https://issues.shibboleth.net/jira/browse/SSPCPP-257

[shibboleth/cpp-sp.git] / schemas / shibboleth-2.0-afp.xsd

diff --git a/schemas/shibboleth-2.0-afp.xsd b/schemas/shibboleth-2.0-afp.xsd
index e132a4f..ded4423 100644 (file)
--- a/schemas/shibboleth-2.0-afp.xsd
+++ b/schemas/shibboleth-2.0-afp.xsd
@@ -4,10 +4,10 @@
     xmlns="http://www.w3.org/2001/XMLSchema"
     xmlns:afp="urn:mace:shibboleth:2.0:afp"
     xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
-    elementFormDefault="qualified">\r
-\r
-    <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="classpath:/schema/xmldsig-core-schema.xsd" />\r
-\r
+    elementFormDefault="qualified">
+
+    <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="classpath:/schema/xmldsig-core-schema.xsd" />
+
     <annotation>
         <documentation>Schema for the attribute filter policies.</documentation>
     </annotation>
@@ -34,10 +34,17 @@
                     <element ref="afp:PermitValueRule" minOccurs="0" maxOccurs="unbounded">
                         <annotation>
                             <documentation>
-                                Defines an attribute value filter that may be reused across multiple attribute rules.
+                                Defines a permit value rule that may be reused across multiple attribute rules.
                             </documentation>
                         </annotation>
-                    </element>\r
+                    </element>
+                    <element ref="afp:DenyValueRule" minOccurs="0" maxOccurs="unbounded">
+                        <annotation>
+                            <documentation>
+                                Defines a deny value rule that may be reused across multiple attribute rules.
+                            </documentation>
+                        </annotation>
+                    </element>
                     <element ref="afp:AttributeRule" minOccurs="0" maxOccurs="unbounded">
                         <annotation>
                             <documentation>
@@ -60,10 +67,10 @@
                                 such as a federation site, should be signed.
                             </documentation>
                         </annotation>
-                    </element>\r
-                </sequence>\r
+                    </element>
+                </sequence>
             </extension>
-        </complexContent>\r
+        </complexContent>
     </complexType>
 
     <element name="AttributeFilterPolicy" type="afp:AttributeFilterPolicyType">
@@ -89,7 +96,7 @@
                         <element name="PolicyRequirementRuleReference" type="afp:ReferenceType">
                             <annotation>
                                 <documentation>
-                                    Rerfence to a PolicyRequirement defined within this policy group or another.
+                                    Reference to a PolicyRequirement defined within this policy group or another.
                                 </documentation>
                             </annotation>
                         </element>
@@ -105,7 +112,7 @@
                         <element name="AttributeRuleReference" type="afp:ReferenceType">
                             <annotation>
                                 <documentation>
-                                    Rerfence to a AttribtueRule defined within this policy group or another.
+                                    Reference to a AttributeRule defined within this policy group or another.
                                 </documentation>
                             </annotation>
                         </element>
@@ -113,32 +120,37 @@
                 </sequence>
             </extension>
         </complexContent>
-    </complexType>\r
-\r
+    </complexType>
+
     <element name="AttributeRule" type="afp:AttributeRuleType">
         <annotation>
             <documentation>A rule that describes how values of an attribute will be filtered.</documentation>
         </annotation>
-    </element>\r
+    </element>
     <complexType name="AttributeRuleType">
         <complexContent>
             <extension base="afp:IdentityType">
                 <choice>
-                    <element ref="afp:PermitValueRule">
-                        <annotation>
-                            <documentation>
-                                A filter for attribute values. If the filter evaluates to true the value is permitted,
-                                otherwise it is filtered out.
-                            </documentation>
-                        </annotation>
-                    </element>
-                    <element name="PermitValueRuleReference" type="afp:ReferenceType">
-                        <annotation>
-                            <documentation>
-                                Rerfence to a PermitValueRule defined within this policy group or another.
-                            </documentation>
-                        </annotation>
-                    </element>
+                    <choice minOccurs="0">
+                        <element ref="afp:PermitValueRule" />
+                        <element name="PermitValueRuleReference" type="afp:ReferenceType">
+                            <annotation>
+                                <documentation>
+                                    Reference to a PermitValueRule defined within this policy group or another.
+                                </documentation>
+                            </annotation>
+                        </element>
+                    </choice>
+                    <choice minOccurs="0">
+                        <element ref="afp:DenyValueRule" />
+                        <element name="DenyValueRuleReference" type="afp:ReferenceType">
+                            <annotation>
+                                <documentation>
+                                    Reference to a DenyValueRule defined within this policy group or another.
+                                </documentation>
+                            </annotation>
+                        </element>
+                    </choice>
                 </choice>
                 <attribute name="attributeID" type="string" use="required">
                     <annotation>
@@ -146,7 +158,7 @@
                     </annotation>
                 </attribute>
             </extension>
-        </complexContent>\r
+        </complexContent>
     </complexType>
 
     <element name="PolicyRequirementRule" type="afp:MatchFunctorType">
@@ -157,8 +169,14 @@
     <element name="PermitValueRule" type="afp:MatchFunctorType">
         <annotation>
             <documentation>
-                A filter for attribtue values. If the filter evaluates to true the value is permitted, otherwise it is
-                filtered out.
+                A filter for attribute values. If the filter evaluates to true the value is permitted to be released.
+            </documentation>
+        </annotation>
+    </element>
+    <element name="DenyValueRule" type="afp:MatchFunctorType">
+        <annotation>
+            <documentation>
+                A filter for attribute values. If the filter evaluates to true the value is denied and may not be released.
             </documentation>
         </annotation>
     </element>
@@ -184,4 +202,4 @@
         </attribute>
     </complexType>
 
-</schema>
\ No newline at end of file
+</schema>