Redesign condition and profile processing based on new policy rules. Fix element...

[shibboleth/cpp-sp.git] / schemas / shibboleth-2.0-native-sp-config.xsd

diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index 652024e..5a1623d 100644 (file)
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -8,7 +8,7 @@
        elementFormDefault="qualified"\r
        attributeFormDefault="unqualified"\r
        blockDefault="substitution"\r
-       version="2.0">\r
+       version="2.2">\r
 \r
        <import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="saml-schema-assertion-2.0.xsd"/>\r
        <import namespace="urn:oasis:names:tc:SAML:2.0:protocol" schemaLocation="saml-schema-protocol-2.0.xsd"/>\r
@@ -71,7 +71,7 @@
                         <complexType>\r
                             <attribute name="address" type="conf:string" use="required"/>\r
                             <attribute name="port" type="unsignedInt" use="required"/>\r
-                            <attribute name="acl" type="conf:listOfStrings" default="127.0.0.1"/>\r
+                            <attribute name="acl" type="conf:listOfStrings"/>\r
                         </complexType>\r
                     </element>\r
                     <element name="Listener" type="conf:PluggableType"/>\r
@@ -81,11 +81,13 @@
                 <element ref="conf:ReplayCache" minOccurs="0"/>\r
                 <element ref="conf:ArtifactMap" minOccurs="0"/>\r
                 <element name="RequestMapper" type="conf:PluggableType" minOccurs="0"/>\r
-                               <element ref="conf:Applications"/>\r
+                               <element ref="conf:ApplicationDefaults"/>\r
                                <element ref="conf:SecurityPolicies"/>\r
+                <element ref="conf:TransportOption" minOccurs="0" maxOccurs="unbounded"/>
                        </sequence>\r
                        <attribute name="logger" type="anyURI"/>\r
                        <attribute name="clockSkew" type="unsignedInt"/>\r
+            <attribute name="unsafeChars" type="conf:string"/>
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r
@@ -102,7 +104,7 @@
                                                        <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                                                </sequence>\r
                                                <attribute name="path" type="anyURI" use="required"/>\r
-                                               <attribute name="fatal" type="boolean" default="true"/>\r
+                                               <attribute name="fatal" type="boolean"/>\r
                                                <anyAttribute namespace="##any" processContents="lax"/>\r
                                        </complexType>\r
                                </element>\r
@@ -122,7 +124,7 @@
                                                <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                                        </sequence>\r
                                        <attribute name="id" type="ID" use="required"/>\r
-                                       <attribute name="cleanupInterval" type="unsignedInt" default="900"/>\r
+                                       <attribute name="cleanupInterval" type="unsignedInt"/>\r
                                        <anyAttribute namespace="##any" processContents="lax"/>\r
                                </restriction>\r
                        </complexContent>\r
@@ -140,7 +142,7 @@
                                                <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                                        </sequence>\r
                                        <attribute name="StorageService" type="IDREF"/>\r
-                                       <attribute name="cacheTimeout" type="unsignedInt" default="28800"/>\r
+                                       <attribute name="cacheTimeout" type="unsignedInt"/>\r
                                        <anyAttribute namespace="##any" processContents="lax"/>\r
                                </restriction>\r
                        </complexContent>\r
@@ -165,7 +167,7 @@
                        <sequence/>\r
                        <attribute name="StorageService" type="IDREF"/>\r
                        <attribute name="context" type="conf:string"/>\r
-                       <attribute name="artifactTTL" type="unsignedInt" default="180"/>\r
+                       <attribute name="artifactTTL" type="unsignedInt"/>\r
                </complexType>\r
        </element>\r
        \r
@@ -200,6 +202,7 @@
                        <attribute name="logger" type="anyURI"/>\r
                        <attribute name="unsetHeaderValue" type="string"/>\r
                        <attribute name="checkSpoofing" type="boolean"/>\r
+            <attribute name="spoofKey" type="string"/>\r
                    <attribute name="catchAll" type="boolean"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
@@ -222,7 +225,7 @@
                                </element>\r
                                <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                        </sequence>\r
-                       <attribute name="normalizeRequest" type="boolean" default="true"/>\r
+                       <attribute name="normalizeRequest" type="boolean"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r
@@ -292,6 +295,7 @@
                <attribute name="metadataError" type="anyURI"/>\r
                <attribute name="accessError" type="anyURI"/>\r
                <attribute name="sslError" type="anyURI"/>\r
+        <attribute name="REMOTE_ADDR" type="conf:string"/>\r
                <anyAttribute namespace="##other" processContents="lax"/>\r
        </attributeGroup>\r
        <element name="AccessControlProvider" type="conf:PluggableType"/>\r
@@ -367,7 +371,7 @@
                                </choice>\r
                        </sequence>\r
                        <attribute name="regex" type="conf:string" use="required"/>\r
-                       <attribute name="ignoreCase" type="boolean" default="true"/>\r
+                       <attribute name="ignoreCase" type="boolean"/>\r
                        <attribute name="applicationId" type="conf:string"/>\r
                        <attributeGroup ref="conf:ContentSettings"/>\r
                </complexType>\r
@@ -404,7 +408,7 @@
                                <element ref="conf:Query" minOccurs="0" maxOccurs="unbounded"/>\r
                        </sequence>\r
                        <attribute name="regex" type="conf:string" use="required"/>\r
-                       <attribute name="ignoreCase" type="boolean" default="true"/>\r
+                       <attribute name="ignoreCase" type="boolean"/>\r
                        <attribute name="applicationId" type="conf:string"/>\r
                        <attributeGroup ref="conf:ContentSettings"/>\r
                </complexType>\r
@@ -426,15 +430,15 @@
                </complexType>\r
        </element>\r
        \r
-       <element name="Applications">\r
+       <element name="ApplicationDefaults">\r
                <annotation>\r
-                       <documentation>Container for global settings and application-specific overrides</documentation>\r
+                       <documentation>Container for default settings and application-specific overrides</documentation>\r
                </annotation>\r
                <complexType>\r
                        <sequence>\r
                                <element ref="conf:Sessions"/>\r
                                <element ref="conf:Errors" minOccurs="0"/>\r
-                               <element ref="conf:DefaultRelyingParty"/>\r
+                               <element ref="conf:RelyingParty" minOccurs="0" maxOccurs="unbounded"/>\r
                                <element ref="conf:Notify" minOccurs="0" maxOccurs="unbounded"/>\r
                                <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>\r
                 <element name="MetadataProvider" type="conf:PluggableType"/>\r
@@ -443,17 +447,18 @@
                                <element name="AttributeResolver" type="conf:PluggableType" minOccurs="0"/>\r
                                <element name="AttributeFilter" type="conf:PluggableType" minOccurs="0"/>\r
                                <element name="CredentialResolver" type="conf:PluggableType" minOccurs="0"/>\r
-                               <element ref="conf:Application" minOccurs="0" maxOccurs="unbounded"/>\r
+                               <element ref="conf:ApplicationOverride" minOccurs="0" maxOccurs="unbounded"/>\r
                        </sequence>\r
                        <attribute name="id" type="conf:string" fixed="default"/>\r
                        <attribute name="entityID" type="anyURI" use="required"/>\r
                        <attribute name="policyId" type="conf:string" use="required"/>\r
                        <attributeGroup ref="conf:ApplicationGroup"/>\r
+                   <attributeGroup ref="conf:RelyingPartyGroup"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r
        \r
-       <element name="Application">\r
+       <element name="ApplicationOverride">\r
                <annotation>\r
                        <documentation>Container for application-specific overrides</documentation>\r
                </annotation>\r
@@ -461,7 +466,7 @@
                        <sequence>\r
                                <element ref="conf:Sessions" minOccurs="0"/>\r
                                <element ref="conf:Errors" minOccurs="0"/>\r
-                               <element ref="conf:DefaultRelyingParty" minOccurs="0"/>\r
+                               <element ref="conf:RelyingParty" minOccurs="0" maxOccurs="unbounded"/>\r
                                <element ref="conf:Notify" minOccurs="0" maxOccurs="unbounded"/>\r
                                <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>\r
                                <element name="MetadataProvider" type="conf:PluggableType" minOccurs="0"/>\r
@@ -475,20 +480,38 @@
                        <attribute name="entityID" type="anyURI"/>\r
                        <attribute name="policyId" type="conf:string"/>\r
                        <attributeGroup ref="conf:ApplicationGroup"/>\r
+                   <attributeGroup ref="conf:RelyingPartyGroup"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r
 \r
        <attributeGroup name="ApplicationGroup">\r
-               <attribute name="homeURL" type="anyURI" default="/"/>\r
+               <attribute name="homeURL" type="anyURI"/>\r
                <attribute name="REMOTE_USER" type="conf:listOfStrings"/>\r
                <attribute name="unsetHeaders" type="conf:listOfStrings"/>\r
                <attribute name="metadataAttributePrefix" type="conf:string"/>\r
            <attribute name="attributePrefix" type="conf:string"/>\r
-               <attribute name="localLogout" type="anyURI"/>\r
-               <attribute name="globalLogout" type="anyURI"/>\r
        </attributeGroup>\r
-               \r
+\r
+    <attributeGroup name="RelyingPartyGroup">\r
+        <attribute name="authType" type="conf:string"/>\r
+        <attribute name="authUsername" type="conf:string"/>\r
+        <attribute name="authPassword" type="conf:string"/>\r
+        <attribute name="signing" type="conf:bindingBoolean"/>\r
+        <attribute name="signingAlg" type="anyURI"/>\r
+        <attribute name="digestAlg" type="anyURI"/>\r
+        <attribute name="encryption" type="conf:bindingBoolean"/>\r
+        <attribute name="encryptionAlg" type="anyURI"/>\r
+        <attribute name="keyName" type="conf:string"/>\r
+        <attribute name="artifactEndpointIndex" type="unsignedShort"/>\r
+        <attribute name="chunkedEncoding" type="boolean"/>\r
+        <attribute name="connectTimeout" type="unsignedShort"/>\r
+        <attribute name="timeout" type="unsignedShort"/>\r
+        <attribute name="requireConfidentiality" type="boolean"/>\r
+        <attribute name="requireTransportAuth" type="boolean"/>\r
+        <attribute name="requireSignedAssertions" type="boolean"/>\r
+    </attributeGroup>\r
+    \r
        <element name="Sessions">\r
                <annotation>\r
                        <documentation>Container for specifying protocol handlers and session policy</documentation>\r
@@ -516,19 +539,24 @@
                                        </complexType>\r
                                </element>\r
                        </choice>\r
-                       <attribute name="handlerURL" type="anyURI"/>\r
-                       <attribute name="handlerSSL" type="boolean" default="true"/>\r
+                       <attribute name="handlerURL" type="anyURI" use="required"/>\r
+                       <attribute name="handlerSSL" type="boolean"/>\r
                        <attribute name="exportLocation" type="conf:string"/>\r
-                       <attribute name="exportACL" type="conf:listOfStrings" default="127.0.0.1"/>\r
+                       <attribute name="exportACL" type="conf:listOfStrings"/>\r
                        <attribute name="cookieName" type="conf:string"/>\r
                        <attribute name="cookieProps" type="conf:string"/>\r
-                       <attribute name="idpHistory" type="boolean" default="false"/>\r
+            <attribute name="cookieLifetime" type="unsignedInt"/>\r
+                       <attribute name="idpHistory" type="boolean"/>\r
                        <attribute name="idpHistoryDays" type="unsignedInt"/>\r
-                       <attribute name="lifetime" type="unsignedInt" default="28800"/>\r
-                       <attribute name="timeout" type="unsignedInt" default="3600"/>\r
-                   <attribute name="authnskew" type="unsignedInt"/>\r
-                       <attribute name="checkAddress" type="boolean" default="true"/>\r
-                       <attribute name="consistentAddress" type="boolean" default="true"/>\r
+                       <attribute name="lifetime" type="unsignedInt"/>\r
+                       <attribute name="timeout" type="unsignedInt"/>\r
+                   <attribute name="maxTimeSinceAuthn" type="unsignedInt"/>\r
+                       <attribute name="checkAddress" type="boolean"/>\r
+                       <attribute name="consistentAddress" type="boolean"/>\r
+                       <attribute name="postData" type="conf:string"/>\r
+            <attribute name="postLimit" type="positiveInteger"/>\r
+                       <attribute name="postTemplate" type="conf:string"/>\r
+            <attribute name="postExpire" type="boolean"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r
@@ -605,6 +633,8 @@
                        <attribute name="metadata" type="anyURI"/>\r
                        <attribute name="access" type="anyURI"/>\r
                        <attribute name="ssl" type="anyURI"/>\r
+            <attribute name="localLogout" type="anyURI"/>\r
+            <attribute name="globalLogout" type="anyURI"/>\r
                        <attribute name="supportContact" type="conf:string"/>\r
                        <attribute name="logoLocation" type="anyURI"/>\r
                        <attribute name="styleSheet" type="anyURI"/>\r
@@ -612,6 +642,19 @@
                </complexType>\r
        </element>\r
 \r
+    <element name="RelyingParty">\r
+        <annotation>\r
+            <documentation>Container for specifying settings to use with particular peers</documentation>\r
+        </annotation>\r
+        <complexType>\r
+            <sequence/>\r
+            <attribute name="Name" type="conf:string" use="required"/>\r
+            <attributeGroup ref="conf:RelyingPartyGroup"/>\r
+            <attribute name="entityID" type="anyURI"/>\r
+            <anyAttribute namespace="##other" processContents="lax"/>\r
+        </complexType>\r
+    </element>\r
+    \r
        <element name="Notify">\r
                <annotation>\r
                        <documentation>Used to specify locations to receive application notifications</documentation>\r
@@ -631,45 +674,6 @@
                </complexType>\r
        </element>\r
        \r
-       <element name="DefaultRelyingParty">\r
-               <annotation>\r
-                       <documentation>Container for specifying security methods to use with particular peers</documentation>\r
-               </annotation>\r
-               <complexType>\r
-                       <sequence>\r
-                               <element name="RelyingParty" minOccurs="0" maxOccurs="unbounded">\r
-                                       <complexType>\r
-                                               <sequence/>\r
-                                               <attribute name="Name" type="conf:string" use="required"/>\r
-                                               <attributeGroup ref="conf:RelyingPartyGroup"/>\r
-                                               <anyAttribute namespace="##other" processContents="lax"/>\r
-                                       </complexType>\r
-                               </element>\r
-                       </sequence>\r
-                       <attributeGroup ref="conf:RelyingPartyGroup"/>\r
-               <anyAttribute namespace="##other" processContents="lax"/>\r
-               </complexType>\r
-       </element>\r
-       \r
-       <attributeGroup name="RelyingPartyGroup">\r
-               <attribute name="authType" type="conf:string"/>\r
-               <attribute name="authUsername" type="conf:string"/>\r
-               <attribute name="authPassword" type="conf:string"/>\r
-               <attribute name="signing" type="conf:bindingBoolean"/>\r
-               <attribute name="signingAlg" type="anyURI"/>\r
-               <attribute name="digestAlg" type="anyURI"/>\r
-               <attribute name="encryption" type="conf:bindingBoolean"/>\r
-               <attribute name="encryptionAlg" type="anyURI"/>\r
-               <attribute name="keyName" type="conf:string"/>\r
-               <attribute name="artifactEndpointIndex" type="unsignedShort"/>\r
-        <attribute name="chunkedEncoding" type="boolean"/>\r
-        <attribute name="connectTimeout" type="unsignedShort"/>\r
-        <attribute name="timeout" type="unsignedShort"/>\r
-        <attribute name="requireConfidentiality" type="boolean"/>\r
-        <attribute name="requireTransportAuth" type="boolean"/>\r
-        <attribute name="signedAssertions" type="boolean"/>\r
-       </attributeGroup>\r
-       \r
        <element name="SecurityPolicies">\r
                <annotation>\r
                        <documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>\r
@@ -681,12 +685,12 @@
                                                <documentation>Specifies a set of SecurityPolicyRule plugins</documentation>\r
                                        </annotation>\r
                                        <complexType>\r
-                                               <sequence>\r
-                                                       <element ref="conf:TransportOption" minOccurs="0" maxOccurs="unbounded"/>\r
+                                               <choice>\r
                                                        <element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>\r
-                                               </sequence>\r
+                            <element name="PolicyRule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>\r
+                                               </choice>\r
                                                <attribute name="id" type="conf:string" use="required"/>\r
-                                               <attribute name="validate" type="boolean" default="false"/>\r
+                                               <attribute name="validate" type="boolean"/>\r
                                                <anyAttribute namespace="##any" processContents="lax"/>\r
                                        </complexType>\r
                                </element>\r