X-Git-Url: http://www.project-moonshot.org/gitweb/?a=blobdiff_plain;f=schemas%2Fshibboleth-2.0-native-sp-config.xsd;h=c5e2e31727162032f90e3e0ca870feb3a870a6b6;hb=3475baba87a42fe6e2e3f788f4822cc77a76a86f;hp=9c3e1918fd079c9bb34f82bd6de77691c3d3a089;hpb=391782324850006eca804cde6aecf0f04caf5899;p=shibboleth%2Fsp.git

diff --git a/schemas/shibboleth-2.0-native-sp-config.xsd b/schemas/shibboleth-2.0-native-sp-config.xsd
index 9c3e191..c5e2e31 100644
--- a/schemas/shibboleth-2.0-native-sp-config.xsd
+++ b/schemas/shibboleth-2.0-native-sp-config.xsd
@@ -61,7 +61,27 @@
 				<element ref="conf:Extensions" minOccurs="0"/>
 				<element ref="conf:OutOfProcess"/>
 				<element ref="conf:InProcess"/>
-				<element ref="conf:Applications"/>
+                <choice minOccurs="0">
+                    <element name="UnixListener">
+                        <complexType>
+                            <attribute name="address" type="conf:string" use="required"/>
+                        </complexType>
+                    </element>
+                    <element name="TCPListener">
+                        <complexType>
+                            <attribute name="address" type="conf:string" use="required"/>
+                            <attribute name="port" type="unsignedInt" use="required"/>
+                            <attribute name="acl" type="conf:listOfStrings" default="127.0.0.1"/>
+                        </complexType>
+                    </element>
+                    <element name="Listener" type="conf:PluggableType"/>
+                </choice>
+                <element ref="conf:StorageService" minOccurs="0" maxOccurs="unbounded"/>
+                <element ref="conf:SessionCache" minOccurs="0"/>
+                <element ref="conf:ReplayCache" minOccurs="0"/>
+                <element ref="conf:ArtifactMap" minOccurs="0"/>
+                <element name="RequestMapper" type="conf:PluggableType" minOccurs="0"/>
+				<element ref="conf:ApplicationDefaults"/>
 				<element ref="conf:SecurityPolicies"/>
 			</sequence>
 			<attribute name="logger" type="anyURI"/>
@@ -151,33 +171,15 @@
 	
 	<element name="OutOfProcess">
 		<annotation>
-			<documentation>Container for shibd out-of-process configuration</documentation>
+			<documentation>Container for out-of-process (shibd) configuration</documentation>
 		</annotation>
 		<complexType>
 			<sequence>
 				<element ref="conf:Extensions" minOccurs="0"/>
-				<choice>
-					<element name="UnixListener">
-						<complexType>
-							<attribute name="address" type="conf:string" use="required"/>
-						</complexType>
-					</element>
-					<element name="TCPListener">
-						<complexType>
-							<attribute name="address" type="conf:string" use="required"/>
-							<attribute name="port" type="unsignedInt" use="required"/>
-							<attribute name="acl" type="conf:listOfStrings" default="127.0.0.1"/>
-						</complexType>
-					</element>
-					<element name="Listener" type="conf:PluggableType"/>
-				</choice>
-				<element ref="conf:StorageService" minOccurs="0" maxOccurs="unbounded"/>
-				<element ref="conf:SessionCache" minOccurs="0"/>
-				<element ref="conf:ReplayCache" minOccurs="0"/>
-				<element ref="conf:ArtifactMap" minOccurs="0"/>
 				<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
 			<attribute name="logger" type="anyURI"/>
+		    <attribute name="catchAll" type="boolean"/>
 			<anyAttribute namespace="##other" processContents="lax"/>
 		</complexType>
 	</element>
@@ -192,21 +194,13 @@
 		<complexType>
 			<sequence>
 				<element ref="conf:Extensions" minOccurs="0"/>
-				<element ref="conf:SessionCache" minOccurs="0"/>
-				<element name="RequestMapper" type="conf:PluggableType"/>
-				<element name="Implementation" minOccurs="0">
-					<complexType>
-						<sequence>
-							<element ref="conf:ISAPI" minOccurs="0"/>
-							<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
-						</sequence>
-					</complexType>
-				</element>
+				<element ref="conf:ISAPI" minOccurs="0"/>
 				<any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
 			<attribute name="logger" type="anyURI"/>
 			<attribute name="unsetHeaderValue" type="string"/>
 			<attribute name="checkSpoofing" type="boolean"/>
+		    <attribute name="catchAll" type="boolean"/>
 			<anyAttribute namespace="##other" processContents="lax"/>
 		</complexType>
 	</element>
@@ -249,6 +243,7 @@
 			<element ref="conf:OR"/>
 			<element ref="conf:NOT"/>
 			<element ref="conf:Rule"/>
+		    <element ref="conf:RuleRegex"/>
 		</choice>
 	</complexType>
 	<complexType name="MultiOperatorType">
@@ -257,6 +252,7 @@
 			<element ref="conf:OR"/>
 			<element ref="conf:NOT"/>
 			<element ref="conf:Rule"/>
+		    <element ref="conf:RuleRegex"/>
 		</choice>
 	</complexType>
 	<element name="Rule">
@@ -264,10 +260,21 @@
 			<simpleContent>
 				<extension base="conf:listOfStrings">
 					<attribute name="require" type="conf:string" use="required"/>
+				    <attribute name="list" type="boolean"/>
 				</extension>
 			</simpleContent>
 		</complexType>
 	</element>
+    <element name="RuleRegex">
+        <complexType>
+            <simpleContent>
+                <extension base="conf:string">
+                    <attribute name="require" type="conf:string" use="required"/>
+                    <attribute name="ignoreCase" type="boolean"/>
+                </extension>
+            </simpleContent>
+        </complexType>
+    </element>
 	
 	<attributeGroup name="ContentSettings">
 		<attribute name="authType" type="conf:string"/>
@@ -275,10 +282,16 @@
 		<attribute name="requireSessionWith" type="conf:string"/>
 		<attribute name="exportAssertion" type="boolean"/>
 		<attribute name="redirectToSSL" type="unsignedInt"/>
+		<attribute name="entityID" type="anyURI"/>
 		<attribute name="isPassive" type="boolean"/>
 		<attribute name="forceAuthn" type="boolean"/>
 		<attribute name="authnContextClassRef" type="anyURI"/>
 		<attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
+        <attribute name="redirectErrors" type="anyURI"/>
+		<attribute name="sessionError" type="anyURI"/>
+		<attribute name="metadataError" type="anyURI"/>
+		<attribute name="accessError" type="anyURI"/>
+		<attribute name="sslError" type="anyURI"/>
 		<anyAttribute namespace="##other" processContents="lax"/>
 	</attributeGroup>
 	<element name="AccessControlProvider" type="conf:PluggableType"/>
@@ -297,7 +310,10 @@
 					<element ref="conf:AccessControl"/>
 	            	<element ref="conf:AccessControlProvider"/>
 	            </choice>
-                <element ref="conf:Host" minOccurs="0" maxOccurs="unbounded"/>
+            	<choice minOccurs="0" maxOccurs="unbounded">
+					<element ref="conf:Host"/>
+            		<element ref="conf:HostRegex"/>
+            	</choice>
             </sequence>
             <attribute name="applicationId" type="conf:string" fixed="default"/>
          	<attributeGroup ref="conf:ContentSettings"/>
@@ -312,7 +328,11 @@
 					<element ref="conf:AccessControl"/>
 	            	<element ref="conf:AccessControlProvider"/>
 	            </choice>
-    			<element ref="conf:Path" minOccurs="0" maxOccurs="unbounded"/>
+    			<choice minOccurs="0" maxOccurs="unbounded">
+    				<element ref="conf:Path"/>
+    				<element ref="conf:PathRegex"/>
+    				<element ref="conf:Query"/>
+    			</choice>
     		</sequence>
     		<attribute name="scheme">
 			    <simpleType>
@@ -327,10 +347,31 @@
     		</attribute>
     		<attribute name="name" type="conf:string" use="required"/>
     		<attribute name="port" type="unsignedInt"/>
-    		<attribute name="applicationId" type="conf:string"/>
+			<attribute name="applicationId" type="conf:string"/>
            	<attributeGroup ref="conf:ContentSettings"/>
     	</complexType>
     </element>
+	
+	<element name="HostRegex">
+		<complexType>
+			<sequence>
+				<choice minOccurs="0">
+					<element ref="conf:htaccess"/>
+					<element ref="conf:AccessControl"/>
+					<element ref="conf:AccessControlProvider"/>
+				</choice>
+				<choice minOccurs="0" maxOccurs="unbounded">
+					<element ref="conf:Path"/>
+					<element ref="conf:PathRegex"/>
+					<element ref="conf:Query"/>
+				</choice>
+			</sequence>
+			<attribute name="regex" type="conf:string" use="required"/>
+			<attribute name="ignoreCase" type="boolean" default="true"/>
+			<attribute name="applicationId" type="conf:string"/>
+			<attributeGroup ref="conf:ContentSettings"/>
+		</complexType>
+	</element>
 
     <element name="Path">
         <complexType>
@@ -340,23 +381,61 @@
 					<element ref="conf:AccessControl"/>
 	            	<element ref="conf:AccessControlProvider"/>
 	            </choice>
-    			<element ref="conf:Path" minOccurs="0" maxOccurs="unbounded"/>
+    			<choice minOccurs="0" maxOccurs="unbounded">
+    				<element ref="conf:Path"/>
+    				<element ref="conf:PathRegex"/>
+    				<element ref="conf:Query"/>
+    			</choice>
     		</sequence>
-    		<attribute name="name" type="conf:string" use="required"/>
-    		<attribute name="applicationId" type="conf:string"/>
-           	<attributeGroup ref="conf:ContentSettings"/>
+			<attribute name="name" type="conf:string" use="required"/>
+			<attribute name="applicationId" type="conf:string"/>
+			<attributeGroup ref="conf:ContentSettings"/>
         </complexType>
     </element>
+
+	<element name="PathRegex">
+		<complexType>
+			<sequence>
+				<choice minOccurs="0">
+					<element ref="conf:htaccess"/>
+					<element ref="conf:AccessControl"/>
+					<element ref="conf:AccessControlProvider"/>
+				</choice>
+				<element ref="conf:Query" minOccurs="0" maxOccurs="unbounded"/>
+			</sequence>
+			<attribute name="regex" type="conf:string" use="required"/>
+			<attribute name="ignoreCase" type="boolean" default="true"/>
+			<attribute name="applicationId" type="conf:string"/>
+			<attributeGroup ref="conf:ContentSettings"/>
+		</complexType>
+	</element>
+	
+	<element name="Query">
+		<complexType>
+			<sequence>
+				<choice minOccurs="0">
+					<element ref="conf:htaccess"/>
+					<element ref="conf:AccessControl"/>
+					<element ref="conf:AccessControlProvider"/>
+				</choice>
+				<element ref="conf:Query" minOccurs="0" maxOccurs="unbounded"/>
+			</sequence>
+			<attribute name="name" type="conf:string" use="required"/>
+			<attribute name="regex" type="conf:string"/>
+			<attributeGroup ref="conf:ContentSettings"/>
+		</complexType>
+	</element>
 	
-	<element name="Applications">
+	<element name="ApplicationDefaults">
 		<annotation>
-			<documentation>Container for global settings and application-specific overrides</documentation>
+			<documentation>Container for default settings and application-specific overrides</documentation>
 		</annotation>
 		<complexType>
 			<sequence>
 				<element ref="conf:Sessions"/>
 				<element ref="conf:Errors" minOccurs="0"/>
-				<element ref="conf:DefaultRelyingParty"/>
+				<element ref="conf:RelyingParty" minOccurs="0" maxOccurs="unbounded"/>
+				<element ref="conf:Notify" minOccurs="0" maxOccurs="unbounded"/>
 				<element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>
                 <element name="MetadataProvider" type="conf:PluggableType"/>
 				<element name="TrustEngine" type="conf:PluggableType"/>
@@ -364,17 +443,18 @@
 				<element name="AttributeResolver" type="conf:PluggableType" minOccurs="0"/>
 				<element name="AttributeFilter" type="conf:PluggableType" minOccurs="0"/>
 				<element name="CredentialResolver" type="conf:PluggableType" minOccurs="0"/>
-				<element ref="conf:Application" minOccurs="0" maxOccurs="unbounded"/>
+				<element ref="conf:ApplicationOverride" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
 			<attribute name="id" type="conf:string" fixed="default"/>
 			<attribute name="entityID" type="anyURI" use="required"/>
 			<attribute name="policyId" type="conf:string" use="required"/>
 			<attributeGroup ref="conf:ApplicationGroup"/>
+		    <attributeGroup ref="conf:RelyingPartyGroup"/>
 			<anyAttribute namespace="##other" processContents="lax"/>
 		</complexType>
 	</element>
 	
-	<element name="Application">
+	<element name="ApplicationOverride">
 		<annotation>
 			<documentation>Container for application-specific overrides</documentation>
 		</annotation>
@@ -382,8 +462,8 @@
 			<sequence>
 				<element ref="conf:Sessions" minOccurs="0"/>
 				<element ref="conf:Errors" minOccurs="0"/>
-				<element ref="conf:DefaultRelyingParty" minOccurs="0"/>
-				<element ref="conf:NotifyOnLogout" minOccurs="0" maxOccurs="unbounded"/>
+				<element ref="conf:RelyingParty" minOccurs="0" maxOccurs="unbounded"/>
+				<element ref="conf:Notify" minOccurs="0" maxOccurs="unbounded"/>
 				<element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>
 				<element name="MetadataProvider" type="conf:PluggableType" minOccurs="0"/>
 				<element name="TrustEngine" type="conf:PluggableType" minOccurs="0"/>
@@ -396,6 +476,7 @@
 			<attribute name="entityID" type="anyURI"/>
 			<attribute name="policyId" type="conf:string"/>
 			<attributeGroup ref="conf:ApplicationGroup"/>
+		    <attributeGroup ref="conf:RelyingPartyGroup"/>
 			<anyAttribute namespace="##other" processContents="lax"/>
 		</complexType>
 	</element>
@@ -404,11 +485,29 @@
 		<attribute name="homeURL" type="anyURI" default="/"/>
 		<attribute name="REMOTE_USER" type="conf:listOfStrings"/>
 		<attribute name="unsetHeaders" type="conf:listOfStrings"/>
-		<attribute name="redirectErrors" type="anyURI"/>
-		<attribute name="localLogout" type="anyURI"/>
-		<attribute name="globalLogout" type="anyURI"/>
+		<attribute name="metadataAttributePrefix" type="conf:string"/>
+	    <attribute name="attributePrefix" type="conf:string"/>
 	</attributeGroup>
-		
+
+    <attributeGroup name="RelyingPartyGroup">
+        <attribute name="authType" type="conf:string"/>
+        <attribute name="authUsername" type="conf:string"/>
+        <attribute name="authPassword" type="conf:string"/>
+        <attribute name="signing" type="conf:bindingBoolean"/>
+        <attribute name="signingAlg" type="anyURI"/>
+        <attribute name="digestAlg" type="anyURI"/>
+        <attribute name="encryption" type="conf:bindingBoolean"/>
+        <attribute name="encryptionAlg" type="anyURI"/>
+        <attribute name="keyName" type="conf:string"/>
+        <attribute name="artifactEndpointIndex" type="unsignedShort"/>
+        <attribute name="chunkedEncoding" type="boolean"/>
+        <attribute name="connectTimeout" type="unsignedShort"/>
+        <attribute name="timeout" type="unsignedShort"/>
+        <attribute name="requireConfidentiality" type="boolean"/>
+        <attribute name="requireTransportAuth" type="boolean"/>
+        <attribute name="requireSignedAssertions" type="boolean"/>
+    </attributeGroup>
+    
 	<element name="Sessions">
 		<annotation>
 			<documentation>Container for specifying protocol handlers and session policy</documentation>
@@ -416,6 +515,7 @@
 		<complexType>
 			<choice minOccurs="0" maxOccurs="unbounded">
 				<element ref="conf:SessionInitiator"/>
+				<element ref="conf:LogoutInitiator"/>
 				<element ref="md:AssertionConsumerService"/>
 				<element ref="md:ArtifactResolutionService"/>
 				<element ref="md:SingleLogoutService"/>
@@ -428,6 +528,8 @@
 									<any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 								</sequence>
 								<attribute name="Location" type="anyURI" use="required"/>
+							    <attribute name="acl" type="conf:listOfStrings"/>
+								<anyAttribute namespace="##any" processContents="lax"/>
 							</restriction>
 						</complexContent>
 					</complexType>
@@ -439,10 +541,11 @@
 			<attribute name="exportACL" type="conf:listOfStrings" default="127.0.0.1"/>
 			<attribute name="cookieName" type="conf:string"/>
 			<attribute name="cookieProps" type="conf:string"/>
-			<attribute name="idpHistory" type="boolean" default="true"/>
+			<attribute name="idpHistory" type="boolean" default="false"/>
 			<attribute name="idpHistoryDays" type="unsignedInt"/>
 			<attribute name="lifetime" type="unsignedInt" default="28800"/>
 			<attribute name="timeout" type="unsignedInt" default="3600"/>
+		    <attribute name="maxTimeSinceAuthn" type="unsignedInt"/>
 			<attribute name="checkAddress" type="boolean" default="true"/>
 			<attribute name="consistentAddress" type="boolean" default="true"/>
 			<anyAttribute namespace="##other" processContents="lax"/>
@@ -477,6 +580,31 @@
 					<attribute name="postArtifact" type="boolean"/>
 					<attribute name="acsByIndex" type="boolean"/>
 					<attribute name="defaultACSIndex" type="unsignedShort"/>
+                    <attribute name="isPassive" type="boolean"/>
+                    <attribute name="forceAuthn" type="boolean"/>
+                    <attribute name="authnContextClassRef" type="anyURI"/>
+                    <attribute name="authnContextComparison" type="samlp:AuthnContextComparisonType"/>
+					<anyAttribute namespace="##any" processContents="lax"/>
+				</restriction>
+			</complexContent>
+		</complexType>
+	</element>
+
+	<element name="LogoutInitiator">
+		<annotation>
+			<documentation>Used to specify handlers that can issue LogoutRequests</documentation>
+		</annotation>
+		<complexType>
+			<complexContent>
+				<restriction base="conf:PluggableType">
+					<sequence>
+						<any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+					</sequence>
+					<attribute name="Location" type="anyURI"/>
+				    <attribute name="relayState" type="conf:string"/>
+					<attribute name="outgoingBindings" type="conf:listOfURIs"/>
+					<attribute name="template" type="anyURI"/>
+					<attribute name="postArtifact" type="boolean"/>
 					<anyAttribute namespace="##any" processContents="lax"/>
 				</restriction>
 			</complexContent>
@@ -491,11 +619,13 @@
 			<sequence>
 				<any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
 			</sequence>
-			<attribute name="session" type="anyURI" use="required"/>
+            <attribute name="redirectErrors" type="anyURI"/>
+			<attribute name="session" type="anyURI"/>
 			<attribute name="metadata" type="anyURI"/>
-			<attribute name="rm" type="anyURI"/>
 			<attribute name="access" type="anyURI"/>
 			<attribute name="ssl" type="anyURI"/>
+            <attribute name="localLogout" type="anyURI"/>
+            <attribute name="globalLogout" type="anyURI"/>
 			<attribute name="supportContact" type="conf:string"/>
 			<attribute name="logoLocation" type="anyURI"/>
 			<attribute name="styleSheet" type="anyURI"/>
@@ -503,6 +633,19 @@
 		</complexType>
 	</element>
 
+    <element name="RelyingParty">
+        <annotation>
+            <documentation>Container for specifying settings to use with particular peers</documentation>
+        </annotation>
+        <complexType>
+            <sequence/>
+            <attribute name="Name" type="conf:string" use="required"/>
+            <attributeGroup ref="conf:RelyingPartyGroup"/>
+            <attribute name="entityID" type="anyURI"/>
+            <anyAttribute namespace="##other" processContents="lax"/>
+        </complexType>
+    </element>
+    
 	<element name="Notify">
 		<annotation>
 			<documentation>Used to specify locations to receive application notifications</documentation>
@@ -522,41 +665,6 @@
 		</complexType>
 	</element>
 	
-	<element name="DefaultRelyingParty">
-		<annotation>
-			<documentation>Container for specifying security methods to use with particular peers</documentation>
-		</annotation>
-		<complexType>
-			<sequence>
-				<element name="RelyingParty" minOccurs="0" maxOccurs="unbounded">
-					<complexType>
-						<sequence/>
-						<attribute name="Name" type="conf:string" use="required"/>
-						<attributeGroup ref="conf:RelyingPartyGroup"/>
-						<anyAttribute namespace="##other" processContents="lax"/>
-					</complexType>
-				</element>
-			</sequence>
-			<attributeGroup ref="conf:RelyingPartyGroup"/>
-	        <anyAttribute namespace="##other" processContents="lax"/>
-		</complexType>
-	</element>
-	
-	<attributeGroup name="RelyingPartyGroup">
-		<attribute name="authType" type="conf:string"/>
-		<attribute name="authUsername" type="conf:string"/>
-		<attribute name="authPassword" type="conf:string"/>
-		<attribute name="signRequests" type="bindingBoolean"/>
-		<attribute name="signResponses" type="bindingBoolean"/>
-		<attribute name="signatureAlg" type="anyURI"/>
-		<attribute name="digestAlg" type="anyURI"/>
-		<attribute name="encryptRequests" type="bindingBoolean"/>
-		<attribute name="encryptResponses" type="bindingBoolean"/>
-		<attribute name="encryptionAlg" type="anyURI"/>
-		<attribute name="keyName" type="conf:string"/>
-		<attribute name="artifactEndpointIndex" type="unsignedShort"/>
-	</attributeGroup>
-	
 	<element name="SecurityPolicies">
 		<annotation>
 			<documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>
@@ -569,21 +677,30 @@
 					</annotation>
 					<complexType>
 						<sequence>
+							<element ref="conf:TransportOption" minOccurs="0" maxOccurs="unbounded"/>
 							<element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
 						</sequence>
 						<attribute name="id" type="conf:string" use="required"/>
 						<attribute name="validate" type="boolean" default="false"/>
-						<attribute name="signedAssertions" type="boolean" default="false"/>
-						<attribute name="requireConfidentiality" type="boolean" default="true"/>
-						<attribute name="requireTransportAuth" type="boolean" default="true"/>
-						<attribute name="chunkedEncoding" type="boolean" default="true"/>
-						<attribute name="connectTimeout" type="unsignedShort" default="15"/>
-						<attribute name="timeout" type="unsignedShort" default="30"/>
 						<anyAttribute namespace="##any" processContents="lax"/>
 					</complexType>
 				</element>
 			</sequence>
 		</complexType>
 	</element>
+
+	<element name="TransportOption">
+		<annotation>
+			<documentation>Implementation-specific option to pass to SOAPTransport provider.</documentation>
+		</annotation>
+		<complexType>
+			<simpleContent>
+				<extension base="anySimpleType">
+					<attribute name="provider" type="conf:string" use="required"/>
+					<attribute name="option" type="conf:string" use="required"/>
+				</extension>
+			</simpleContent>
+		</complexType>
+	</element>
 	
 </schema>