schemas/shibboleth.xsd

   1 <?xml version="1.0" encoding="US-ASCII"?>
   2 <schema targetNamespace="urn:mace:shibboleth:1.0" xmlns="http://www.w3.org/2001/XMLSchema" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xml="http://www.w3.org/XML/1998/namespace" xmlns:shib="urn:mace:shibboleth:1.0" elementFormDefault="qualified" attributeFormDefault="unqualified" version="1.0">
   3     <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>
   4     <import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="http://www.w3.org/2001/xml.xsd"/>
   5
   6
   7     <!-- Status-Related Information -->
   8
   9     <!--
  10     The following SAML sub-status codes are defined in this namespace:
  11
  12         "RealTimeRelease"
  13             Used with samlp:Responder, signals user wants real-time attribute release
  14
  15         "InvalidHandle"
  16             Used with samlp:Requester, signals AA did not recognize handle as valid
  17     -->
  18
  19     <element name="RealTimeReleaseURL" type="anyURI">
  20         <annotation>
  21                 <documentation xml:lang="en">Used by AA in samlp:StatusDetail to signal user wants real-time attribute release.</documentation>
  22         </annotation>
  23     </element>
  24
  25
  26     <!-- Relaxes SAML AttributeValue type definition -->
  27
  28         <complexType name="AttributeValueType" mixed="true">
  29                 <annotation>
  30                         <documentation xml:lang="en">By convention, all Shibboleth attribute values carry this unconstrained xsi:type.</documentation>
  31                 </annotation>
  32                 <sequence>
  33                         <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
  34                 </sequence>
  35                 <anyAttribute namespace="##any" processContents="lax"/>
  36         </complexType>
  37
  38
  39     <!-- Attribute Acceptance Policies -->
  40
  41     <simpleType name="AttributeRuleValueType">
  42         <restriction base="string">
  43             <enumeration value="literal"/>
  44             <enumeration value="regexp"/>
  45             <enumeration value="xpath"/>
  46         </restriction>
  47     </simpleType>
  48
  49     <complexType name="SiteRuleType">
  50         <choice>
  51                 <element name="AnyValue">
  52                         <complexType>
  53                                 <sequence/>
  54                         </complexType>
  55                 </element>
  56             <element name="Value" maxOccurs="unbounded">
  57                 <complexType>
  58                     <simpleContent>
  59                         <extension base="string">
  60                             <attribute name="Type" type="shib:AttributeRuleValueType" use="optional" default="literal"/>
  61                         </extension>
  62                     </simpleContent>
  63                 </complexType>
  64             </element>
  65         </choice>
  66     </complexType>
  67
  68     <element name="AnySite" type="shib:SiteRuleType"/>
  69     <element name="SiteRule">
  70         <complexType>
  71             <complexContent>
  72                 <extension base="shib:SiteRuleType">
  73                     <attribute name="Name" type="string" use="required"/>
  74                 </extension>
  75             </complexContent>
  76         </complexType>
  77     </element>
  78
  79     <complexType name="AttributeRuleType">
  80         <sequence>
  81             <element ref="shib:AnySite" minOccurs="0"/>
  82             <element ref="shib:SiteRule" minOccurs="0" maxOccurs="unbounded"/>
  83         </sequence>
  84         <attribute name="Name" type="string" use="required"/>
  85         <attribute name="Namespace" type="string" use="optional"/>
  86         <attribute name="Factory" type="string" use="optional"/>
  87         <attribute name="Alias" type="string" use="optional"/>
  88                 <attribute name="Header" type="string" use="optional"/>
  89     </complexType>
  90
  91     <element name="AttributeRule" type="shib:AttributeRuleType">
  92         <key name="SiteRuleKey">
  93             <selector xpath="./shib:SiteRule"/>
  94             <field xpath="@Name"/>
  95         </key>
  96     </element>
  97
  98     <element name="AttributeAcceptancePolicy">
  99         <complexType>
 100             <sequence>
 101                 <element ref="shib:AttributeRule" minOccurs="0" maxOccurs="unbounded"/>
 102             </sequence>
 103         </complexType>
 104     </element>
 105
 106
 107     <!-- Shibboleth Metadata -->
 108
 109     <complexType name="SiteType">
 110         <annotation>
 111                 <documentation xml:lang="en">All sites have a Name attribute, plus optional i18n-ized aliases.</documentation>
 112         </annotation>
 113         <sequence>
 114             <element name="Alias" minOccurs="0" maxOccurs="unbounded">
 115                 <complexType>
 116                     <simpleContent>
 117                         <extension base="string">
 118                             <attribute ref="xml:lang"/>
 119                         </extension>
 120                     </simpleContent>
 121                 </complexType>
 122             </element>
 123             <element name="Contact" type="shib:ContactType" minOccurs="0" maxOccurs="unbounded"/>
 124         </sequence>
 125         <attribute name="Name" type="string" use="required"/>
 126         <attribute name="ErrorURL" type="anyURI" use="optional"/>
 127     </complexType>
 128
 129         <simpleType name="ContactTypeType">
 130                 <restriction base="string">
 131             <enumeration value="technical"/>
 132             <enumeration value="administrative"/>
 133             <enumeration value="billing"/>
 134             <enumeration value="other"/>
 135         </restriction>
 136     </simpleType>
 137
 138         <complexType name="ContactType">
 139                 <annotation><documentation xml:lang="en">A human contact for a site.</documentation></annotation>
 140                 <sequence/>
 141         <attribute name="Type" type="shib:ContactTypeType" use="required"/>
 142         <attribute name="Name" type="string" use="required"/>
 143         <attribute name="Email" type="string" use="optional"/>
 144         </complexType>
 145
 146     <complexType name="regexp_string">
 147         <annotation>
 148                 <documentation xml:lang="en">A string element with an optional attribute signaling regexp content.</documentation>
 149         </annotation>
 150         <simpleContent>
 151             <extension base="string">
 152                 <attribute name="regexp" type="boolean" use="optional" default="false"/>
 153             </extension>
 154         </simpleContent>
 155     </complexType>
 156
 157         <complexType name="AuthorityType">
 158                 <annotation>
 159                         <documentation xml:lang="en">Metadata about a SAML authority.</documentation>
 160                 </annotation>
 161         <sequence/>
 162         <attribute name="Name" type="string" use="required"/>
 163         <attribute name="Location" type="anyURI" use="required"/>
 164         </complexType>
 165
 166     <complexType name="OriginSiteType">
 167         <annotation>
 168                 <documentation xml:lang="en">Origin sites add at least one handle service (with a name and optional KeyInfo), plus optional domains trusted for attribute scoping.</documentation>
 169         </annotation>
 170         <complexContent>
 171                 <extension base="shib:SiteType">
 172                     <sequence>
 173                         <element name="HandleService" type="shib:AuthorityType" maxOccurs="unbounded"/>
 174                         <element name="AttributeAuthority" type="shib:AuthorityType" minOccurs="0" maxOccurs="unbounded"/>
 175                         <element name="Domain" type="shib:regexp_string" minOccurs="0" maxOccurs="unbounded"/>
 176                     </sequence>
 177                 </extension>
 178         </complexContent>
 179     </complexType>
 180
 181     <complexType name="SiteGroupType">
 182         <annotation>
 183                 <documentation xml:lang="en">Used to logically group sites together, optionally signed.</documentation>
 184         </annotation>
 185         <sequence>
 186             <choice maxOccurs="unbounded">
 187                 <element ref="shib:OriginSite"/>
 188                 <element ref="shib:DestinationSite"/>
 189                 <element ref="shib:SiteGroup"/>
 190             </choice>
 191             <element ref="ds:Signature" minOccurs="0"/>
 192         </sequence>
 193         <attribute name="Name" type="string" use="required"/>
 194     </complexType>
 195
 196     <element name="OriginSite" type="shib:OriginSiteType"/>
 197     <element name="DestinationSite" type="shib:SiteType"/>
 198     <element name="SiteGroup" type="shib:SiteGroupType"/>
 199
 200         <complexType name="KeyAuthorityType">
 201                 <annotation>
 202                         <documentation xml:lang="en">Binds a set of keying material to one or more named system entities.</documentation>
 203                 </annotation>
 204                 <sequence>
 205                         <element ref="ds:KeyInfo"/>
 206                         <element name="Subject" type="shib:regexp_string" maxOccurs="unbounded"/>
 207                 </sequence>
 208         </complexType>
 209
 210         <element name="KeyAuthority" type="shib:KeyAuthorityType"/>
 211
 212         <element name="Trust">
 213                 <annotation>
 214                         <documentation xml:lang="en">An optionally signed collection of KeyAuthority data.</documentation>
 215                 </annotation>
 216                 <complexType>
 217                         <sequence>
 218                                 <element ref="shib:KeyAuthority" maxOccurs="unbounded"/>
 219                                 <element ref="ds:Signature" minOccurs="0"/>
 220                         </sequence>
 221                 </complexType>
 222         </element>
 223
 224 </schema>