More config cleanup, use default TrustEngine chain if absent.

[shibboleth/cpp-sp.git] / schemas / shibboleth-2.0-native-sp-config.xsd

diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index 5d69ba6..14068cd 100644 (file)
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -2,6 +2,7 @@
 <schema targetNamespace="urn:mace:shibboleth:2.0:native:sp:config"
        xmlns="http://www.w3.org/2001/XMLSchema"
        xmlns:conf="urn:mace:shibboleth:2.0:native:sp:config"
+    xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
        xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
        xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
        xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
@@ -10,6 +11,7 @@
        blockDefault="substitution"
        version="2.4">
 
+  <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd" />
   <import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="saml-schema-assertion-2.0.xsd"/>
   <import namespace="urn:oasis:names:tc:SAML:2.0:protocol" schemaLocation="saml-schema-protocol-2.0.xsd"/>
   <import namespace="urn:oasis:names:tc:SAML:2.0:metadata" schemaLocation="saml-schema-metadata-2.0.xsd"/>
@@ -108,7 +110,7 @@
       <documentation>Ties ReplayCache to a custom StorageService</documentation>
     </annotation>
     <sequence/>
-    <attribute name="StorageService" type="IDREF" use="required"/>
+    <attribute name="StorageService" type="IDREF"/>
   </complexType>
 
   <complexType name="ArtifactMapType">
@@ -218,6 +220,7 @@
   </complexType>
 
   <attributeGroup name="ContentSettings">
+    <attribute name="applicationId" type="conf:string"/>
     <attribute name="authType" type="conf:string"/>
     <attribute name="requireSession" type="boolean"/>
     <attribute name="requireSessionWith" type="conf:string"/>
@@ -260,8 +263,8 @@
           <element name="Host" type="conf:HostType"/>
           <element name="HostRegex" type="conf:HostRegexType"/>
         </choice>
+        <element ref="ds:Signature" minOccurs="0"/>
       </sequence>
-      <attribute name="applicationId" type="conf:string" fixed="default"/>
       <attributeGroup ref="conf:ContentSettings"/>
     </complexType>
   </element>
@@ -292,7 +295,6 @@
     </attribute>
     <attribute name="name" type="conf:string" use="required"/>
     <attribute name="port" type="unsignedInt"/>
-    <attribute name="applicationId" type="conf:string"/>
     <attributeGroup ref="conf:ContentSettings"/>
   </complexType>
 
@@ -311,7 +313,6 @@
     </sequence>
     <attribute name="regex" type="conf:string" use="required"/>
     <attribute name="ignoreCase" type="boolean"/>
-    <attribute name="applicationId" type="conf:string"/>
     <attributeGroup ref="conf:ContentSettings"/>
   </complexType>
 
@@ -329,7 +330,6 @@
       </choice>
     </sequence>
     <attribute name="name" type="conf:string" use="required"/>
-    <attribute name="applicationId" type="conf:string"/>
     <attributeGroup ref="conf:ContentSettings"/>
   </complexType>
 
@@ -344,7 +344,6 @@
     </sequence>
     <attribute name="regex" type="conf:string" use="required"/>
     <attribute name="ignoreCase" type="boolean"/>
-    <attribute name="applicationId" type="conf:string"/>
     <attributeGroup ref="conf:ContentSettings"/>
   </complexType>
 
@@ -373,7 +372,7 @@
       <element name="Notify" type="conf:NotifyType" minOccurs="0" maxOccurs="unbounded"/>
       <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>
       <element name="MetadataProvider" type="conf:PluggableType"/>
-      <element name="TrustEngine" type="conf:PluggableType"/>
+      <element name="TrustEngine" type="conf:PluggableType" minOccurs="0"/>
       <element name="AttributeExtractor" type="conf:PluggableType" minOccurs="0"/>
       <element name="AttributeResolver" type="conf:PluggableType" minOccurs="0"/>
       <element name="AttributeFilter" type="conf:PluggableType" minOccurs="0"/>
@@ -601,31 +600,33 @@
     <anyAttribute namespace="##any" processContents="lax"/>
   </complexType>
 
-  <complexType name="SecurityPoliciesType">
-    <annotation>
-      <documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>
-    </annotation>
-    <sequence>
-      <element name="Policy" minOccurs="1" maxOccurs="unbounded">
-        <annotation>
-          <documentation>Specifies a set of SecurityPolicyRule plugins</documentation>
-        </annotation>
-        <complexType>
-          <choice>
-            <element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
-            <element name="PolicyRule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
-          </choice>
-          <attribute name="id" type="conf:string" use="required"/>
-          <attribute name="validate" type="boolean"/>
-          <anyAttribute namespace="##any" processContents="lax"/>
-        </complexType>
-      </element>
-      <choice minOccurs="0">
-        <element name="AlgorithmWhitelist" type="conf:listOfURIs"/>
-        <element name="AlgorithmBlacklist" type="conf:listOfURIs"/>
-      </choice>
-    </sequence>
-  </complexType>
+  <element name="SecurityPolicies">
+    <complexType>
+      <annotation>
+        <documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>
+      </annotation>
+      <sequence>
+        <element name="Policy" minOccurs="1" maxOccurs="unbounded">
+          <annotation>
+            <documentation>Specifies a set of SecurityPolicyRule plugins</documentation>
+          </annotation>
+          <complexType>
+            <choice>
+              <element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
+              <element name="PolicyRule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
+            </choice>
+            <attribute name="id" type="conf:string" use="required"/>
+            <attribute name="validate" type="boolean"/>
+            <anyAttribute namespace="##any" processContents="lax"/>
+          </complexType>
+        </element>
+        <choice minOccurs="0">
+          <element name="AlgorithmWhitelist" type="conf:listOfURIs"/>
+          <element name="AlgorithmBlacklist" type="conf:listOfURIs"/>
+        </choice>
+      </sequence>
+    </complexType>
+  </element>
 
   <element name="TransportOption">
     <annotation>
@@ -648,8 +649,8 @@
       </annotation>
       <sequence>
         <element name="Extensions" type="conf:ExtensionsType" minOccurs="0"/>
-        <element name="OutOfProcess" type="conf:OutOfProcessType"/>
-        <element name="InProcess" type="conf:InProcessType"/>
+        <element name="OutOfProcess" type="conf:OutOfProcessType" minOccurs="0"/>
+        <element name="InProcess" type="conf:InProcessType" minOccurs="0"/>
         <choice minOccurs="0">
           <element name="UnixListener">
             <complexType>
@@ -673,8 +674,12 @@
         <element name="ArtifactMap" type="conf:ArtifactMapType" minOccurs="0"/>
         <element name="RequestMapper" type="conf:PluggableType" minOccurs="0"/>
         <element name="ApplicationDefaults" type="conf:ApplicationDefaultsType"/>
-        <element name="SecurityPolicies" type="conf:SecurityPoliciesType"/>
+        <choice>
+          <element name="SecurityPolicyProvider" type="conf:PluggableType"/>
+          <element ref="conf:SecurityPolicies"/> <!-- deprecated -->
+        </choice>
         <element ref="conf:TransportOption" minOccurs="0" maxOccurs="unbounded"/>
+        <element ref="ds:Signature" minOccurs="0"/>
       </sequence>
       <attribute name="logger" type="anyURI"/>
       <attribute name="clockSkew" type="unsignedInt"/>