:complexType name='SecurityTokenType' >
- <xs:sequence>
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='1' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:element name='ProofToken' type='tns:ProofTokenType' />
- <xs:complexType name='ProofTokenType' >
- <xs:sequence>
- <xs:any namespace='##other' processContents='lax' minOccurs='1' maxOccurs='1' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 7.1 -->
- <xs:element name='RequestPseudonym' type='tns:RequestPseudonymType' />
- <xs:complexType name='RequestPseudonymType' >
- <xs:sequence>
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:attribute name='SingleUse' type='xs:boolean' use='optional' />
- <xs:attribute name='Lookup' type='xs:boolean' use='optional' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 8.1 -->
- <xs:element name='ReferenceToken' type='tns:ReferenceTokenType' />
- <xs:complexType name='ReferenceTokenType'>
- <xs:sequence>
- <xs:element name='ReferenceEPR' type='wsa:EndpointReferenceType' minOccurs='1' maxOccurs='unbounded' />
- <xs:element name='ReferenceDigest' type='tns:ReferenceDigestType' minOccurs='0' maxOccurs='1' />
- <xs:element name='ReferenceType' type='tns:AttributeExtensibleURI' minOccurs='0' maxOccurs='1' />
- <xs:element name='SerialNo' type='tns:AttributeExtensibleURI' minOccurs='0' maxOccurs='1' />
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='ReferenceDigestType' >
- <xs:simpleContent>
- <xs:extension base='xs:base64Binary' >
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
- <xs:complexType name='AttributeExtensibleURI' >
- <xs:simpleContent>
- <xs:extension base='xs:anyURI' >
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <!-- Section 8.2 -->
- <xs:element name='FederationID' type='tns:AttributeExtensibleURI' />
-
- <!-- Section 8.3 -->
- <xs:element name='RequestProofToken' type='tns:RequestProofTokenType' />
- <xs:complexType name='RequestProofTokenType' >
- <xs:sequence>
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 8.4 -->
- <xs:element name='ClientPseudonym' type='tns:ClientPseudonymType' />
- <xs:complexType name='ClientPseudonymType' >
- <xs:sequence>
- <xs:element name='PPID' type='tns:AttributeExtensibleString' minOccurs='0' />
- <xs:element name='DisplayName' type='tns:AttributeExtensibleString' minOccurs='0' />
- <xs:element name='EMail' type='tns:AttributeExtensibleString' minOccurs='0' />
- <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <xs:complexType name='AttributeExtensibleString' >
- <xs:simpleContent>
- <xs:extension base='xs:string' >
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <!-- Section 8.5 -->
- <xs:element name='Freshness' type='tns:Freshness' />
- <xs:complexType name='Freshness'>
- <xs:simpleContent>
- <xs:extension base='xs:unsignedInt' >
- <xs:attribute name='AllowCache' type='xs:boolean' use='optional' />
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:extension>
- </xs:simpleContent>
- </xs:complexType>
-
- <!-- Section 14.1 -->
- <xs:element name='RequireReferenceToken' type='sp:TokenAssertionType' />
- <xs:element name='ReferenceToken11' type='tns:AssertionType' />
-
- <xs:complexType name='AssertionType' >
- <xs:sequence>
- <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
- </xs:sequence>
- <xs:anyAttribute namespace='##other' processContents='lax' />
- </xs:complexType>
-
- <!-- Section 14.2 -->
- <xs:element name='WebBinding' type='sp:NestedPolicyType' />
- <xs:element name='AuthenticationToken' type='sp:NestedPolicyType' />
- <!-- ReferenceToken defined above -->
- <xs:element name='RequireSignedTokens' type='tns:AssertionType' />
- <xs:element name='RequireBearerTokens' type='tns:AssertionType' />
- <xs:element name='RequireSharedCookies' type='tns:AssertionType' />
-
-
- <!-- Section 14.3 -->
- <xs:element name='RequiresGenericClaimDialect' type='tns:AssertionType' />
- <xs:element name='IssuesSpecificPolicyFault' type='tns:AssertionType' />
- <xs:element name='AdditionalContextProcessed' type='tns:AssertionType' />
-
-
-</xs:schema>
-
diff --git a/schemas/ws-securitypolicy-1.2.xsd b/schemas/ws-securitypolicy-1.2.xsd
deleted file mode 100644
index bda124b8..00000000
--- a/schemas/ws-securitypolicy-1.2.xsd
+++ /dev/null
@@ -1,1205 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<!--
-OASIS takes no position regarding the validity or scope of any intellectual property or other rights that might be claimed to pertain to the
-implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available;
-neither does it represent that it has made any effort to identify any such rights. Information on OASIS's procedures with respect to rights in OASIS
-specifications can be found at the OASIS website. Copies of claims of rights made available for publication and any assurances of licenses to be made
-available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementors or users
-of this specification, can be obtained from the OASIS Executive Director.
-OASIS invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights which may
-cover technology that may be required to implement this specification. Please address the information to the OASIS Executive Director.
-Copyright © OASIS Open 2002-2007. All Rights Reserved.
-This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist
-in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the
-above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself does not be modified
-in any way, such as by removing the copyright notice or references to OASIS, except as needed for the purpose of developing OASIS specifications,
-in which case the procedures for copyrights defined in the OASIS Intellectual Property Rights document must be followed, or as required to translate
-it into languages other than English.
-The limited permissions granted above are perpetual and will not be revoked by OASIS or its successors or assigns.
-This document and the information contained herein is provided on an AS IS basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
-INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
-MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
--->
-<xs:schema
- targetNamespace='http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702'
- xmlns:tns='http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702'
- xmlns:wsa="http://www.w3.org/2005/08/addressing"
- xmlns:xs="http://www.w3.org/2001/XMLSchema"
- elementFormDefault="qualified"
- blockDefault="#all" >
-
- <xs:import namespace="http://www.w3.org/2005/08/addressing"
- schemaLocation="ws-addr.xsd" />
-
- <!--
- 4. Protection Assertions
- -->
- <xs:element name="SignedParts" type="tns:SePartsType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 4.1.1 SignedParts Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="EncryptedParts" type="tns:SePartsType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 4.2.1 EncryptedParts Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="SePartsType">
- <xs:sequence>
- <xs:element name="Body" type="tns:EmptyType" minOccurs="0" />
- <xs:element name="Header" type="tns:HeaderType" minOccurs="0" maxOccurs="unbounded" />
- <xs:element name="Attachments" type="tns:EmptyType" minOccurs="0" />
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax"/>
- </xs:sequence>
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
- <xs:complexType name="EmptyType" />
- <xs:complexType name="HeaderType" >
- <xs:attribute name="Name" type="xs:QName" use="optional" />
- <xs:attribute name="Namespace" type="xs:anyURI" use="required" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
-
- <xs:element name="SignedElements" type="tns:SerElementsType" >
- <xs:annotation>
- <xs:documentation xml:lang="en" >
- 4.1.2 SignedElements Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="EncryptedElements" type="tns:SerElementsType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 4.2.2 EncryptedElements Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequiredElements" type="tns:SerElementsType" >
- <xs:annotation>
- <xs:documentation xml:lang="en" >
- 4.3.1 RequiredElements Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="SerElementsType">
- <xs:sequence>
- <xs:element name="XPath" type="xs:string" minOccurs="1" maxOccurs="unbounded" />
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax"/>
- </xs:sequence>
- <xs:attribute name="XPathVersion" type="xs:anyURI" use="optional" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
-
- <!--
- 5. Token Assertions
- -->
- <xs:attribute name="IncludeToken" type="tns:IncludeTokenOpenType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.1 Token Inclusion
- </xs:documentation>
- </xs:annotation>
- </xs:attribute>
- <xs:simpleType name="IncludeTokenOpenType">
- <xs:union memberTypes="tns:IncludeTokenType xs:anyURI" />
- </xs:simpleType>
- <xs:simpleType name="IncludeTokenType">
- <xs:restriction base="xs:anyURI" >
- <xs:enumeration value="http://docs.oasis-open.org/ws-sx/ws-trust/200702/ws-securitypolicy/IncludeToken/Never" />
- <xs:enumeration value="http://docs.oasis-open.org/ws-sx/ws-trust/200702/ws-securitypolicy/IncludeToken/Once" />
- <xs:enumeration value="http://docs.oasis-open.org/ws-sx/ws-trust/200702/ws-securitypolicy/IncludeToken/AlwaysToRecipient" />
- <xs:enumeration value="http://docs.oasis-open.org/ws-sx/ws-trust/200702/ws-securitypolicy/IncludeToken/AlwaysToInitiator" />
- <xs:enumeration value="http://docs.oasis-open.org/ws-sx/ws-trust/200702/ws-securitypolicy/IncludeToken/Always" />
- </xs:restriction>
- </xs:simpleType>
-
- <xs:element name="UsernameToken" type="tns:TokenAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en" >
- 5.4.1 UsernameToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="TokenAssertionType">
- <xs:sequence>
- <xs:choice minOccurs="0">
- <xs:element name="Issuer" type="wsa:EndpointReferenceType" />
- <xs:element name="IssuerName" type="xs:anyURI" />
- </xs:choice>
- <!--
- Actual content model is non-deterministic, hence wildcard. The following shows intended content model:
- <xs:element ref="wsp:Policy" minOccurs="0" />
- -->
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax"/>
- </xs:sequence>
- <xs:attribute ref="tns:IncludeToken" use="optional" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
-
- <xs:element name="NoPassword" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.1 UsernameToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="HashPassword" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.1 UsernameToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssUsernameToken10" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.1 UsernameToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssUsernameToken11" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.1 UsernameToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- RequireDerivedKeys defined below. -->
- <!-- RequireImpliedDerivedKeys defined below. -->
- <!-- RequireExplicitDerivedKeys defined below. -->
-
- <xs:complexType name="QNameAssertionType">
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
-
- <xs:element name="IssuedToken" type="tns:IssuedTokenType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.2 IssuedToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="IssuedTokenType">
- <xs:sequence>
- <xs:choice minOccurs="0">
- <xs:element name="Issuer" type="wsa:EndpointReferenceType" />
- <xs:element name="IssuerName" type="xs:anyURI" />
- </xs:choice>
- <xs:element name="RequestSecurityTokenTemplate" type="tns:RequestSecurityTokenTemplateType" />
- <!--
- Actual content model is non-deterministic, hence wildcard. The following shows intended content model:
- <xs:element ref="wsp:Policy" minOccurs="0" />
- -->
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax" />
- </xs:sequence>
- <xs:attribute ref="tns:IncludeToken" use="optional" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
- <xs:complexType name="RequestSecurityTokenTemplateType">
- <xs:sequence>
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax" />
- </xs:sequence>
- <xs:attribute name="TrustVersion" type="xs:anyURI" use="optional" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
-
- <xs:element name="RequireDerivedKeys" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.2 IssuedToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireImpliedDerivedKeys" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.2 IssuedToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireExplicitDerivedKeys" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.2 IssuedToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireExternalReference" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.2 IssuedToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireInternalReference" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.2 IssuedToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="X509Token" type="tns:TokenAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- RequireDerivedKeys defined above. -->
- <!-- RequireImpliedDerivedKeys defined above. -->
- <!-- RequireExplicitDerivedKeys defined above. -->
-
- <xs:element name="RequireKeyIdentifierReference" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireIssuerSerialReference" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireEmbeddedTokenReference" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireThumbprintReference" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssX509V3Token10" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssX509Pkcs7Token10" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssX509PkiPathV1Token10" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssX509V1Token11" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssX509V3Token11" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssX509Pkcs7Token11" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssX509PkiPathV1Token11" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.3 X509Token Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="KerberosToken" type="tns:TokenAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.4 KerberosToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- RequireDerivedKeys defined above. -->
- <!-- RequireImpliedDerivedKeys defined above. -->
- <!-- RequireExplicitDerivedKeys defined above. -->
- <!-- RequireKeyIdentifierReference defined above. -->
-
- <xs:element name="WssKerberosV5ApReqToken11" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.4 KerberosToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssGssKerberosV5ApReqToken11" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.4 KerberosToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="SpnegoContextToken" type="tns:SpnegoContextTokenType" >
- <xs:annotation>
- <xs:documentation xml:lang="en" >
- 5.4.5 SpnegoContextToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="SpnegoContextTokenType">
- <xs:sequence>
- <xs:choice minOccurs="0">
- <xs:element name="Issuer" type="wsa:EndpointReferenceType" />
- <xs:element name="IssuerName" type="xs:anyURI" />
- </xs:choice>
- <!--
- Actual content model is non-deterministic, hence wildcard. The following shows intended content model:
- <xs:element ref="wsp:Policy" minOccurs="0" />
- -->
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax" />
- </xs:sequence>
- <xs:attribute ref="tns:IncludeToken" use="optional" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
- <!-- RequireDerivedKeys defined above. -->
- <!-- RequireImpliedDerivedKeys defined above. -->
- <!-- RequireExplicitDerivedKeys defined above. -->
- <xs:element name="MustNotSendCancel" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.5 SpnegoContextToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustNotSendAmend" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.5 SpnegoContextToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustNotSendRenew" type="tns:QNameAssertionType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.5 SpnegoContextToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="SecurityContextToken" type="tns:TokenAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.6 SecurityContextToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- RequireDerivedKeys defined above. -->
- <!-- RequireImpliedDerivedKeys defined above. -->
- <!-- RequireExplicitDerivedKeys defined above. -->
-
- <xs:element name="RequireExternalUriReference" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.6 SecurityContextToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="SC13SecurityContextToken" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.6 SecurityContextToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="SecureConversationToken" type="tns:SecureConversationTokenType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.7 SecureConversationToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="SecureConversationTokenType">
- <xs:sequence>
- <xs:choice minOccurs="0">
- <xs:element name="Issuer" type="wsa:EndpointReferenceType" />
- <xs:element name="IssuerName" type="xs:anyURI" />
- </xs:choice>
- <!--
- Actual content model is non-deterministic, hence wildcard. The following shows intended content model:
- <xs:element ref="wsp:Policy" minOccurs="0" />
- -->
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax" />
- </xs:sequence>
- <xs:attribute ref="tns:IncludeToken" use="optional" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
- <!-- RequireDerivedKeys defined above. -->
- <!-- RequireImpliedDerivedKeys defined above. -->
- <!-- RequireExplicitDerivedKeys defined above. -->
- <!-- RequireExternalUriReference defined above. -->
- <!-- SC13SecurityContextToken defined above. -->
- <!-- MustNotSendCancel defined above. -->
- <!-- MustNotSendAmend defined above. -->
- <!-- MustNotSendRenew defined above. -->
-
- <xs:element name="BootstrapPolicy" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.7 SecureConversationToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="SamlToken" type="tns:TokenAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en" >
- 5.4.8 SamlToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- RequireDerivedKeys defined above. -->
- <!-- RequireImpliedDerivedKeys defined above. -->
- <!-- RequireExplicitDerivedKeys defined above. -->
- <!-- RequireKeyIdentifierReference defined above. -->
-
- <xs:element name="WssSamlV11Token10" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.8 SamlToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssSamlV11Token11" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.8 SamlToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssSamlV20Token11" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.8 SamlToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="RelToken" type="tns:TokenAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.9 RelToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- RequireDerivedKeys defined above. -->
- <!-- RequireImpliedDerivedKeys defined above. -->
- <!-- RequireExplicitDerivedKeys defined above. -->
- <!-- RequireKeyIdentifierReference defined above. -->
-
- <xs:element name="WssRelV10Token10" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.9 RelToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssRelV20Token10" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.9 RelToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssRelV10Token11" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.9 RelToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="WssRelV20Token11" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.9 RelToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="HttpsToken" type="tns:TokenAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.10 HttpsToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="HttpBasicAuthentication" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.10 HttpsToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="HttpDigestAuthentication" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.10 HttpsToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireClientCertificate" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.10 HttpsToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="KeyValueToken" type="tns:KeyValueTokenType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.11 KeyValueToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="KeyValueTokenType">
- <xs:sequence>
- <!--
- Actual content model is non-deterministic, hence wildcard. The following shows intended content model:
- <xs:element ref="wsp:Policy" minOccurs="0" />
- -->
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax" />
- </xs:sequence>
- <xs:attribute ref="tns:IncludeToken" use="optional" />
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
- <xs:element name="RsaKeyValue" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 5.4.11 KeyValueToken Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <!--
- 7. Security Binding Assertions
- -->
- <xs:element name="AlgorithmSuite" type="tns:NestedPolicyType" >
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:complexType name="NestedPolicyType">
- <xs:sequence>
- <xs:any minOccurs="0" maxOccurs="unbounded" namespace="##other" processContents="lax"/>
- </xs:sequence>
- <xs:anyAttribute namespace="##any" processContents="lax" />
- </xs:complexType>
-
- <xs:element name="Basic256" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic192" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic128" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="TripleDes" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic256Rsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic192Rsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic128Rsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="TripleDesRsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic256Sha256" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic192Sha256" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic128Sha256" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="TripleDesSha256" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic256Sha256Rsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic192Sha256Rsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Basic128Sha256Rsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="TripleDesSha256Rsa15" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="InclusiveC14N" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="SOAPNormalization10" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="STRTransform10" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="XPath10" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="XPathFilter20" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="AbsXPath" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.1 AlgorithmSuite Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="Layout" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.2 Layout Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="Strict" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.2 Layout Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="Lax" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.2 Layout Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="LaxTsFirst" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.2 Layout Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="LaxTsLast" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.2 Layout Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="TransportBinding" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.3 TransportBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="TransportToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.3 TransportBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- Layout defined above. -->
-
- <xs:element name="IncludeTimestamp" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.3 TransportBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="SymmetricBinding" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="EncryptionToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="SignatureToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8=7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="ProtectionToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- Layout defined above. -->
- <!-- IncludeTimestamp defined above. -->
-
- <xs:element name="EncryptBeforeSigning" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="EncryptSignature" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="ProtectTokens" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="OnlySignEntireHeadersAndBody" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.4 SymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="AsymmetricBinding" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.5 AsymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="InitiatorToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.5 AsymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="InitiatorSignatureToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.5 AsymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="InitiatorEncryptionToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.5 AsymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="RecipientToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.5 AsymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="RecipientSignatureToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.5 AsymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="RecipientEncryptionToken" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 7.5 AsymmetricBinding Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- Layout defined above. -->
- <!-- IncludeTimestamp defined above. -->
- <!-- EncryptBeforeSigning defined above. -->
- <!-- EncryptSignature defined above. -->
- <!-- ProtectTokens defined above. -->
- <!-- OnlySignEntireHeadersAndBody defined above. -->
-
- <!--
- 8. Supporting Tokens
- -->
- <xs:element name="SupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.1 SupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <xs:element name="SignedSupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.2 SignedSupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <xs:element name="EndorsingSupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.3 EndorsingSupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <xs:element name="SignedEndorsingSupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.4 SignedEndorsingSupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <xs:element name="SignedEncryptedSupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.5 SignedEncryptedSupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <xs:element name="EncryptedSupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.6 EncryptedSupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <xs:element name="EndorsingEncryptedSupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.7 EndorsingEncryptedSupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <xs:element name="SignedEndorsingEncryptedSupportingTokens" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 8.8 SignedEndorsingEncryptedSupportingTokens Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- AlgorithmSuite defined above. -->
- <!-- SignedParts defined above. -->
- <!-- SignedElements defined above. -->
- <!-- EncryptedParts defined above. -->
- <!-- EncryptedElements defined above. -->
-
- <!--
- 9. WSS: SOAP Message Security Options
- -->
- <xs:element name="Wss10" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.1 Wss10 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="MustSupportRefKeyIdentifier" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.1 Wss10 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustSupportRefIssuerSerial" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.1 Wss10 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustSupportRefExternalURI" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.1 Wss10 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustSupportRefEmbeddedToken" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.1 Wss10 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="Wss11" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.2 Wss11 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <!-- MustSupportRefKeyIdentifier defined above. -->
- <!-- MustSupportRefIssuerSerial defined above. -->
- <!-- MustSupportRefExternalURI defined above. -->
- <!-- MustSupportRefEmbeddedToken defined above. -->
-
- <xs:element name="MustSupportRefThumbprint" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.2 Wss11 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustSupportRefEncryptedKey" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.2 Wss11 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireSignatureConfirmation" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 9.2 Wss11 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <!--
- 10. WS-Trust Options
- -->
- <xs:element name="Trust13" type="tns:NestedPolicyType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
- <xs:element name="MustSupportClientChallenge" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustSupportServerChallenge" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireClientEntropy" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireServerEntropy" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="MustSupportIssuedTokens" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireRequestSecurityTokenCollection" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
- <xs:element name="RequireAppiesTo" type="tns:QNameAssertionType">
- <xs:annotation>
- <xs:documentation xml:lang="en">
- 10.1 Trust13 Assertion
- </xs:documentation>
- </xs:annotation>
- </xs:element>
-
-</xs:schema>
diff --git a/shibsp/Makefile.am b/shibsp/Makefile.am
index c67b271a..6e2327c8 100644
--- a/shibsp/Makefile.am
+++ b/shibsp/Makefile.am
@@ -162,11 +162,9 @@ libshibsp_la_LIBADD = \
$(libcurl_LIBS)
pkgsysconfdir = $(sysconfdir)/@PACKAGE_NAME@
-pkgxmldir = $(datadir)/xml/@PACKAGE_NAME@
logdir = ${localstatedir}/log
rundir = $(localstatedir)/run
cachedir = $(localstatedir)/cache
-xmldir = $(datadir)/xml
paths.h: ${srcdir}/paths.h.in Makefile ${top_builddir}/config.status
rm -f $@.tmp
@@ -177,11 +175,7 @@ paths.h: ${srcdir}/paths.h.in Makefile ${top_builddir}/config.status
-e 's:@-LOGDIR-@:${logdir}:g' \
-e 's:@-RUNDIR-@:${rundir}:g' \
-e 's:@-CACHEDIR-@:${cachedir}:g' \
- -e 's:@-XMLDIR-@:${xmldir}:g' \
- -e 's:@-PKGSYSCONFDIR-@:${pkgsysconfdir}:g' \
- -e 's:@-PKGXMLDIR-@:${pkgxmldir}:g' \
- -e 's:@-XMLTOOLINGXMLDIR-@:${XMLTOOLINGXMLDIR}:g' \
- -e 's:@-OPENSAMLXMLDIR-@:${OPENSAMLXMLDIR}:g'
+ -e 's:@-PKGSYSCONFDIR-@:${pkgsysconfdir}:g'
cmp -s $@ $@.tmp || mv $@.tmp $@
rm -f $@.tmp
diff --git a/shibsp/base.h b/shibsp/base.h
index bb8544af..695dca7e 100644
--- a/shibsp/base.h
+++ b/shibsp/base.h
@@ -82,9 +82,6 @@
#ifdef WIN32
-/** Default catalog path on Windows. */
-# define SHIBSP_SCHEMAS "%PROGRAMDATA%/Shibboleth/SP/xml/xmltooling/catalog.xml;%PROGRAMDATA%/Shibboleth/SP/xml/opensaml/saml20-catalog.xml;%PROGRAMDATA%/Shibboleth/SP/xml/opensaml/saml11-catalog.xml;%PROGRAMDATA%/Shibboleth/SP/xml/shibboleth/catalog.xml"
-
/** Default prefix for installation (used to resolve relative paths). */
#define SHIBSP_PREFIX "c:/opt/shibboleth-sp"
@@ -112,9 +109,6 @@
/** Cache directory for installation (used to resolve relative paths). */
#define SHIBSP_CACHEDIR "var/cache"
-/** XML directory for installation (used to resolve relative paths). */
-#define SHIBSP_XMLDIR "share/xml"
-
#else
# include <shibsp/paths.h>
#endif
diff --git a/shibsp/handler/impl/AbstractHandler.cpp b/shibsp/handler/impl/AbstractHandler.cpp
index fd0013fd..4a2633ef 100644
--- a/shibsp/handler/impl/AbstractHandler.cpp
+++ b/shibsp/handler/impl/AbstractHandler.cpp
@@ -83,8 +83,8 @@ void SHIBSP_API shibsp::registerHandlers()
{
AgentConfig& conf=AgentConfig::getConfig();
- conf.HandlerManager.registerFactory(ATTR_CHECKER_HANDLER, AttributeCheckerFactory);
- conf.HandlerManager.registerFactory(METADATA_GENERATOR_HANDLER, MetadataGeneratorFactory);
+ //conf.HandlerManager.registerFactory(ATTR_CHECKER_HANDLER, AttributeCheckerFactory);
+ //conf.HandlerManager.registerFactory(METADATA_GENERATOR_HANDLER, MetadataGeneratorFactory);
conf.HandlerManager.registerFactory(SESSION_HANDLER, SessionHandlerFactory);
//conf.HandlerManager.registerFactory(SAML20_ASSERTION_CONSUMER_SERVICE, SAML2ConsumerFactory);
diff --git a/shibsp/handler/impl/SecuredHandler.cpp b/shibsp/handler/impl/SecuredHandler.cpp
index aa74ec9b..33e3cf4a 100644
--- a/shibsp/handler/impl/SecuredHandler.cpp
+++ b/shibsp/handler/impl/SecuredHandler.cpp
@@ -1,25 +1,19 @@
/**
- * Licensed to the University Corporation for Advanced Internet
- * Development, Inc. (UCAID) under one or more contributor license
- * agreements. See the NOTICE file distributed with this work for
- * additional information regarding copyright ownership.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
*
- * UCAID licenses this file to you under the Apache License,
- * Version 2.0 (the "License"); you may not use this file except
- * in compliance with the License. You may obtain a copy of the
- * License at
+ * http://www.apache.org/licenses/LICENSE-2.0
*
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
*/
/**
- * SecuredHandler.cpp
+ * handler/impl/SecuredHandler.cpp
*
* Pluggable runtime functionality that is protected by simple access control.
*/
diff --git a/shibsp/handler/impl/StatusHandler.cpp b/shibsp/handler/impl/StatusHandler.cpp
index 9249b33c..3f692029 100644
--- a/shibsp/handler/impl/StatusHandler.cpp
+++ b/shibsp/handler/impl/StatusHandler.cpp
@@ -13,16 +13,15 @@
*/
/**
- * StatusHandler.cpp
+ * handler/impl/StatusHandler.cpp
*
- * Handler for exposing information about the internals of the SP.
+ * Handler for exposing information about the state of the agent.
*/
#include "internal.h"
#include "exceptions.h"
#include "Agent.h"
#include "SPRequest.h"
-#include "handler/RemotedHandler.h"
#include "handler/SecuredHandler.h"
#include "logging/Category.h"
#include "session/SessionCache.h"
@@ -71,7 +70,7 @@ namespace shibsp {
return new StatusHandler(p.first);
}
- class DummyRequest : public HTTPRequest
+ class DummyRequest : public virtual HTTPRequest
{
public:
DummyRequest(const char* url) : m_parser(nullptr), m_url(url), m_scheme(nullptr), m_query(nullptr), m_port(0) {
@@ -207,8 +206,9 @@ pair<bool,long> StatusHandler::run(SPRequest& request, bool isHandler) const
{
// Check ACL in base class.
pair<bool,long> ret = SecuredHandler::run(request, isHandler);
- if (ret.first)
+ if (ret.first) {
return ret;
+ }
auto now = chrono::system_clock::now();
diff --git a/shibsp/paths.h.in b/shibsp/paths.h.in
index 06a56ac6..001c68e7 100644
--- a/shibsp/paths.h.in
+++ b/shibsp/paths.h.in
@@ -39,7 +39,4 @@
/** Cache directory for installation (used to resolve relative paths). */
#define SHIBSP_CACHEDIR "@-CACHEDIR-@"
-/** XML directory for installation (used to resolve relative paths). */
-#define SHIBSP_XMLDIR "@-XMLDIR-@"
-
#endif /* __shibsp_paths_h__ */
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list