schemas/shibboleth.xsd

   1 <?xml version="1.0" encoding="US-ASCII"?>
   2 <schema targetNamespace="urn:mace:shibboleth:1.0"
   3         xmlns="http://www.w3.org/2001/XMLSchema"
   4         xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
   5         xmlns:xml="http://www.w3.org/XML/1998/namespace"
   6         xmlns:shib="urn:mace:shibboleth:1.0"
   7         xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
   8         elementFormDefault="qualified"
   9         attributeFormDefault="unqualified"
  10         version="1.3">
  11
  12     <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
  13     <import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="xml.xsd"/>
  14     <import namespace="urn:oasis:names:tc:SAML:1.0:assertion" schemaLocation="cs-sstc-schema-assertion-1.1.xsd"/>
  15
  16     <!-- Status-Related Information -->
  17
  18     <!--
  19     The following SAML sub-status codes are defined in this namespace:
  20
  21         "InvalidHandle"
  22             Used with samlp:Requester, signals AA did not recognize handle as valid
  23     -->
  24
  25     <!--
  26     Relaxes SAML AttributeValue type definition. Xerces-C has a bug that prevents
  27     anyAttribute content appearing on anyType. It works in 2.2 but not in later versions.
  28     -->
  29
  30         <complexType name="AttributeValueType" mixed="true">
  31                 <annotation>
  32                         <documentation xml:lang="en">
  33                         By convention, all Shibboleth 1.1 origin attribute values carry this unconstrained xsi:type.
  34                         </documentation>
  35                 </annotation>
  36                 <complexContent>
  37                         <extension base="anyType"/>
  38                 </complexContent>
  39         </complexType>
  40
  41     <!-- Attribute Acceptance Policies -->
  42
  43     <simpleType name="AttributeRuleValueType">
  44         <restriction base="string">
  45             <enumeration value="literal"/>
  46             <enumeration value="regexp"/>
  47             <enumeration value="xpath"/>
  48         </restriction>
  49     </simpleType>
  50
  51     <complexType name="SiteRuleType">
  52         <sequence>
  53                 <element name="Scope" minOccurs="0" maxOccurs="unbounded">
  54                         <complexType>
  55                     <simpleContent>
  56                         <extension base="string">
  57                                 <attribute name="Accept" type="boolean" use="optional" default="true"/>
  58                             <attribute name="Type" type="shib:AttributeRuleValueType" use="optional" default="literal"/>
  59                             <anyAttribute namespace="##other" processContents="lax"/>
  60                         </extension>
  61                     </simpleContent>
  62                         </complexType>
  63                 </element>
  64                 <choice minOccurs="0">
  65                         <element name="AnyValue">
  66                                 <complexType>
  67                                         <sequence/>
  68                                         <anyAttribute namespace="##other" processContents="lax"/>
  69                                 </complexType>
  70                         </element>
  71                     <element name="Value" maxOccurs="unbounded">
  72                         <complexType>
  73                             <simpleContent>
  74                                 <extension base="string">
  75                                     <attribute name="Type" type="shib:AttributeRuleValueType" use="optional" default="literal"/>
  76                                     <anyAttribute namespace="##other" processContents="lax"/>
  77                                 </extension>
  78                             </simpleContent>
  79                         </complexType>
  80                     </element>
  81                 </choice>
  82         </sequence>
  83     </complexType>
  84
  85     <element name="AnySite" type="shib:SiteRuleType"/>
  86     <element name="SiteRule">
  87         <complexType>
  88             <complexContent>
  89                 <extension base="shib:SiteRuleType">
  90                     <attribute name="Name" type="string" use="required"/>
  91                     <anyAttribute namespace="##other" processContents="lax"/>
  92                 </extension>
  93             </complexContent>
  94         </complexType>
  95     </element>
  96
  97     <complexType name="AttributeRuleType">
  98         <sequence>
  99             <element ref="shib:AnySite" minOccurs="0"/>
 100             <element ref="shib:SiteRule" minOccurs="0" maxOccurs="unbounded"/>
 101         </sequence>
 102         <attribute name="Name" type="string" use="required"/>
 103         <attribute name="Namespace" type="string" use="optional"/>
 104         <attribute name="Factory" type="string" use="optional"/>
 105         <attribute name="Alias" type="string" use="optional"/>
 106                 <attribute name="Header" type="string" use="optional"/>
 107                 <attribute name="Scoped" type="boolean" use="optional" default="false"/>
 108                 <attribute name="CaseSensitive" type="boolean" use="optional" default="true"/>
 109                 <anyAttribute namespace="##other" processContents="lax"/>
 110     </complexType>
 111
 112     <element name="AttributeRule" type="shib:AttributeRuleType">
 113         <key name="SiteRuleKey">
 114             <selector xpath="./shib:SiteRule"/>
 115             <field xpath="@Name"/>
 116         </key>
 117     </element>
 118
 119     <element name="AttributeAcceptancePolicy">
 120         <complexType>
 121             <sequence>
 122                 <element name="AnyAttribute" minOccurs="0">
 123                     <complexType>
 124                         <sequence/>
 125                     </complexType>
 126                 </element>
 127                 <element ref="shib:AttributeRule" minOccurs="0" maxOccurs="unbounded"/>
 128             </sequence>
 129             <anyAttribute namespace="##other" processContents="lax"/>
 130         </complexType>
 131     </element>
 132
 133
 134     <!-- Shibboleth Metadata -->
 135
 136     <complexType name="SiteType">
 137         <annotation>
 138                 <documentation xml:lang="en">All sites have a Name attribute, plus optional i18n-ized aliases.</documentation>
 139         </annotation>
 140         <sequence>
 141             <element name="Alias" minOccurs="0" maxOccurs="unbounded">
 142                 <complexType>
 143                     <simpleContent>
 144                         <extension base="string">
 145                             <attribute ref="xml:lang"/>
 146                         </extension>
 147                     </simpleContent>
 148                 </complexType>
 149             </element>
 150             <element name="Contact" type="shib:ContactType" minOccurs="0" maxOccurs="unbounded"/>
 151         </sequence>
 152         <attribute name="Name" type="string" use="required"/>
 153         <attribute name="ErrorURL" type="anyURI" use="optional"/>
 154         <anyAttribute namespace="##any" processContents="lax"/>
 155     </complexType>
 156
 157         <simpleType name="ContactTypeType">
 158                 <restriction base="string">
 159             <enumeration value="technical"/>
 160             <enumeration value="support"/>
 161             <enumeration value="administrative"/>
 162             <enumeration value="billing"/>
 163             <enumeration value="other"/>
 164         </restriction>
 165     </simpleType>
 166
 167         <complexType name="ContactType">
 168                 <annotation><documentation xml:lang="en">A human contact for a site.</documentation></annotation>
 169                 <sequence/>
 170         <attribute name="Type" type="shib:ContactTypeType" use="required"/>
 171         <attribute name="Name" type="string" use="required"/>
 172         <attribute name="Email" type="string" use="optional"/>
 173         </complexType>
 174
 175     <complexType name="regexp_string">
 176         <annotation>
 177                 <documentation xml:lang="en">A string element with an optional attribute signaling regexp content.</documentation>
 178         </annotation>
 179         <simpleContent>
 180             <extension base="string">
 181                 <attribute name="regexp" type="boolean" use="optional" default="false"/>
 182             </extension>
 183         </simpleContent>
 184     </complexType>
 185
 186         <complexType name="AuthorityType">
 187                 <annotation>
 188                         <documentation xml:lang="en">Metadata about a SAML authority.</documentation>
 189                 </annotation>
 190         <sequence/>
 191         <attribute name="Name" type="string" use="required"/>
 192         <attribute name="Location" type="anyURI" use="required"/>
 193         <anyAttribute namespace="##any" processContents="lax"/>
 194         </complexType>
 195
 196     <complexType name="OriginSiteType">
 197         <annotation>
 198                 <documentation xml:lang="en">
 199                 Origin sites add at least one handle service (with a name), plus optional domains trusted for attribute scoping.
 200                 </documentation>
 201         </annotation>
 202         <complexContent>
 203                 <extension base="shib:SiteType">
 204                     <sequence>
 205                         <element name="HandleService" type="shib:AuthorityType" maxOccurs="unbounded"/>
 206                         <element name="AttributeAuthority" type="shib:AuthorityType" minOccurs="0" maxOccurs="unbounded"/>
 207                         <element ref="shib:Domain" minOccurs="0" maxOccurs="unbounded"/>
 208                     </sequence>
 209                 </extension>
 210         </complexContent>
 211     </complexType>
 212
 213         <element name="Domain" type="shib:regexp_string">
 214                 <annotation>
 215                         <documentation xml:lang="en">A metadata extension used to regulate allowable attribute scopes.</documentation>
 216                 </annotation>
 217         </element>
 218
 219     <complexType name="DestinationSiteType">
 220         <annotation>
 221                 <documentation xml:lang="en">
 222                 Destination sites add at least one attribute requester (with a name).
 223                 </documentation>
 224         </annotation>
 225         <complexContent>
 226                 <extension base="shib:SiteType">
 227                     <sequence>
 228                         <element name="AssertionConsumerServiceURL" maxOccurs="unbounded">
 229                                 <complexType>
 230                                         <attribute name="Location" type="string" use="required"/>
 231                                                 <attribute name="Id" type="string" use="optional"/>
 232                                                 <anyAttribute namespace="##any" processContents="lax"/>
 233                                 </complexType>
 234                         </element>
 235                         <element name="AttributeRequester" maxOccurs="unbounded">
 236                                 <complexType>
 237                                         <attribute name="Name" type="string" use="required"/>
 238                                                 <anyAttribute namespace="##any" processContents="lax"/>
 239                                 </complexType>
 240                         </element>
 241                     </sequence>
 242                 </extension>
 243         </complexContent>
 244     </complexType>
 245
 246     <complexType name="SiteGroupType">
 247         <annotation>
 248                 <documentation xml:lang="en">Used to logically group sites together, optionally signed.</documentation>
 249         </annotation>
 250         <sequence>
 251             <choice maxOccurs="unbounded">
 252                 <element ref="shib:OriginSite"/>
 253                 <element ref="shib:DestinationSite"/>
 254                 <element ref="shib:SiteGroup"/>
 255             </choice>
 256             <element ref="ds:Signature" minOccurs="0"/>
 257         </sequence>
 258         <attribute name="Name" type="string" use="required"/>
 259         <attribute name="lastChanged" type="dateTime" use="optional"/>
 260         <attribute name="validUntil" type="dateTime" use="optional"/>
 261         <attribute name="cacheDuration" type="duration" use="optional"/>
 262         <anyAttribute namespace="##any" processContents="lax"/>
 263     </complexType>
 264
 265     <element name="OriginSite" type="shib:OriginSiteType"/>
 266     <element name="DestinationSite" type="shib:DestinationSiteType"/>
 267     <element name="SiteGroup" type="shib:SiteGroupType"/>
 268
 269
 270         <!-- Old (pre 1.2) Trust Metadata -->
 271
 272         <complexType name="KeyAuthorityType">
 273                 <annotation>
 274                         <documentation xml:lang="en">
 275                         Binds a set of keying material to one or more named system entities.
 276                         </documentation>
 277                 </annotation>
 278                 <sequence>
 279                         <element ref="ds:KeyInfo"/>
 280                         <element name="Subject" type="shib:regexp_string" minOccurs="0" maxOccurs="unbounded"/>
 281                 </sequence>
 282                 <anyAttribute namespace="##any" processContents="lax"/>
 283         </complexType>
 284         <element name="KeyAuthority" type="shib:KeyAuthorityType"/>
 285
 286         <element name="Trust">
 287                 <annotation>
 288                         <documentation xml:lang="en">An optionally signed collection of KeyAuthority data.</documentation>
 289                 </annotation>
 290                 <complexType>
 291                         <sequence>
 292                                 <element ref="shib:KeyAuthority" maxOccurs="unbounded"/>
 293                                 <element ref="ds:Signature" minOccurs="0"/>
 294                         </sequence>
 295                 <attribute name="lastChanged" type="dateTime" use="optional"/>
 296                 <attribute name="validUntil" type="dateTime" use="optional"/>
 297                 <attribute name="cacheDuration" type="duration" use="optional"/>
 298                 <anyAttribute namespace="##any" processContents="lax"/>
 299                 </complexType>
 300         </element>
 301
 302 </schema>