Schema check-in.

diff --git a/schemas/Makefile.am b/schemas/Makefile.am
new file mode 100644 (file)
index 0000000..10eb5e3
--- /dev/null
+++ b/schemas/Makefile.am
@@ -0,0 +1,77 @@
+\r
+AUTOMAKE_OPTIONS = foreign\r
+\r
+schemas = soap-envelope.xsd \\r
+       cs-sstc-schema-assertion-01.xsd \\r
+       cs-sstc-schema-protocol-01.xsd \\r
+       cs-sstc-schema-assertion-1.1.xsd \\r
+       cs-sstc-schema-protocol-1.1.xsd \\r
+       saml-schema-assertion-2.0.xsd \\r
+       saml-schema-authn-context-2.0.xsd \\r
+       saml-schema-authn-context-auth-telephony-2.0.xsd \\r
+       saml-schema-authn-context-ip-2.0.xsd \\r
+       saml-schema-authn-context-ippword-2.0.xsd \\r
+       saml-schema-authn-context-kerberos-2.0.xsd \\r
+       saml-schema-authn-context-mobileonefactor-reg-2.0.xsd \\r
+       saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd \\r
+       saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd \\r
+       saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd \\r
+       saml-schema-authn-context-nomad-telephony-2.0.xsd \\r
+       saml-schema-authn-context-personal-telephony-2.0.xsd \\r
+       saml-schema-authn-context-pgp-2.0.xsd \\r
+       saml-schema-authn-context-ppt-2.0.xsd \\r
+       saml-schema-authn-context-pword-2.0.xsd \\r
+       saml-schema-authn-context-session-2.0.xsd \\r
+       saml-schema-authn-context-smartcard-2.0.xsd \\r
+       saml-schema-authn-context-smartcardpki-2.0.xsd \\r
+       saml-schema-authn-context-softwarepki-2.0.xsd \\r
+       saml-schema-authn-context-spki-2.0.xsd \\r
+       saml-schema-authn-context-srp-2.0.xsd \\r
+       saml-schema-authn-context-sslcert-2.0.xsd \\r
+       saml-schema-authn-context-telephony-2.0.xsd \\r
+       saml-schema-authn-context-timesync-2.0.xsd \\r
+       saml-schema-authn-context-types-2.0.xsd \\r
+       saml-schema-authn-context-x509-2.0.xsd \\r
+       saml-schema-authn-context-xmldsig-2.0.xsd \\r
+       saml-schema-dce-2.0.xsd \\r
+       saml-schema-ecp-2.0.xsd \\r
+       saml-schema-metadata-2.0.xsd \\r
+       saml-schema-protocol-2.0.xsd \\r
+       saml-schema-x500-2.0.xsd \\r
+       saml-schema-xacml-2.0.xsd\r
+\r
+pkgxmldir = $(datadir)/xml/@PACKAGE@\r
+\r
+pkgxml_DATA = saml20-catalog.xml \\r
+       saml10-catalog.xml \\r
+       saml11-catalog.xml \\r
+       $(schemas)\r
+\r
+#\r
+# Some of these need building\r
+#\r
+do-build-file:\r
+       rm -f ${FILE}.tmp\r
+       sed < ${srcdir}/${FILE}.in > ${FILE}.tmp \\r
+           -e 's:@-PKGXMLDIR-@:${pkgxmldir}:'\r
+       cmp -s ${FILE} ${FILE}.tmp || mv ${FILE}.tmp ${FILE}\r
+       rm -f ${FILE}.tmp\r
+\r
+saml20-catalog.xml: ${srcdir}/saml20-catalog.xml.in Makefile ${top_builddir}/config.status\r
+       $(MAKE) do-build-file FILE=$@\r
+\r
+saml10-catalog.xml: ${srcdir}/saml10-catalog.xml.in Makefile ${top_builddir}/config.status\r
+       $(MAKE) do-build-file FILE=$@\r
+\r
+saml11-catalog.xml: ${srcdir}/saml11-catalog.xml.in Makefile ${top_builddir}/config.status\r
+       $(MAKE) do-build-file FILE=$@\r
+\r
+CLEANFILES = saml20-catalog.xml \\r
+       saml10-catalog.xml \\r
+       saml11-catalog.xml\r
+\r
+EXTRA_DIST = \\r
+       saml20-catalog.xml.in \\r
+       saml10-catalog.xml.in \\r
+       saml11-catalog.xml.in \\r
+       $(schemas)\r

diff --git a/schemas/cs-sstc-schema-assertion-01.xsd b/schemas/cs-sstc-schema-assertion-01.xsd
new file mode 100644 (file)
index 0000000..8bc5af1
--- /dev/null
+++ b/schemas/cs-sstc-schema-assertion-01.xsd
@@ -0,0 +1,194 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<!-- edited with XML Spy v3.5 NT (http://www.xmlspy.com) by Phill Hallam-Baker (VeriSign Inc.) -->\r
+<schema targetNamespace="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns="http://www.w3.org/2001/XMLSchema" elementFormDefault="unqualified">\r
+        <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>\r
+        <annotation>\r
+                <documentation>\r
+                Document identifier: cs-sstc-schema-assertion-01\r
+                Location: http://www.oasis-open.org/committees/security/docs/\r
+                </documentation>\r
+        </annotation>\r
+        <simpleType name="IDType">\r
+                <restriction base="string"/>\r
+        </simpleType>\r
+        <simpleType name="IDReferenceType">\r
+                <restriction base="string"/>\r
+        </simpleType>\r
+        <simpleType name="DecisionType">\r
+                <restriction base="string">\r
+                        <enumeration value="Permit"/>\r
+                        <enumeration value="Deny"/>\r
+                        <enumeration value="Indeterminate"/>\r
+                </restriction>\r
+        </simpleType>\r
+        <element name="AssertionIDReference" type="saml:IDReferenceType"/>\r
+        <element name="Assertion" type="saml:AssertionType"/>\r
+        <complexType name="AssertionType">\r
+                <sequence>\r
+                        <element ref="saml:Conditions" minOccurs="0"/>\r
+                        <element ref="saml:Advice" minOccurs="0"/>\r
+                        <choice maxOccurs="unbounded">\r
+                                <element ref="saml:Statement"/>\r
+                                <element ref="saml:SubjectStatement"/>\r
+                                <element ref="saml:AuthenticationStatement"/>\r
+                                <element ref="saml:AuthorizationDecisionStatement"/>\r
+                                <element ref="saml:AttributeStatement"/>\r
+                        </choice>\r
+                        <element ref="ds:Signature" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="MajorVersion" type="integer" use="required"/>\r
+                <attribute name="MinorVersion" type="integer" use="required"/>\r
+                <attribute name="AssertionID" type="saml:IDType" use="required"/>\r
+                <attribute name="Issuer" type="string" use="required"/>\r
+                <attribute name="IssueInstant" type="dateTime" use="required"/>\r
+        </complexType>\r
+        <element name="Conditions" type="saml:ConditionsType"/>\r
+        <complexType name="ConditionsType">\r
+                <choice minOccurs="0" maxOccurs="unbounded">\r
+                        <element ref="saml:AudienceRestrictionCondition"/>\r
+                        <element ref="saml:Condition"/>\r
+                </choice>\r
+                <attribute name="NotBefore" type="dateTime" use="optional"/>\r
+                <attribute name="NotOnOrAfter" type="dateTime" use="optional"/>\r
+        </complexType>\r
+        <element name="Condition" type="saml:ConditionAbstractType"/>\r
+        <complexType name="ConditionAbstractType" abstract="true"/>\r
+        <element name="AudienceRestrictionCondition" type="saml:AudienceRestrictionConditionType"/>\r
+        <complexType name="AudienceRestrictionConditionType">\r
+                <complexContent>\r
+                        <extension base="saml:ConditionAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:Audience" maxOccurs="unbounded"/>\r
+                                </sequence>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="Audience" type="anyURI"/>\r
+        <element name="Advice" type="saml:AdviceType"/>\r
+        <complexType name="AdviceType">\r
+                <choice minOccurs="0" maxOccurs="unbounded">\r
+                        <element ref="saml:AssertionIDReference"/>\r
+                        <element ref="saml:Assertion"/>\r
+                        <any namespace="##other" processContents="lax"/>\r
+                </choice>\r
+        </complexType>\r
+        <element name="Statement" type="saml:StatementAbstractType"/>\r
+        <complexType name="StatementAbstractType" abstract="true"/>\r
+        <element name="SubjectStatement" type="saml:SubjectStatementAbstractType"/>\r
+        <complexType name="SubjectStatementAbstractType" abstract="true">\r
+                <complexContent>\r
+                        <extension base="saml:StatementAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:Subject"/>\r
+                                </sequence>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="Subject" type="saml:SubjectType"/>\r
+        <complexType name="SubjectType">\r
+                <choice>\r
+                        <sequence>\r
+                                <element ref="saml:NameIdentifier"/>\r
+                                <element ref="saml:SubjectConfirmation" minOccurs="0"/>\r
+                        </sequence>\r
+                        <element ref="saml:SubjectConfirmation"/>\r
+                </choice>\r
+        </complexType>\r
+        <element name="NameIdentifier" type="saml:NameIdentifierType"/>\r
+        <complexType name="NameIdentifierType">\r
+                <simpleContent>\r
+                        <extension base="string">\r
+                                <attribute name="NameQualifier" type="string" use="optional"/>\r
+                                <attribute name="Format" type="anyURI" use="optional"/>\r
+                        </extension>\r
+                </simpleContent>\r
+        </complexType>\r
+        <element name="SubjectConfirmation" type="saml:SubjectConfirmationType"/>\r
+        <complexType name="SubjectConfirmationType">\r
+                <sequence>\r
+                        <element ref="saml:ConfirmationMethod" maxOccurs="unbounded"/>\r
+                        <element ref="saml:SubjectConfirmationData" minOccurs="0"/>\r
+                        <element ref="ds:KeyInfo" minOccurs="0"/>\r
+                </sequence>\r
+        </complexType>\r
+        <element name="SubjectConfirmationData" type="anyType"/>\r
+        <element name="ConfirmationMethod" type="anyURI"/>\r
+        <element name="AuthenticationStatement" type="saml:AuthenticationStatementType"/>\r
+        <complexType name="AuthenticationStatementType">\r
+                <complexContent>\r
+                        <extension base="saml:SubjectStatementAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:SubjectLocality" minOccurs="0"/>\r
+                                        <element ref="saml:AuthorityBinding" minOccurs="0" maxOccurs="unbounded"/>\r
+                                </sequence>\r
+                                <attribute name="AuthenticationMethod" type="anyURI" use="required"/>\r
+                                <attribute name="AuthenticationInstant" type="dateTime" use="required"/>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="SubjectLocality" type="saml:SubjectLocalityType"/>\r
+        <complexType name="SubjectLocalityType">\r
+                <attribute name="IPAddress" type="string" use="optional"/>\r
+                <attribute name="DNSAddress" type="string" use="optional"/>\r
+        </complexType>\r
+        <element name="AuthorityBinding" type="saml:AuthorityBindingType"/>\r
+        <complexType name="AuthorityBindingType">\r
+                <attribute name="AuthorityKind" type="QName" use="required"/>\r
+                <attribute name="Location" type="anyURI" use="required"/>\r
+                <attribute name="Binding" type="anyURI" use="required"/>\r
+        </complexType>\r
+        <element name="AuthorizationDecisionStatement" type="saml:AuthorizationDecisionStatementType"/>\r
+        <complexType name="AuthorizationDecisionStatementType">\r
+                <complexContent>\r
+                        <extension base="saml:SubjectStatementAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:Action" maxOccurs="unbounded"/>\r
+                                        <element ref="saml:Evidence" minOccurs="0"/>\r
+                                </sequence>\r
+                                <attribute name="Resource" type="anyURI" use="required"/>\r
+                                <attribute name="Decision" type="saml:DecisionType" use="required"/>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="Action" type="saml:ActionType"/>\r
+        <complexType name="ActionType">\r
+                <simpleContent>\r
+                        <extension base="string">\r
+                                <attribute name="Namespace" type="anyURI"/>\r
+                        </extension>\r
+                </simpleContent>\r
+        </complexType>\r
+        <element name="Evidence" type="saml:EvidenceType"/>\r
+        <complexType name="EvidenceType">\r
+                <choice maxOccurs="unbounded">\r
+                        <element ref="saml:AssertionIDReference"/>\r
+                        <element ref="saml:Assertion"/>\r
+                </choice>\r
+        </complexType>\r
+        <element name="AttributeStatement" type="saml:AttributeStatementType"/>\r
+        <complexType name="AttributeStatementType">\r
+                <complexContent>\r
+                        <extension base="saml:SubjectStatementAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:Attribute" maxOccurs="unbounded"/>\r
+                                </sequence>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="AttributeDesignator" type="saml:AttributeDesignatorType"/>\r
+        <complexType name="AttributeDesignatorType">\r
+                <attribute name="AttributeName" type="string" use="required"/>\r
+                <attribute name="AttributeNamespace" type="anyURI" use="required"/>\r
+        </complexType>\r
+        <element name="Attribute" type="saml:AttributeType"/>\r
+        <complexType name="AttributeType">\r
+                <complexContent>\r
+                        <extension base="saml:AttributeDesignatorType">\r
+                                <sequence>\r
+                                        <element ref="saml:AttributeValue" maxOccurs="unbounded"/>\r
+                                </sequence>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="AttributeValue" type="anyType"/>\r
+</schema>\r

diff --git a/schemas/cs-sstc-schema-assertion-1.1.xsd b/schemas/cs-sstc-schema-assertion-1.1.xsd
new file mode 100644 (file)
index 0000000..97d0ddd
--- /dev/null
+++ b/schemas/cs-sstc-schema-assertion-1.1.xsd
@@ -0,0 +1,205 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<schema targetNamespace="urn:oasis:names:tc:SAML:1.0:assertion" xmlns="http://www.w3.org/2001/XMLSchema" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" elementFormDefault="unqualified" attributeFormDefault="unqualified" version="1.1">\r
+       <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>\r
+       <annotation>\r
+               <documentation>\r
+                Document identifier: sstc-saml-schema-assertion-1.1-draft-02\r
+                Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security\r
+                Revision history:\r
+                draft-01 (Eve Maler):\r
+                  Note that V1.1 of this schema has the same namespace as V1.0.\r
+                  Minor cosmetic updates.\r
+                  Changed IDType to restrict from xsd:ID.\r
+                  Changed IDReferenceType to restrict from xsd:IDREF.\r
+                  Set version attribute on schema element to 1.1.\r
+                draft-02 (Prateek Mishra, Rob Philpott):\r
+                  Added DoNotCacheCondition element and DoNotCacheConditionType\r
+                draft-03 (Scott Cantor)\r
+                                 Rebased ID content directly on XML Schema types\r
+                </documentation>\r
+       </annotation>\r
+       <simpleType name="DecisionType">\r
+               <restriction base="string">\r
+                       <enumeration value="Permit"/>\r
+                       <enumeration value="Deny"/>\r
+                       <enumeration value="Indeterminate"/>\r
+               </restriction>\r
+       </simpleType>\r
+       <element name="AssertionIDReference" type="NCName"/>\r
+       <element name="Assertion" type="saml:AssertionType"/>\r
+       <complexType name="AssertionType">\r
+               <sequence>\r
+                       <element ref="saml:Conditions" minOccurs="0"/>\r
+                       <element ref="saml:Advice" minOccurs="0"/>\r
+                       <choice maxOccurs="unbounded">\r
+                               <element ref="saml:Statement"/>\r
+                               <element ref="saml:SubjectStatement"/>\r
+                               <element ref="saml:AuthenticationStatement"/>\r
+                               <element ref="saml:AuthorizationDecisionStatement"/>\r
+                               <element ref="saml:AttributeStatement"/>\r
+                       </choice>\r
+                       <element ref="ds:Signature" minOccurs="0"/>\r
+               </sequence>\r
+               <attribute name="MajorVersion" type="integer" use="required"/>\r
+               <attribute name="MinorVersion" type="integer" use="required"/>\r
+               <attribute name="AssertionID" type="ID" use="required"/>\r
+               <attribute name="Issuer" type="string" use="required"/>\r
+               <attribute name="IssueInstant" type="dateTime" use="required"/>\r
+       </complexType>\r
+       <element name="Conditions" type="saml:ConditionsType"/>\r
+       <complexType name="ConditionsType">\r
+               <choice minOccurs="0" maxOccurs="unbounded">\r
+                       <element ref="saml:AudienceRestrictionCondition"/>\r
+                       <element ref="saml:DoNotCacheCondition"/>\r
+                       <element ref="saml:Condition"/>\r
+               </choice>\r
+               <attribute name="NotBefore" type="dateTime" use="optional"/>\r
+               <attribute name="NotOnOrAfter" type="dateTime" use="optional"/>\r
+       </complexType>\r
+       <element name="Condition" type="saml:ConditionAbstractType"/>\r
+       <complexType name="ConditionAbstractType" abstract="true"/>\r
+       <element name="AudienceRestrictionCondition" type="saml:AudienceRestrictionConditionType"/>\r
+       <complexType name="AudienceRestrictionConditionType">\r
+               <complexContent>\r
+                       <extension base="saml:ConditionAbstractType">\r
+                               <sequence>\r
+                                       <element ref="saml:Audience" maxOccurs="unbounded"/>\r
+                               </sequence>\r
+                       </extension>\r
+               </complexContent>\r
+       </complexType>\r
+       <element name="Audience" type="anyURI"/>\r
+       <element name="DoNotCacheCondition" type="saml:DoNotCacheConditionType" />\r
+       <complexType name="DoNotCacheConditionType">\r
+               <complexContent>\r
+                       <extension base="saml:ConditionAbstractType"/>\r
+               </complexContent>\r
+       </complexType>\r
+       <element name="Advice" type="saml:AdviceType"/>\r
+       <complexType name="AdviceType">\r
+               <choice minOccurs="0" maxOccurs="unbounded">\r
+                       <element ref="saml:AssertionIDReference"/>\r
+                       <element ref="saml:Assertion"/>\r
+                       <any namespace="##other" processContents="lax"/>\r
+               </choice>\r
+       </complexType>\r
+       <element name="Statement" type="saml:StatementAbstractType"/>\r
+       <complexType name="StatementAbstractType" abstract="true"/>\r
+       <element name="SubjectStatement" type="saml:SubjectStatementAbstractType"/>\r
+       <complexType name="SubjectStatementAbstractType" abstract="true">\r
+               <complexContent>\r
+                       <extension base="saml:StatementAbstractType">\r
+                               <sequence>\r
+                                       <element ref="saml:Subject"/>\r
+                               </sequence>\r
+                       </extension>\r
+               </complexContent>\r
+       </complexType>\r
+       <element name="Subject" type="saml:SubjectType"/>\r
+       <complexType name="SubjectType">\r
+               <choice>\r
+                       <sequence>\r
+                               <element ref="saml:NameIdentifier"/>\r
+                               <element ref="saml:SubjectConfirmation" minOccurs="0"/>\r
+                       </sequence>\r
+                       <element ref="saml:SubjectConfirmation"/>\r
+               </choice>\r
+       </complexType>\r
+       <element name="NameIdentifier" type="saml:NameIdentifierType"/>\r
+       <complexType name="NameIdentifierType">\r
+               <simpleContent>\r
+                       <extension base="string">\r
+                               <attribute name="NameQualifier" type="string" use="optional"/>\r
+                               <attribute name="Format" type="anyURI" use="optional"/>\r
+                       </extension>\r
+               </simpleContent>\r
+       </complexType>\r
+       <element name="SubjectConfirmation" type="saml:SubjectConfirmationType"/>\r
+       <complexType name="SubjectConfirmationType">\r
+               <sequence>\r
+                       <element ref="saml:ConfirmationMethod" maxOccurs="unbounded"/>\r
+                       <element ref="saml:SubjectConfirmationData" minOccurs="0"/>\r
+                       <element ref="ds:KeyInfo" minOccurs="0"/>\r
+               </sequence>\r
+       </complexType>\r
+       <element name="SubjectConfirmationData" type="anyType"/>\r
+       <element name="ConfirmationMethod" type="anyURI"/>\r
+       <element name="AuthenticationStatement" type="saml:AuthenticationStatementType"/>\r
+       <complexType name="AuthenticationStatementType">\r
+               <complexContent>\r
+                       <extension base="saml:SubjectStatementAbstractType">\r
+                               <sequence>\r
+                                       <element ref="saml:SubjectLocality" minOccurs="0"/>\r
+                                       <element ref="saml:AuthorityBinding" minOccurs="0" maxOccurs="unbounded"/>\r
+                               </sequence>\r
+                               <attribute name="AuthenticationMethod" type="anyURI" use="required"/>\r
+                               <attribute name="AuthenticationInstant" type="dateTime" use="required"/>\r
+                       </extension>\r
+               </complexContent>\r
+       </complexType>\r
+       <element name="SubjectLocality" type="saml:SubjectLocalityType"/>\r
+       <complexType name="SubjectLocalityType">\r
+               <attribute name="IPAddress" type="string" use="optional"/>\r
+               <attribute name="DNSAddress" type="string" use="optional"/>\r
+       </complexType>\r
+       <element name="AuthorityBinding" type="saml:AuthorityBindingType"/>\r
+       <complexType name="AuthorityBindingType">\r
+               <attribute name="AuthorityKind" type="QName" use="required"/>\r
+               <attribute name="Location" type="anyURI" use="required"/>\r
+               <attribute name="Binding" type="anyURI" use="required"/>\r
+       </complexType>\r
+       <element name="AuthorizationDecisionStatement" type="saml:AuthorizationDecisionStatementType"/>\r
+       <complexType name="AuthorizationDecisionStatementType">\r
+               <complexContent>\r
+                       <extension base="saml:SubjectStatementAbstractType">\r
+                               <sequence>\r
+                                       <element ref="saml:Action" maxOccurs="unbounded"/>\r
+                                       <element ref="saml:Evidence" minOccurs="0"/>\r
+                               </sequence>\r
+                               <attribute name="Resource" type="anyURI" use="required"/>\r
+                               <attribute name="Decision" type="saml:DecisionType" use="required"/>\r
+                       </extension>\r
+               </complexContent>\r
+       </complexType>\r
+       <element name="Action" type="saml:ActionType"/>\r
+       <complexType name="ActionType">\r
+               <simpleContent>\r
+                       <extension base="string">\r
+                               <attribute name="Namespace" type="anyURI"/>\r
+                       </extension>\r
+               </simpleContent>\r
+       </complexType>\r
+       <element name="Evidence" type="saml:EvidenceType"/>\r
+       <complexType name="EvidenceType">\r
+               <choice maxOccurs="unbounded">\r
+                       <element ref="saml:AssertionIDReference"/>\r
+                       <element ref="saml:Assertion"/>\r
+               </choice>\r
+       </complexType>\r
+       <element name="AttributeStatement" type="saml:AttributeStatementType"/>\r
+       <complexType name="AttributeStatementType">\r
+               <complexContent>\r
+                       <extension base="saml:SubjectStatementAbstractType">\r
+                               <sequence>\r
+                                       <element ref="saml:Attribute" maxOccurs="unbounded"/>\r
+                               </sequence>\r
+                       </extension>\r
+               </complexContent>\r
+       </complexType>\r
+       <element name="AttributeDesignator" type="saml:AttributeDesignatorType"/>\r
+       <complexType name="AttributeDesignatorType">\r
+               <attribute name="AttributeName" type="string" use="required"/>\r
+               <attribute name="AttributeNamespace" type="anyURI" use="required"/>\r
+       </complexType>\r
+       <element name="Attribute" type="saml:AttributeType"/>\r
+       <complexType name="AttributeType">\r
+               <complexContent>\r
+                       <extension base="saml:AttributeDesignatorType">\r
+                               <sequence>\r
+                                       <element ref="saml:AttributeValue" maxOccurs="unbounded"/>\r
+                               </sequence>\r
+                       </extension>\r
+               </complexContent>\r
+       </complexType>\r
+       <element name="AttributeValue" type="anyType"/>\r
+</schema>\r

diff --git a/schemas/cs-sstc-schema-protocol-01.xsd b/schemas/cs-sstc-schema-protocol-01.xsd
new file mode 100644 (file)
index 0000000..ecad05b
--- /dev/null
+++ b/schemas/cs-sstc-schema-protocol-01.xsd
@@ -0,0 +1,127 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<!-- edited with XML Spy v4.2 U (http://www.xmlspy.com) by Phillip Hallam-Baker (Phillip Hallam-Baker) -->\r
+<schema targetNamespace="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns="http://www.w3.org/2001/XMLSchema" elementFormDefault="unqualified">\r
+        <import namespace="urn:oasis:names:tc:SAML:1.0:assertion" schemaLocation="cs-sstc-schema-assertion-01.xsd"/>\r
+        <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>\r
+        <annotation>\r
+                <documentation>\r
+                Document identifier: cs-sstc-schema-protocol-01\r
+                Location: http://www.oasis-open.org/committees/security/docs/\r
+                </documentation>\r
+        </annotation>\r
+        <complexType name="RequestAbstractType" abstract="true">\r
+                <sequence>\r
+                        <element ref="samlp:RespondWith" minOccurs="0" maxOccurs="unbounded"/>\r
+                        <element ref="ds:Signature" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="RequestID" type="saml:IDType" use="required"/>\r
+                <attribute name="MajorVersion" type="integer" use="required"/>\r
+                <attribute name="MinorVersion" type="integer" use="required"/>\r
+                <attribute name="IssueInstant" type="dateTime" use="required"/>\r
+        </complexType>\r
+        <element name="RespondWith" type="QName"/>\r
+        <element name="Request" type="samlp:RequestType"/>\r
+        <complexType name="RequestType">\r
+                <complexContent>\r
+                        <extension base="samlp:RequestAbstractType">\r
+                                <choice>\r
+                                        <element ref="samlp:Query"/>\r
+                                        <element ref="samlp:SubjectQuery"/>\r
+                                        <element ref="samlp:AuthenticationQuery"/>\r
+                                        <element ref="samlp:AttributeQuery"/>\r
+                                        <element ref="samlp:AuthorizationDecisionQuery"/>\r
+                                        <element ref="saml:AssertionIDReference" maxOccurs="unbounded"/>\r
+                                        <element ref="samlp:AssertionArtifact" maxOccurs="unbounded"/>\r
+                                </choice>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="AssertionArtifact" type="string"/>\r
+        <element name="Query" type="samlp:QueryAbstractType"/>\r
+        <complexType name="QueryAbstractType" abstract="true"/>\r
+        <element name="SubjectQuery" type="samlp:SubjectQueryAbstractType"/>\r
+        <complexType name="SubjectQueryAbstractType" abstract="true">\r
+                <complexContent>\r
+                        <extension base="samlp:QueryAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:Subject"/>\r
+                                </sequence>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="AuthenticationQuery" type="samlp:AuthenticationQueryType"/>\r
+        <complexType name="AuthenticationQueryType">\r
+                <complexContent>\r
+                        <extension base="samlp:SubjectQueryAbstractType">\r
+                                <attribute name="AuthenticationMethod" type="anyURI"/>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="AttributeQuery" type="samlp:AttributeQueryType"/>\r
+        <complexType name="AttributeQueryType">\r
+                <complexContent>\r
+                        <extension base="samlp:SubjectQueryAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:AttributeDesignator" minOccurs="0" maxOccurs="unbounded"/>\r
+                                </sequence>\r
+                                <attribute name="Resource" type="anyURI" use="optional"/>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="AuthorizationDecisionQuery" type="samlp:AuthorizationDecisionQueryType"/>\r
+        <complexType name="AuthorizationDecisionQueryType">\r
+                <complexContent>\r
+                        <extension base="samlp:SubjectQueryAbstractType">\r
+                                <sequence>\r
+                                        <element ref="saml:Action" maxOccurs="unbounded"/>\r
+                                        <element ref="saml:Evidence" minOccurs="0" maxOccurs="1"/>\r
+                                </sequence>\r
+                                <attribute name="Resource" type="anyURI" use="required"/>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <complexType name="ResponseAbstractType" abstract="true">\r
+                <sequence>\r
+                        <element ref="ds:Signature" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="ResponseID" type="saml:IDType" use="required"/>\r
+                <attribute name="InResponseTo" type="saml:IDReferenceType" use="optional"/>\r
+                <attribute name="MajorVersion" type="integer" use="required"/>\r
+                <attribute name="MinorVersion" type="integer" use="required"/>\r
+                <attribute name="IssueInstant" type="dateTime" use="required"/>\r
+                <attribute name="Recipient" type="anyURI" use="optional"/>\r
+        </complexType>\r
+        <element name="Response" type="samlp:ResponseType"/>\r
+        <complexType name="ResponseType">\r
+                <complexContent>\r
+                        <extension base="samlp:ResponseAbstractType">\r
+                                <sequence>\r
+                                        <element ref="samlp:Status"/>\r
+                                        <element ref="saml:Assertion" minOccurs="0" maxOccurs="unbounded"/>\r
+                                </sequence>\r
+                        </extension>\r
+                </complexContent>\r
+        </complexType>\r
+        <element name="Status" type="samlp:StatusType"/>\r
+        <complexType name="StatusType">\r
+                <sequence>\r
+                        <element ref="samlp:StatusCode"/>\r
+                        <element ref="samlp:StatusMessage" minOccurs="0" maxOccurs="1"/>\r
+                        <element ref="samlp:StatusDetail" minOccurs="0"/>\r
+                </sequence>\r
+        </complexType>\r
+        <element name="StatusCode" type="samlp:StatusCodeType"/>\r
+        <complexType name="StatusCodeType">\r
+                <sequence>\r
+                        <element ref="samlp:StatusCode" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="Value" type="QName" use="required"/>\r
+        </complexType>\r
+        <element name="StatusMessage" type="string"/>\r
+        <element name="StatusDetail" type="samlp:StatusDetailType"/>\r
+        <complexType name="StatusDetailType">\r
+                <sequence>\r
+                        <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+        </complexType>\r
+</schema>\r

diff --git a/schemas/cs-sstc-schema-protocol-1.1.xsd b/schemas/cs-sstc-schema-protocol-1.1.xsd
new file mode 100644 (file)
index 0000000..8989f37
--- /dev/null
+++ b/schemas/cs-sstc-schema-protocol-1.1.xsd
@@ -0,0 +1,137 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<schema targetNamespace="urn:oasis:names:tc:SAML:1.0:protocol" xmlns="http://www.w3.org/2001/XMLSchema" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" elementFormDefault="unqualified" attributeFormDefault="unqualified" version="1.1">
+       <import namespace="urn:oasis:names:tc:SAML:1.0:assertion" schemaLocation="cs-sstc-schema-assertion-1.1.xsd"/>
+       <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd"/>
+       <annotation>
+               <documentation>
+                       Document identifier: sstc-saml-schema-protocol-1.1-draft-03
+                       Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security
+                       Revision history:
+                          draft-01 (Eve Maler):
+                               Note that V1.1 of this schema has the same namespace as V1.0.
+                               Minor cosmetic updates.
+                               Set version attribute on schema element to 1.1.
+                          draft-01 (Eve Maler):
+                               Fix document Identifier.
+                          draft-02 (Prateek Mishra, Rob Philpott):
+                               Added DoNotCacheCondition.
+                          draft-04 (Scott Cantor):
+                               Rebased ID content directly on XML Schema types
+               </documentation>
+       </annotation>
+       <complexType name="RequestAbstractType" abstract="true">
+               <sequence>
+                       <element ref="samlp:RespondWith" minOccurs="0" maxOccurs="unbounded"/>
+                       <element ref="ds:Signature" minOccurs="0"/>
+               </sequence>
+               <attribute name="RequestID" type="ID" use="required"/>
+               <attribute name="MajorVersion" type="integer" use="required"/>
+               <attribute name="MinorVersion" type="integer" use="required"/>
+               <attribute name="IssueInstant" type="dateTime" use="required"/>
+       </complexType>
+       <element name="RespondWith" type="QName"/>
+       <element name="Request" type="samlp:RequestType"/>
+       <complexType name="RequestType">
+               <complexContent>
+                       <extension base="samlp:RequestAbstractType">
+                               <choice>
+                                       <element ref="samlp:Query"/>
+                                       <element ref="samlp:SubjectQuery"/>
+                                       <element ref="samlp:AuthenticationQuery"/>
+                                       <element ref="samlp:AttributeQuery"/>
+                                       <element ref="samlp:AuthorizationDecisionQuery"/>
+                                       <element ref="saml:AssertionIDReference" maxOccurs="unbounded"/>
+                                       <element ref="samlp:AssertionArtifact" maxOccurs="unbounded"/>
+                               </choice>
+                       </extension>
+               </complexContent>
+       </complexType>
+       <element name="AssertionArtifact" type="string"/>
+       <element name="Query" type="samlp:QueryAbstractType"/>
+       <complexType name="QueryAbstractType" abstract="true"/>
+       <element name="SubjectQuery" type="samlp:SubjectQueryAbstractType"/>
+       <complexType name="SubjectQueryAbstractType" abstract="true">
+               <complexContent>
+                       <extension base="samlp:QueryAbstractType">
+                               <sequence>
+                                       <element ref="saml:Subject"/>
+                               </sequence>
+                       </extension>
+               </complexContent>
+       </complexType>
+       <element name="AuthenticationQuery" type="samlp:AuthenticationQueryType"/>
+       <complexType name="AuthenticationQueryType">
+               <complexContent>
+                       <extension base="samlp:SubjectQueryAbstractType">
+                               <attribute name="AuthenticationMethod" type="anyURI"/>
+                       </extension>
+               </complexContent>
+       </complexType>
+       <element name="AttributeQuery" type="samlp:AttributeQueryType"/>
+       <complexType name="AttributeQueryType">
+               <complexContent>
+                       <extension base="samlp:SubjectQueryAbstractType">
+                               <sequence>
+                                       <element ref="saml:AttributeDesignator" minOccurs="0" maxOccurs="unbounded"/>
+                               </sequence>
+                               <attribute name="Resource" type="anyURI" use="optional"/>
+                       </extension>
+               </complexContent>
+       </complexType>
+       <element name="AuthorizationDecisionQuery" type="samlp:AuthorizationDecisionQueryType"/>
+       <complexType name="AuthorizationDecisionQueryType">
+               <complexContent>
+                       <extension base="samlp:SubjectQueryAbstractType">
+                               <sequence>
+                                       <element ref="saml:Action" maxOccurs="unbounded"/>
+                                       <element ref="saml:Evidence" minOccurs="0"/>
+                               </sequence>
+                               <attribute name="Resource" type="anyURI" use="required"/>
+                       </extension>
+               </complexContent>
+       </complexType>
+       <complexType name="ResponseAbstractType" abstract="true">
+               <sequence>
+                       <element ref="ds:Signature" minOccurs="0"/>
+               </sequence>
+               <attribute name="ResponseID" type="ID" use="required"/>
+               <attribute name="InResponseTo" type="NCName" use="optional"/>
+               <attribute name="MajorVersion" type="integer" use="required"/>
+               <attribute name="MinorVersion" type="integer" use="required"/>
+               <attribute name="IssueInstant" type="dateTime" use="required"/>
+               <attribute name="Recipient" type="anyURI" use="optional"/>
+       </complexType>
+       <element name="Response" type="samlp:ResponseType"/>
+       <complexType name="ResponseType">
+               <complexContent>
+                       <extension base="samlp:ResponseAbstractType">
+                               <sequence>
+                                       <element ref="samlp:Status"/>
+                                       <element ref="saml:Assertion" minOccurs="0" maxOccurs="unbounded"/>
+                               </sequence>
+                       </extension>
+               </complexContent>
+       </complexType>
+       <element name="Status" type="samlp:StatusType"/>
+       <complexType name="StatusType">
+               <sequence>
+                       <element ref="samlp:StatusCode"/>
+                       <element ref="samlp:StatusMessage" minOccurs="0"/>
+                       <element ref="samlp:StatusDetail" minOccurs="0"/>
+               </sequence>
+       </complexType>
+       <element name="StatusCode" type="samlp:StatusCodeType"/>
+       <complexType name="StatusCodeType">
+               <sequence>
+                       <element ref="samlp:StatusCode" minOccurs="0"/>
+               </sequence>
+               <attribute name="Value" type="QName" use="required"/>
+       </complexType>
+       <element name="StatusMessage" type="string"/>
+       <element name="StatusDetail" type="samlp:StatusDetailType"/>
+       <complexType name="StatusDetailType">
+               <sequence>
+                       <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+               </sequence>
+       </complexType>
+</schema>

diff --git a/schemas/saml-schema-assertion-2.0.xsd b/schemas/saml-schema-assertion-2.0.xsd
new file mode 100644 (file)
index 0000000..6aa3b27
--- /dev/null
+++ b/schemas/saml-schema-assertion-2.0.xsd
@@ -0,0 +1,283 @@
+<?xml version="1.0" encoding="US-ASCII"?>\r
+<schema\r
+    targetNamespace="urn:oasis:names:tc:SAML:2.0:assertion"\r
+    xmlns="http://www.w3.org/2001/XMLSchema"\r
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"\r
+    xmlns:ds="http://www.w3.org/2000/09/xmldsig#"\r
+    xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"\r
+    elementFormDefault="unqualified"\r
+    attributeFormDefault="unqualified"\r
+    blockDefault="substitution"\r
+    version="2.0">\r
+    <import namespace="http://www.w3.org/2000/09/xmldsig#"\r
+        schemaLocation="http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"/>\r
+    <import namespace="http://www.w3.org/2001/04/xmlenc#"\r
+        schemaLocation="http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/xenc-schema.xsd"/>\r
+    <annotation>\r
+        <documentation>\r
+            Document identifier: saml-schema-assertion-2.0\r
+            Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+            Revision history:\r
+            V1.0 (November, 2002):\r
+              Initial Standard Schema.\r
+            V1.1 (September, 2003):\r
+              Updates within the same V1.0 namespace.\r
+            V2.0 (March, 2005):\r
+              New assertion schema for SAML V2.0 namespace.\r
+        </documentation>\r
+    </annotation>\r
+    <attributeGroup name="IDNameQualifiers">\r
+        <attribute name="NameQualifier" type="string" use="optional"/>\r
+        <attribute name="SPNameQualifier" type="string" use="optional"/>\r
+    </attributeGroup>\r
+    <element name="BaseID" type="saml:BaseIDAbstractType"/>\r
+    <complexType name="BaseIDAbstractType" abstract="true">\r
+        <attributeGroup ref="saml:IDNameQualifiers"/>\r
+    </complexType>\r
+    <element name="NameID" type="saml:NameIDType"/>\r
+    <complexType name="NameIDType">\r
+        <simpleContent>\r
+            <extension base="string">\r
+                <attributeGroup ref="saml:IDNameQualifiers"/>\r
+                <attribute name="Format" type="anyURI" use="optional"/>\r
+                <attribute name="SPProvidedID" type="string" use="optional"/>\r
+            </extension>\r
+        </simpleContent>\r
+    </complexType>\r
+    <complexType name="EncryptedElementType">\r
+        <sequence>\r
+            <element ref="xenc:EncryptedData"/>\r
+            <element ref="xenc:EncryptedKey" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+    </complexType>\r
+    <element name="EncryptedID" type="saml:EncryptedElementType"/>\r
+    <element name="Issuer" type="saml:NameIDType"/>\r
+    <element name="AssertionIDRef" type="NCName"/>\r
+    <element name="AssertionURIRef" type="anyURI"/>\r
+    <element name="Assertion" type="saml:AssertionType"/>\r
+    <complexType name="AssertionType">\r
+        <sequence>\r
+            <element ref="saml:Issuer"/>\r
+            <element ref="ds:Signature" minOccurs="0"/>\r
+            <element ref="saml:Subject" minOccurs="0"/>\r
+            <element ref="saml:Conditions" minOccurs="0"/>\r
+            <element ref="saml:Advice" minOccurs="0"/>\r
+            <choice minOccurs="0" maxOccurs="unbounded">\r
+                <element ref="saml:Statement"/>\r
+                <element ref="saml:AuthnStatement"/>\r
+                <element ref="saml:AuthzDecisionStatement"/>\r
+                <element ref="saml:AttributeStatement"/>\r
+            </choice>\r
+        </sequence>\r
+        <attribute name="Version" type="string" use="required"/>\r
+        <attribute name="ID" type="ID" use="required"/>\r
+        <attribute name="IssueInstant" type="dateTime" use="required"/>\r
+    </complexType>\r
+    <element name="Subject" type="saml:SubjectType"/>\r
+    <complexType name="SubjectType">\r
+        <choice>\r
+            <sequence>\r
+                <choice>\r
+                    <element ref="saml:BaseID"/>\r
+                    <element ref="saml:NameID"/>\r
+                    <element ref="saml:EncryptedID"/>\r
+                </choice>\r
+                <element ref="saml:SubjectConfirmation" minOccurs="0" maxOccurs="unbounded"/>\r
+            </sequence>\r
+            <element ref="saml:SubjectConfirmation" maxOccurs="unbounded"/>\r
+        </choice>\r
+    </complexType>\r
+    <element name="SubjectConfirmation" type="saml:SubjectConfirmationType"/>\r
+    <complexType name="SubjectConfirmationType">\r
+        <sequence>\r
+            <choice minOccurs="0">\r
+                <element ref="saml:BaseID"/>\r
+                <element ref="saml:NameID"/>\r
+                <element ref="saml:EncryptedID"/>\r
+            </choice>\r
+            <element ref="saml:SubjectConfirmationData" minOccurs="0"/>\r
+        </sequence>\r
+        <attribute name="Method" type="anyURI" use="required"/>\r
+    </complexType>\r
+    <element name="SubjectConfirmationData" type="saml:SubjectConfirmationDataType"/>\r
+    <complexType name="SubjectConfirmationDataType" mixed="true">\r
+        <complexContent>\r
+            <restriction base="anyType">\r
+                <sequence>\r
+                    <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+                <attribute name="NotBefore" type="dateTime" use="optional"/>\r
+                <attribute name="NotOnOrAfter" type="dateTime" use="optional"/>\r
+                <attribute name="Recipient" type="anyURI" use="optional"/>\r
+                <attribute name="InResponseTo" type="NCName" use="optional"/>\r
+                <attribute name="Address" type="string" use="optional"/>\r
+                <anyAttribute namespace="##other" processContents="lax"/>\r
+            </restriction>\r
+        </complexContent>\r
+    </complexType>\r
+    <complexType name="KeyInfoConfirmationDataType" mixed="false">\r
+        <complexContent>\r
+            <restriction base="saml:SubjectConfirmationDataType">\r
+                <sequence>\r
+                    <element ref="ds:KeyInfo" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </restriction>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="Conditions" type="saml:ConditionsType"/>\r
+    <complexType name="ConditionsType">\r
+        <choice minOccurs="0" maxOccurs="unbounded">\r
+            <element ref="saml:Condition"/>\r
+            <element ref="saml:AudienceRestriction"/>\r
+            <element ref="saml:OneTimeUse"/>\r
+            <element ref="saml:ProxyRestriction"/>\r
+        </choice>\r
+        <attribute name="NotBefore" type="dateTime" use="optional"/>\r
+        <attribute name="NotOnOrAfter" type="dateTime" use="optional"/>\r
+    </complexType>\r
+    <element name="Condition" type="saml:ConditionAbstractType"/>\r
+    <complexType name="ConditionAbstractType" abstract="true"/>\r
+    <element name="AudienceRestriction" type="saml:AudienceRestrictionType"/>\r
+    <complexType name="AudienceRestrictionType">\r
+        <complexContent>\r
+            <extension base="saml:ConditionAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:Audience" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="Audience" type="anyURI"/>\r
+    <element name="OneTimeUse" type="saml:OneTimeUseType" />\r
+    <complexType name="OneTimeUseType">\r
+        <complexContent>\r
+            <extension base="saml:ConditionAbstractType"/>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="ProxyRestriction" type="saml:ProxyRestrictionType"/>\r
+    <complexType name="ProxyRestrictionType">\r
+    <complexContent>\r
+        <extension base="saml:ConditionAbstractType">\r
+            <sequence>\r
+                <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>\r
+            </sequence>\r
+            <attribute name="Count" type="nonNegativeInteger" use="optional"/>\r
+        </extension>\r
+       </complexContent>\r
+    </complexType>\r
+    <element name="Advice" type="saml:AdviceType"/>\r
+    <complexType name="AdviceType">\r
+        <choice minOccurs="0" maxOccurs="unbounded">\r
+            <element ref="saml:AssertionIDRef"/>\r
+            <element ref="saml:AssertionURIRef"/>\r
+            <element ref="saml:Assertion"/>\r
+            <element ref="saml:EncryptedAssertion"/>\r
+            <any namespace="##other" processContents="lax"/>\r
+        </choice>\r
+    </complexType>\r
+    <element name="EncryptedAssertion" type="saml:EncryptedElementType"/>\r
+    <element name="Statement" type="saml:StatementAbstractType"/>\r
+    <complexType name="StatementAbstractType" abstract="true"/>\r
+    <element name="AuthnStatement" type="saml:AuthnStatementType"/>\r
+    <complexType name="AuthnStatementType">\r
+        <complexContent>\r
+            <extension base="saml:StatementAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:SubjectLocality" minOccurs="0"/>\r
+                    <element ref="saml:AuthnContext"/>\r
+                </sequence>\r
+                <attribute name="AuthnInstant" type="dateTime" use="required"/>\r
+                <attribute name="SessionIndex" type="string" use="optional"/>\r
+                <attribute name="SessionNotOnOrAfter" type="dateTime" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="SubjectLocality" type="saml:SubjectLocalityType"/>\r
+    <complexType name="SubjectLocalityType">\r
+        <attribute name="Address" type="string" use="optional"/>\r
+        <attribute name="DNSName" type="string" use="optional"/>\r
+    </complexType>\r
+    <element name="AuthnContext" type="saml:AuthnContextType"/>\r
+    <complexType name="AuthnContextType">\r
+        <sequence>\r
+            <choice>\r
+                <sequence>\r
+                    <element ref="saml:AuthnContextClassRef"/>\r
+                    <choice minOccurs="0">\r
+                        <element ref="saml:AuthnContextDecl"/>\r
+                        <element ref="saml:AuthnContextDeclRef"/>\r
+                    </choice>\r
+                </sequence>\r
+                <choice>\r
+                    <element ref="saml:AuthnContextDecl"/>\r
+                    <element ref="saml:AuthnContextDeclRef"/>\r
+                </choice>\r
+            </choice>\r
+            <element ref="saml:AuthenticatingAuthority" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+    </complexType>\r
+    <element name="AuthnContextClassRef" type="anyURI"/>\r
+    <element name="AuthnContextDeclRef" type="anyURI"/>\r
+    <element name="AuthnContextDecl" type="anyType"/>\r
+    <element name="AuthenticatingAuthority" type="anyURI"/>\r
+    <element name="AuthzDecisionStatement" type="saml:AuthzDecisionStatementType"/>\r
+    <complexType name="AuthzDecisionStatementType">\r
+        <complexContent>\r
+            <extension base="saml:StatementAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:Action" maxOccurs="unbounded"/>\r
+                    <element ref="saml:Evidence" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="Resource" type="anyURI" use="required"/>\r
+                <attribute name="Decision" type="saml:DecisionType" use="required"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <simpleType name="DecisionType">\r
+        <restriction base="string">\r
+            <enumeration value="Permit"/>\r
+            <enumeration value="Deny"/>\r
+            <enumeration value="Indeterminate"/>\r
+        </restriction>\r
+    </simpleType>\r
+    <element name="Action" type="saml:ActionType"/>\r
+    <complexType name="ActionType">\r
+        <simpleContent>\r
+            <extension base="string">\r
+                <attribute name="Namespace" type="anyURI" use="required"/>\r
+            </extension>\r
+        </simpleContent>\r
+    </complexType>\r
+    <element name="Evidence" type="saml:EvidenceType"/>\r
+    <complexType name="EvidenceType">\r
+        <choice maxOccurs="unbounded">\r
+            <element ref="saml:AssertionIDRef"/>\r
+            <element ref="saml:AssertionURIRef"/>\r
+            <element ref="saml:Assertion"/>\r
+            <element ref="saml:EncryptedAssertion"/>\r
+        </choice>\r
+    </complexType>\r
+    <element name="AttributeStatement" type="saml:AttributeStatementType"/>\r
+    <complexType name="AttributeStatementType">\r
+        <complexContent>\r
+            <extension base="saml:StatementAbstractType">\r
+                <choice maxOccurs="unbounded">\r
+                    <element ref="saml:Attribute"/>\r
+                    <element ref="saml:EncryptedAttribute"/>\r
+                </choice>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="Attribute" type="saml:AttributeType"/>\r
+    <complexType name="AttributeType">\r
+        <sequence>\r
+            <element ref="saml:AttributeValue" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="Name" type="string" use="required"/>\r
+        <attribute name="NameFormat" type="anyURI" use="optional"/>\r
+        <attribute name="FriendlyName" type="string" use="optional"/>\r
+        <anyAttribute namespace="##other" processContents="lax"/>\r
+    </complexType>\r
+    <element name="AttributeValue" type="anyType" nillable="true"/>\r
+    <element name="EncryptedAttribute" type="saml:EncryptedElementType"/>\r
+</schema>\r

diff --git a/schemas/saml-schema-authn-context-2.0.xsd b/schemas/saml-schema-authn-context-2.0.xsd
new file mode 100644 (file)
index 0000000..5723bb9
--- /dev/null
+++ b/schemas/saml-schema-authn-context-2.0.xsd
@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<xs:schema \r
+  targetNamespace="urn:oasis:names:tc:SAML:2.0:ac"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema"\r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:annotation>\r
+    <xs:documentation>\r
+      Document identifier: saml-schema-authn-context-2.0\r
+      Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+      Revision history:\r
+        V2.0 (March, 2005):\r
+          New core authentication context schema for SAML V2.0. \r
+          This is just an include of all types from the schema\r
+          referred to in the include statement below.\r
+    </xs:documentation>\r
+  </xs:annotation>\r
+\r
+  <xs:include schemaLocation="saml-schema-authn-context-types-2.0.xsd"/>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-auth-telephony-2.0.xsd b/schemas/saml-schema-authn-context-auth-telephony-2.0.xsd
new file mode 100644 (file)
index 0000000..84dc4ec
--- /dev/null
+++ b/schemas/saml-schema-authn-context-auth-telephony-2.0.xsd
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony\r
+        Document identifier: saml-schema-authn-context-auth-telephony-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Password"/>\r
+            <xs:element ref="SubscriberLineNumber"/>\r
+            <xs:element ref="UserSuffix"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PSTN"/>\r
+              <xs:element ref="ISDN"/>\r
+              <xs:element ref="ADSL"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-ip-2.0.xsd b/schemas/saml-schema-authn-context-ip-2.0.xsd
new file mode 100644 (file)
index 0000000..add9e0c
--- /dev/null
+++ b/schemas/saml-schema-authn-context-ip-2.0.xsd
@@ -0,0 +1,65 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema\r
+  targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol\r
+        Document identifier: saml-schema-authn-context-ip-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="IPAddress"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-ippword-2.0.xsd b/schemas/saml-schema-authn-context-ippword-2.0.xsd
new file mode 100644 (file)
index 0000000..7496a04
--- /dev/null
+++ b/schemas/saml-schema-authn-context-ippword-2.0.xsd
@@ -0,0 +1,67 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword"\r
+  xmlns:ac="urn:oasis:names:tc:SAML:2.0:ac" \r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword\r
+        Document identifier: saml-schema-authn-context-ippword-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Password"/>\r
+            <xs:element ref="IPAddress"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-kerberos-2.0.xsd b/schemas/saml-schema-authn-context-kerberos-2.0.xsd
new file mode 100644 (file)
index 0000000..88398cf
--- /dev/null
+++ b/schemas/saml-schema-authn-context-kerberos-2.0.xsd
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos\r
+        Document identifier: saml-schema-authn-context-kerberos-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="preauth" type="xs:integer" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="SharedSecretChallengeResponse"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="SharedSecretChallengeResponseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SharedSecretChallengeResponseType">\r
+          <xs:attribute name="method" type="xs:anyURI" fixed="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd b/schemas/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd
new file mode 100644 (file)
index 0000000..745a277
--- /dev/null
+++ b/schemas/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd
@@ -0,0 +1,186 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract\r
+        Document identifier: saml-schema-authn-context-mobileonefactor-reg-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="DigSig"/>\r
+              <xs:element ref="ZeroKnowledge"/>\r
+              <xs:element ref="SharedSecretChallengeResponse"/>\r
+              <xs:element ref="SharedSecretDynamicPlaintext"/>\r
+              <xs:element ref="AsymmetricDecryption"/>\r
+              <xs:element ref="AsymmetricKeyAgreement"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SSL"/>\r
+              <xs:element ref="MobileNetworkNoEncryption"/>\r
+              <xs:element ref="MobileNetworkRadioEncryption"/>\r
+              <xs:element ref="MobileNetworkEndToEndEncryption"/>\r
+              <xs:element ref="WTLS"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="OperationalProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="OperationalProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="SecurityAudit"/>\r
+            <xs:element ref="DeactivationCallCenter"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="TechnicalProtectionBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TechnicalProtectionBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PrivateKeyProtection"/>\r
+              <xs:element ref="SecretKeyProtection"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrivateKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrivateKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="SecretKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecretKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="KeyStorageType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyStorageType">\r
+          <xs:attribute name="medium" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="mediumType">\r
+                <xs:enumeration value="smartcard"/>\r
+                <xs:enumeration value="MobileDevice"/>\r
+                <xs:enumeration value="MobileAuthCard"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="SecurityAuditType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecurityAuditType">\r
+          <xs:sequence>\r
+            <xs:element ref="SwitchAudit"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="IdentificationType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="IdentificationType">\r
+          <xs:sequence>\r
+            <xs:element ref="PhysicalVerification"/>\r
+            <xs:element ref="WrittenConsent"/>\r
+            <xs:element ref="GoverningAgreements"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="nym">\r
+            <xs:simpleType>\r
+              <xs:restriction base="nymType">\r
+                <xs:enumeration value="anonymity"/>\r
+                <xs:enumeration value="verinymity"/>\r
+                <xs:enumeration value="pseudonymity"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd b/schemas/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd
new file mode 100644 (file)
index 0000000..deea996
--- /dev/null
+++ b/schemas/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd
@@ -0,0 +1,183 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered\r
+        Document identifier: saml-schema-authn-context-mobileonefactor-unreg-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="DigSig"/>\r
+              <xs:element ref="ZeroKnowledge"/>\r
+              <xs:element ref="SharedSecretChallengeResponse"/>\r
+              <xs:element ref="SharedSecretDynamicPlaintext"/>\r
+              <xs:element ref="AsymmetricDecryption"/>\r
+              <xs:element ref="AsymmetricKeyAgreement"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SSL"/>\r
+              <xs:element ref="MobileNetworkNoEncryption"/>\r
+              <xs:element ref="MobileNetworkRadioEncryption"/>\r
+              <xs:element ref="MobileNetworkEndToEndEncryption"/>\r
+              <xs:element ref="WTLS"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="OperationalProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="OperationalProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="SecurityAudit"/>\r
+            <xs:element ref="DeactivationCallCenter"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="TechnicalProtectionBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TechnicalProtectionBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PrivateKeyProtection"/>\r
+              <xs:element ref="SecretKeyProtection"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrivateKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrivateKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="SecretKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecretKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="KeyStorageType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyStorageType">\r
+          <xs:attribute name="medium" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="mediumType">\r
+                <xs:enumeration value="MobileDevice"/>\r
+                <xs:enumeration value="MobileAuthCard"/>\r
+                <xs:enumeration value="smartcard"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="SecurityAuditType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecurityAuditType">\r
+          <xs:sequence>\r
+            <xs:element ref="SwitchAudit"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="IdentificationType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="IdentificationType">\r
+          <xs:sequence>\r
+            <xs:element ref="GoverningAgreements"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="nym">\r
+            <xs:simpleType>\r
+              <xs:restriction base="nymType">\r
+                <xs:enumeration value="anonymity"/>\r
+                <xs:enumeration value="pseudonymity"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd b/schemas/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd
new file mode 100644 (file)
index 0000000..3bfa7c5
--- /dev/null
+++ b/schemas/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd
@@ -0,0 +1,202 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract\r
+        Document identifier: saml-schema-authn-context-mobiletwofactor-reg-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="DigSig"/>\r
+              <xs:element ref="ZeroKnowledge"/>\r
+              <xs:element ref="SharedSecretChallengeResponse"/>\r
+              <xs:element ref="SharedSecretDynamicPlaintext"/>\r
+              <xs:element ref="AsymmetricDecryption"/>\r
+              <xs:element ref="AsymmetricKeyAgreement"/>\r
+              <xs:element ref="ComplexAuthenticator"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="ComplexAuthenticatorType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="ComplexAuthenticatorType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SharedSecretChallengeResponse"/>\r
+              <xs:element ref="SharedSecretDynamicPlaintext"/>\r
+            </xs:choice>\r
+            <xs:element ref="Password"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SSL"/>\r
+              <xs:element ref="MobileNetworkNoEncryption"/>\r
+              <xs:element ref="MobileNetworkRadioEncryption"/>\r
+              <xs:element ref="MobileNetworkEndToEndEncryption"/>\r
+              <xs:element ref="WTLS"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="OperationalProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="OperationalProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="SecurityAudit"/>\r
+            <xs:element ref="DeactivationCallCenter"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="TechnicalProtectionBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TechnicalProtectionBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PrivateKeyProtection"/>\r
+              <xs:element ref="SecretKeyProtection"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrivateKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrivateKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyActivation"/>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="SecretKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecretKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyActivation"/>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="KeyStorageType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyStorageType">\r
+          <xs:attribute name="medium" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="mediumType">\r
+                <xs:enumeration value="MobileDevice"/>\r
+                <xs:enumeration value="MobileAuthCard"/>\r
+                <xs:enumeration value="smartcard"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+  \r
+    <xs:complexType name="SecurityAuditType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecurityAuditType">\r
+          <xs:sequence>\r
+            <xs:element ref="SwitchAudit"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+  \r
+    <xs:complexType name="IdentificationType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="IdentificationType">\r
+          <xs:sequence>\r
+            <xs:element ref="PhysicalVerification"/>\r
+            <xs:element ref="WrittenConsent"/>\r
+            <xs:element ref="GoverningAgreements"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="nym">\r
+            <xs:simpleType>\r
+              <xs:restriction base="nymType">\r
+                <xs:enumeration value="anonymity"/>\r
+                <xs:enumeration value="verinymity"/>\r
+                <xs:enumeration value="pseudonymity"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd b/schemas/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd
new file mode 100644 (file)
index 0000000..714e0fd
--- /dev/null
+++ b/schemas/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd
@@ -0,0 +1,200 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered\r
+        Document identifier: saml-schema-authn-context-mobiletwofactor-unreg-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="DigSig"/>\r
+              <xs:element ref="ZeroKnowledge"/>\r
+              <xs:element ref="SharedSecretChallengeResponse"/>\r
+              <xs:element ref="SharedSecretDynamicPlaintext"/>\r
+              <xs:element ref="AsymmetricDecryption"/>\r
+              <xs:element ref="AsymmetricKeyAgreement"/>\r
+              <xs:element ref="ComplexAuthenticator"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="ComplexAuthenticatorType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="ComplexAuthenticatorType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SharedSecretChallengeResponse"/>\r
+              <xs:element ref="SharedSecretDynamicPlaintext"/>\r
+            </xs:choice>\r
+            <xs:element ref="Password"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SSL"/>\r
+              <xs:element ref="MobileNetworkNoEncryption"/>\r
+              <xs:element ref="MobileNetworkRadioEncryption"/>\r
+              <xs:element ref="MobileNetworkEndToEndEncryption"/>\r
+              <xs:element ref="WTLS"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="OperationalProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="OperationalProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="SecurityAudit"/>\r
+            <xs:element ref="DeactivationCallCenter"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="TechnicalProtectionBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TechnicalProtectionBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PrivateKeyProtection"/>\r
+              <xs:element ref="SecretKeyProtection"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrivateKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrivateKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyActivation"/>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="SecretKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecretKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyActivation"/>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="KeyStorageType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyStorageType">\r
+          <xs:attribute name="medium" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="mediumType">\r
+                <xs:enumeration value="MobileDevice"/>\r
+                <xs:enumeration value="MobileAuthCard"/>\r
+                <xs:enumeration value="smartcard"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="SecurityAuditType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SecurityAuditType">\r
+          <xs:sequence>\r
+            <xs:element ref="SwitchAudit"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="IdentificationType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="IdentificationType">\r
+          <xs:sequence>\r
+            <xs:element ref="GoverningAgreements"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="nym">\r
+            <xs:simpleType>\r
+              <xs:restriction base="nymType">\r
+                <xs:enumeration value="anonymity"/>\r
+                <xs:enumeration value="pseudonymity"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-nomad-telephony-2.0.xsd b/schemas/saml-schema-authn-context-nomad-telephony-2.0.xsd
new file mode 100644 (file)
index 0000000..c906514
--- /dev/null
+++ b/schemas/saml-schema-authn-context-nomad-telephony-2.0.xsd
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony\r
+        Document identifier: saml-schema-authn-context-nomad-telephony-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Password"/>\r
+            <xs:element ref="SubscriberLineNumber"/>\r
+            <xs:element ref="UserSuffix"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PSTN"/>\r
+              <xs:element ref="ISDN"/>\r
+              <xs:element ref="ADSL"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-personal-telephony-2.0.xsd b/schemas/saml-schema-authn-context-personal-telephony-2.0.xsd
new file mode 100644 (file)
index 0000000..bdb0f72
--- /dev/null
+++ b/schemas/saml-schema-authn-context-personal-telephony-2.0.xsd
@@ -0,0 +1,80 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalizedTelephony"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalizedTelephony"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalizedTelephony\r
+        Document identifier: saml-schema-authn-context-personal-telephony-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="SubscriberLineNumber"/>\r
+            <xs:element ref="UserSuffix"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PSTN"/>\r
+              <xs:element ref="ISDN"/>\r
+              <xs:element ref="ADSL"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-pgp-2.0.xsd b/schemas/saml-schema-authn-context-pgp-2.0.xsd
new file mode 100644 (file)
index 0000000..cbff52a
--- /dev/null
+++ b/schemas/saml-schema-authn-context-pgp-2.0.xsd
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:PGP"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:PGP"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PGP\r
+        Document identifier: saml-schema-authn-context-pgp-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="preauth" type="xs:integer" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="DigSig"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PublicKeyType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PublicKeyType">\r
+          <xs:attribute name="keyValidation" fixed="urn:oasis:names:tc:SAML:2.0:ac:classes:PGP"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-ppt-2.0.xsd b/schemas/saml-schema-authn-context-ppt-2.0.xsd
new file mode 100644 (file)
index 0000000..a0d9bcb
--- /dev/null
+++ b/schemas/saml-schema-authn-context-ppt-2.0.xsd
@@ -0,0 +1,81 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport\r
+        Document identifier: saml-schema-authn-context-ppt-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SSL"/>\r
+              <xs:element ref="MobileNetworkRadioEncryption"/>\r
+              <xs:element ref="MobileNetworkEndToEndEncryption"/>\r
+              <xs:element ref="WTLS"/>\r
+              <xs:element ref="IPSec"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-pword-2.0.xsd b/schemas/saml-schema-authn-context-pword-2.0.xsd
new file mode 100644 (file)
index 0000000..7c98cdd
--- /dev/null
+++ b/schemas/saml-schema-authn-context-pword-2.0.xsd
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:Password"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:Password"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Password\r
+        Document identifier: saml-schema-authn-context-pword-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-session-2.0.xsd b/schemas/saml-schema-authn-context-session-2.0.xsd
new file mode 100644 (file)
index 0000000..c7340bf
--- /dev/null
+++ b/schemas/saml-schema-authn-context-session-2.0.xsd
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession\r
+        Document identifier: saml-schema-authn-context-session-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PreviousSession"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-smartcard-2.0.xsd b/schemas/saml-schema-authn-context-smartcard-2.0.xsd
new file mode 100644 (file)
index 0000000..64a7479
--- /dev/null
+++ b/schemas/saml-schema-authn-context-smartcard-2.0.xsd
@@ -0,0 +1,64 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard\r
+        Document identifier: saml-schema-authn-context-smartcard-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="Smartcard"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+  \r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-smartcardpki-2.0.xsd b/schemas/saml-schema-authn-context-smartcardpki-2.0.xsd
new file mode 100644 (file)
index 0000000..bb6474d
--- /dev/null
+++ b/schemas/saml-schema-authn-context-smartcardpki-2.0.xsd
@@ -0,0 +1,129 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI\r
+        Document identifier: saml-schema-authn-context-smartcardpki-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="TechnicalProtectionBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TechnicalProtectionBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PrivateKeyProtection"/>\r
+            </xs:choice>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="Smartcard"/>\r
+            <xs:element ref="ActivationPin"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="DigSig"/>\r
+              <xs:element ref="AsymmetricDecryption"/>\r
+              <xs:element ref="AsymmetricKeyAgreement"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="PrivateKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrivateKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyActivation"/>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="KeyActivationType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyActivationType">\r
+          <xs:sequence>\r
+            <xs:element ref="ActivationPin"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="KeyStorageType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyStorageType">\r
+          <xs:attribute name="medium" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="mediumType">\r
+                <xs:enumeration value="smartcard"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-softwarepki-2.0.xsd b/schemas/saml-schema-authn-context-softwarepki-2.0.xsd
new file mode 100644 (file)
index 0000000..2054a81
--- /dev/null
+++ b/schemas/saml-schema-authn-context-softwarepki-2.0.xsd
@@ -0,0 +1,129 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI\r
+        Document identifier: saml-schema-authn-context-softwarepki-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="TechnicalProtectionBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TechnicalProtectionBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PrivateKeyProtection"/>\r
+            </xs:choice>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="ActivationPin"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="DigSig"/>\r
+              <xs:element ref="AsymmetricDecryption"/>\r
+              <xs:element ref="AsymmetricKeyAgreement"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrivateKeyProtectionType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrivateKeyProtectionType">\r
+          <xs:sequence>\r
+            <xs:element ref="KeyActivation"/>\r
+            <xs:element ref="KeyStorage"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="KeyActivationType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyActivationType">\r
+          <xs:sequence>\r
+            <xs:element ref="ActivationPin"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="KeyStorageType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="KeyStorageType">\r
+          <xs:attribute name="medium" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="mediumType">\r
+                <xs:enumeration value="memory"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-spki-2.0.xsd b/schemas/saml-schema-authn-context-spki-2.0.xsd
new file mode 100644 (file)
index 0000000..698c7c6
--- /dev/null
+++ b/schemas/saml-schema-authn-context-spki-2.0.xsd
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI\r
+        Document identifier: saml-schema-authn-context-spki-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="preauth" type="xs:integer" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="DigSig"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PublicKeyType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PublicKeyType">\r
+          <xs:attribute name="keyValidation" fixed="urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-srp-2.0.xsd b/schemas/saml-schema-authn-context-srp-2.0.xsd
new file mode 100644 (file)
index 0000000..07c6ae4
--- /dev/null
+++ b/schemas/saml-schema-authn-context-srp-2.0.xsd
@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword\r
+        Document identifier: saml-schema-authn-context-srp-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="SharedSecretChallengeResponse"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="SharedSecretChallengeResponseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="SharedSecretChallengeResponseType">\r
+          <xs:attribute name="method" type="xs:anyURI" fixed="urn:ietf:rfc:2945"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-sslcert-2.0.xsd b/schemas/saml-schema-authn-context-sslcert-2.0.xsd
new file mode 100644 (file)
index 0000000..88a4f17
--- /dev/null
+++ b/schemas/saml-schema-authn-context-sslcert-2.0.xsd
@@ -0,0 +1,97 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient\r
+        Document identifier: saml-schema-authn-context-sslcert-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="preauth" type="xs:integer" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="DigSig"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="PublicKeyType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PublicKeyType">\r
+          <xs:attribute name="keyValidation" type="xs:anyURI" fixed="urn:oasis:names:tc:SAML:2.0:ac:classes:X509"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="SSL"/>            \r
+              <xs:element ref="WTLS"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-telephony-2.0.xsd b/schemas/saml-schema-authn-context-telephony-2.0.xsd
new file mode 100644 (file)
index 0000000..e4906c5
--- /dev/null
+++ b/schemas/saml-schema-authn-context-telephony-2.0.xsd
@@ -0,0 +1,79 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony\r
+        Document identifier: saml-schema-authn-context-telephony-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="SubscriberLineNumber"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorTransportProtocolType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorTransportProtocolType">\r
+          <xs:sequence>\r
+            <xs:choice>\r
+              <xs:element ref="PSTN"/>\r
+              <xs:element ref="ISDN"/>\r
+              <xs:element ref="ADSL"/>\r
+            </xs:choice>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>
\ No newline at end of file

diff --git a/schemas/saml-schema-authn-context-timesync-2.0.xsd b/schemas/saml-schema-authn-context-timesync-2.0.xsd
new file mode 100644 (file)
index 0000000..53b425f
--- /dev/null
+++ b/schemas/saml-schema-authn-context-timesync-2.0.xsd
@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken\r
+        Document identifier: saml-schema-authn-context-timesync-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="Token"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="TokenType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TokenType">\r
+          <xs:sequence>\r
+            <xs:element ref="TimeSyncToken"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="TimeSyncTokenType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="TimeSyncTokenType">\r
+          <xs:attribute name="DeviceType" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="DeviceTypeType">\r
+                <xs:enumeration value="hardware"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+\r
+          <xs:attribute name="SeedLength" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="xs:integer">\r
+                <xs:minInclusive value="64"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+\r
+          <xs:attribute name="DeviceInHand" use="required">\r
+            <xs:simpleType>\r
+              <xs:restriction base="booleanType">\r
+                <xs:enumeration value="true"/>\r
+              </xs:restriction>\r
+            </xs:simpleType>\r
+          </xs:attribute>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-types-2.0.xsd b/schemas/saml-schema-authn-context-types-2.0.xsd
new file mode 100644 (file)
index 0000000..6ae1875
--- /dev/null
+++ b/schemas/saml-schema-authn-context-types-2.0.xsd
@@ -0,0 +1,821 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<xs:schema \r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema"\r
+  elementFormDefault="qualified"\r
+  version="2.0">\r
+\r
+  <xs:annotation>\r
+    <xs:documentation>\r
+      Document identifier: saml-schema-authn-context-types-2.0\r
+      Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+      Revision history:\r
+          V2.0 (March, 2005):\r
+          New core authentication context schema types for SAML V2.0. \r
+    </xs:documentation>\r
+  </xs:annotation>\r
+\r
+  <xs:element name="AuthenticationContextDeclaration" type="AuthnContextDeclarationBaseType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        A particular assertion on an identity\r
+        provider's part with respect to the authentication\r
+        context associated with an authentication assertion.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="Identification" type="IdentificationType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Refers to those characteristics that describe the\r
+        processes and mechanisms\r
+        the Authentication Authority uses to initially create\r
+        an association between a Principal\r
+        and the identity (or name) by which the Principal will\r
+        be known\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="PhysicalVerification">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that identification has been\r
+        performed in a physical\r
+        face-to-face meeting with the principal and not in an\r
+        online manner.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+    <xs:complexType>\r
+      <xs:attribute name="credentialLevel">\r
+        <xs:simpleType>\r
+          <xs:restriction base="xs:NMTOKEN">\r
+            <xs:enumeration value="primary"/>\r
+            <xs:enumeration value="secondary"/>\r
+          </xs:restriction>\r
+        </xs:simpleType>\r
+      </xs:attribute>\r
+    </xs:complexType>\r
+  </xs:element>\r
+\r
+  <xs:element name="WrittenConsent" type="ExtensionOnlyType"/>\r
+\r
+  <xs:element name="TechnicalProtection" type="TechnicalProtectionBaseType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Refers to those characterstics that describe how the\r
+        'secret' (the knowledge or possession\r
+        of which allows the Principal to authenticate to the\r
+        Authentication Authority) is kept secure\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="SecretKeyProtection" type="SecretKeyProtectionType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates the types and strengths of\r
+        facilities\r
+        of a UA used to protect a shared secret key from\r
+        unauthorized access and/or use.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="PrivateKeyProtection" type="PrivateKeyProtectionType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates the types and strengths of\r
+        facilities\r
+        of a UA used to protect a private key from\r
+        unauthorized access and/or use.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="KeyActivation" type="KeyActivationType">\r
+    <xs:annotation>\r
+      <xs:documentation>The actions that must be performed\r
+        before the private key can be used. </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="KeySharing" type="KeySharingType">\r
+    <xs:annotation>\r
+      <xs:documentation>Whether or not the private key is shared\r
+        with the certificate authority.</xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="KeyStorage" type="KeyStorageType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        In which medium is the key stored.\r
+        memory - the key is stored in memory.\r
+        smartcard - the key is stored in a smartcard.\r
+        token - the key is stored in a hardware token.\r
+        MobileDevice - the key is stored in a mobile device.\r
+        MobileAuthCard - the key is stored in a mobile\r
+        authentication card.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="SubscriberLineNumber" type="ExtensionOnlyType"/>\r
+  <xs:element name="UserSuffix" type="ExtensionOnlyType"/>\r
+\r
+  <xs:element name="Password" type="PasswordType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that a password (or passphrase)\r
+        has been used to\r
+        authenticate the Principal to a remote system.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="ActivationPin" type="ActivationPinType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that a Pin (Personal\r
+        Identification Number) has been used to authenticate the Principal to\r
+        some local system in order to activate a key.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="Token" type="TokenType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that a hardware or software\r
+        token is used\r
+        as a method of identifying the Principal.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="TimeSyncToken" type="TimeSyncTokenType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that a time synchronization\r
+        token is used to identify the Principal. hardware -\r
+        the time synchonization\r
+        token has been implemented in hardware. software - the\r
+        time synchronization\r
+        token has been implemented in software. SeedLength -\r
+        the length, in bits, of the\r
+        random seed used in the time synchronization token.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="Smartcard" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that a smartcard is used to\r
+        identity the Principal.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="Length" type="LengthType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates the minimum and/or maximum\r
+        ASCII length of the password which is enforced (by the UA or the\r
+        IdP). In other words, this is the minimum and/or maximum number of\r
+        ASCII characters required to represent a valid password.\r
+        min - the minimum number of ASCII characters required\r
+        in a valid password, as enforced by the UA or the IdP.\r
+        max - the maximum number of ASCII characters required\r
+        in a valid password, as enforced by the UA or the IdP.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="ActivationLimit" type="ActivationLimitType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates the length of time for which an\r
+        PIN-based authentication is valid.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="Generation">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Indicates whether the password was chosen by the\r
+        Principal or auto-supplied by the Authentication Authority.\r
+        principalchosen - the Principal is allowed to choose\r
+        the value of the password. This is true even if\r
+        the initial password is chosen at random by the UA or\r
+        the IdP and the Principal is then free to change\r
+        the password.\r
+        automatic - the password is chosen by the UA or the\r
+        IdP to be cryptographically strong in some sense,\r
+        or to satisfy certain password rules, and that the\r
+        Principal is not free to change it or to choose a new password.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType>\r
+      <xs:attribute name="mechanism" use="required">\r
+        <xs:simpleType>\r
+          <xs:restriction base="xs:NMTOKEN">\r
+            <xs:enumeration value="principalchosen"/>\r
+            <xs:enumeration value="automatic"/>\r
+          </xs:restriction>\r
+        </xs:simpleType>\r
+      </xs:attribute>\r
+    </xs:complexType>\r
+  </xs:element>\r
+\r
+  <xs:element name="AuthnMethod" type="AuthnMethodBaseType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Refers to those characteristics that define the\r
+        mechanisms by which the Principal authenticates to the Authentication\r
+        Authority.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="PrincipalAuthenticationMechanism" type="PrincipalAuthenticationMechanismType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        The method that a Principal employs to perform\r
+        authentication to local system components.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="Authenticator" type="AuthenticatorBaseType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        The method applied to validate a principal's\r
+        authentication across a network\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="ComplexAuthenticator" type="ComplexAuthenticatorType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Supports Authenticators with nested combinations of\r
+        additional complexity.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="PreviousSession" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Indicates that the Principal has been strongly\r
+        authenticated in a previous session during which the IdP has set a\r
+        cookie in the UA. During the present session the Principal has only\r
+        been authenticated by the UA returning the cookie to the IdP.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="ResumeSession" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Rather like PreviousSession but using stronger\r
+        security. A secret that was established in a previous session with\r
+        the Authentication Authority has been cached by the local system and\r
+        is now re-used (e.g. a Master Secret is used to derive new session\r
+        keys in TLS, SSL, WTLS).\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="ZeroKnowledge" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Principal has been\r
+        authenticated by a zero knowledge technique as specified in ISO/IEC\r
+        9798-5.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="SharedSecretChallengeResponse" type="SharedSecretChallengeResponseType"/>\r
+\r
+  <xs:complexType name="SharedSecretChallengeResponseType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Principal has been\r
+        authenticated by a challenge-response protocol utilizing shared secret\r
+        keys and symmetric cryptography.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+    <xs:sequence>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+    <xs:attribute name="method" type="xs:anyURI" use="optional"/>\r
+  </xs:complexType>\r
+\r
+  <xs:element name="DigSig" type="PublicKeyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Principal has been\r
+        authenticated by a mechanism which involves the Principal computing a\r
+        digital signature over at least challenge data provided by the IdP.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="AsymmetricDecryption" type="PublicKeyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        The local system has a private key but it is used\r
+        in decryption mode, rather than signature mode. For example, the\r
+        Authentication Authority generates a secret and encrypts it using the\r
+        local system's public key: the local system then proves it has\r
+        decrypted the secret.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="AsymmetricKeyAgreement" type="PublicKeyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        The local system has a private key and uses it for\r
+        shared secret key agreement with the Authentication Authority (e.g.\r
+        via Diffie Helman).\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:complexType name="PublicKeyType">\r
+    <xs:sequence>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+    <xs:attribute name="keyValidation" use="optional"/>\r
+  </xs:complexType>\r
+\r
+  <xs:element name="IPAddress" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Principal has been\r
+        authenticated through connection from a particular IP address.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="SharedSecretDynamicPlaintext" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        The local system and Authentication Authority\r
+        share a secret key. The local system uses this to encrypt a\r
+        randomised string to pass to the Authentication Authority.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="AuthenticatorTransportProtocol" type="AuthenticatorTransportProtocolType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        The protocol across which Authenticator information is\r
+        transferred to an Authentication Authority verifier.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="HTTP" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Authenticator has been\r
+        transmitted using bare HTTP utilizing no additional security\r
+        protocols.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="IPSec" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Authenticator has been\r
+        transmitted using a transport mechanism protected by an IPSEC session.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  \r
+  <xs:element name="WTLS" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Authenticator has been\r
+        transmitted using a transport mechanism protected by a WTLS session.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="MobileNetworkNoEncryption" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Authenticator has been\r
+        transmitted solely across a mobile network using no additional\r
+        security mechanism.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="MobileNetworkRadioEncryption" type="ExtensionOnlyType"/>\r
+  <xs:element name="MobileNetworkEndToEndEncryption" type="ExtensionOnlyType"/>\r
+\r
+  <xs:element name="SSL" type="ExtensionOnlyType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Authenticator has been\r
+        transmitted using a transport mechnanism protected by an SSL or TLS\r
+        session.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  \r
+  <xs:element name="PSTN" type="ExtensionOnlyType"/>\r
+  <xs:element name="ISDN" type="ExtensionOnlyType"/>\r
+  <xs:element name="ADSL" type="ExtensionOnlyType"/>\r
+\r
+  <xs:element name="OperationalProtection" type="OperationalProtectionType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Refers to those characteristics that describe\r
+        procedural security controls employed by the Authentication Authority.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="SecurityAudit" type="SecurityAuditType"/>\r
+  <xs:element name="SwitchAudit" type="ExtensionOnlyType"/>\r
+  <xs:element name="DeactivationCallCenter" type="ExtensionOnlyType"/>\r
+\r
+  <xs:element name="GoverningAgreements" type="GoverningAgreementsType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        Provides a mechanism for linking to external (likely\r
+        human readable) documents in which additional business agreements,\r
+        (e.g. liability constraints, obligations, etc) can be placed.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+\r
+  <xs:element name="GoverningAgreementRef" type="GoverningAgreementRefType"/>\r
+\r
+  <xs:simpleType name="nymType">\r
+    <xs:restriction base="xs:NMTOKEN">\r
+      <xs:enumeration value="anonymity"/>\r
+      <xs:enumeration value="verinymity"/>\r
+      <xs:enumeration value="pseudonymity"/>\r
+    </xs:restriction>\r
+  </xs:simpleType>\r
+\r
+  <xs:complexType name="AuthnContextDeclarationBaseType">\r
+    <xs:sequence>\r
+      <xs:element ref="Identification" minOccurs="0"/>\r
+      <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+      <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+      <xs:element ref="AuthnMethod" minOccurs="0"/>\r
+      <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+    <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="IdentificationType">\r
+    <xs:sequence>\r
+      <xs:element ref="PhysicalVerification" minOccurs="0"/>\r
+      <xs:element ref="WrittenConsent" minOccurs="0"/>\r
+      <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+    <xs:attribute name="nym" type="nymType">\r
+      <xs:annotation>\r
+        <xs:documentation>\r
+          This attribute indicates whether or not the\r
+          Identification mechanisms allow the actions of the Principal to be\r
+          linked to an actual end user.\r
+        </xs:documentation>\r
+      </xs:annotation>\r
+    </xs:attribute>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="TechnicalProtectionBaseType">\r
+    <xs:sequence>\r
+      <xs:choice minOccurs="0">\r
+        <xs:element ref="PrivateKeyProtection"/>\r
+        <xs:element ref="SecretKeyProtection"/>\r
+      </xs:choice>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="OperationalProtectionType">\r
+    <xs:sequence>\r
+      <xs:element ref="SecurityAudit" minOccurs="0"/>\r
+      <xs:element ref="DeactivationCallCenter" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="AuthnMethodBaseType">\r
+    <xs:sequence>\r
+      <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>\r
+      <xs:element ref="Authenticator" minOccurs="0"/>\r
+      <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="GoverningAgreementsType">\r
+    <xs:sequence>\r
+      <xs:element ref="GoverningAgreementRef" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="GoverningAgreementRefType">\r
+    <xs:attribute name="governingAgreementRef" type="xs:anyURI" use="required"/>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+    <xs:sequence>\r
+      <xs:element ref="Password" minOccurs="0"/>\r
+      <xs:element ref="RestrictedPassword" minOccurs="0"/>\r
+      <xs:element ref="Token" minOccurs="0"/>\r
+      <xs:element ref="Smartcard" minOccurs="0"/>\r
+      <xs:element ref="ActivationPin" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+    <xs:attribute name="preauth" type="xs:integer" use="optional"/>\r
+  </xs:complexType>\r
+  \r
+  <xs:group name="AuthenticatorChoiceGroup">\r
+    <xs:choice>\r
+      <xs:element ref="PreviousSession"/>\r
+      <xs:element ref="ResumeSession"/>\r
+      <xs:element ref="DigSig"/>\r
+      <xs:element ref="Password"/>\r
+      <xs:element ref="RestrictedPassword"/>\r
+      <xs:element ref="ZeroKnowledge"/>\r
+      <xs:element ref="SharedSecretChallengeResponse"/>\r
+      <xs:element ref="SharedSecretDynamicPlaintext"/>\r
+      <xs:element ref="IPAddress"/>\r
+      <xs:element ref="AsymmetricDecryption"/>\r
+      <xs:element ref="AsymmetricKeyAgreement"/>\r
+      <xs:element ref="SubscriberLineNumber"/>\r
+      <xs:element ref="UserSuffix"/>\r
+      <xs:element ref="ComplexAuthenticator"/>\r
+    </xs:choice>\r
+  </xs:group>\r
+  \r
+  <xs:group name="AuthenticatorSequenceGroup">\r
+    <xs:sequence>\r
+      <xs:element ref="PreviousSession" minOccurs="0"/>\r
+      <xs:element ref="ResumeSession" minOccurs="0"/>\r
+      <xs:element ref="DigSig" minOccurs="0"/>\r
+      <xs:element ref="Password" minOccurs="0"/>\r
+      <xs:element ref="RestrictedPassword" minOccurs="0"/>\r
+      <xs:element ref="ZeroKnowledge" minOccurs="0"/>\r
+      <xs:element ref="SharedSecretChallengeResponse" minOccurs="0"/>\r
+      <xs:element ref="SharedSecretDynamicPlaintext" minOccurs="0"/>\r
+      <xs:element ref="IPAddress" minOccurs="0"/>\r
+      <xs:element ref="AsymmetricDecryption" minOccurs="0"/>\r
+      <xs:element ref="AsymmetricKeyAgreement" minOccurs="0"/>\r
+      <xs:element ref="SubscriberLineNumber" minOccurs="0"/>\r
+      <xs:element ref="UserSuffix" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:group>\r
+\r
+  <xs:complexType name="AuthenticatorBaseType">\r
+    <xs:sequence>\r
+      <xs:group ref="AuthenticatorChoiceGroup"/>\r
+      <xs:group ref="AuthenticatorSequenceGroup"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="ComplexAuthenticatorType">\r
+    <xs:sequence>\r
+      <xs:group ref="AuthenticatorChoiceGroup"/>\r
+      <xs:group ref="AuthenticatorSequenceGroup"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="AuthenticatorTransportProtocolType">\r
+    <xs:sequence>\r
+      <xs:choice minOccurs="0">\r
+        <xs:element ref="HTTP"/>\r
+        <xs:element ref="SSL"/>\r
+        <xs:element ref="MobileNetworkNoEncryption"/>\r
+        <xs:element ref="MobileNetworkRadioEncryption"/>\r
+        <xs:element ref="MobileNetworkEndToEndEncryption"/>\r
+        <xs:element ref="WTLS"/>\r
+        <xs:element ref="IPSec"/>\r
+        <xs:element ref="PSTN"/>\r
+        <xs:element ref="ISDN"/>\r
+        <xs:element ref="ADSL"/>\r
+      </xs:choice>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="KeyActivationType">\r
+    <xs:sequence>\r
+      <xs:element ref="ActivationPin" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="KeySharingType">\r
+    <xs:attribute name="sharing" type="xs:boolean" use="required"/>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="PrivateKeyProtectionType">\r
+    <xs:sequence>\r
+      <xs:element ref="KeyActivation" minOccurs="0"/>\r
+      <xs:element ref="KeyStorage" minOccurs="0"/>\r
+      <xs:element ref="KeySharing" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="PasswordType">\r
+    <xs:sequence>\r
+      <xs:element ref="Length" minOccurs="0"/>\r
+      <xs:element ref="Alphabet" minOccurs="0"/>\r
+      <xs:element ref="Generation" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+    <xs:attribute name="ExternalVerification" type="xs:anyURI" use="optional"/>\r
+  </xs:complexType>\r
+\r
+  <xs:element name="RestrictedPassword" type="RestrictedPasswordType"/>\r
+\r
+  <xs:complexType name="RestrictedPasswordType">\r
+    <xs:complexContent>\r
+      <xs:restriction base="PasswordType">\r
+        <xs:sequence>\r
+          <xs:element name="Length" type="RestrictedLengthType" minOccurs="1"/>\r
+          <xs:element ref="Generation" minOccurs="0"/>\r
+          <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+        </xs:sequence>\r
+        <xs:attribute name="ExternalVerification" type="xs:anyURI" use="optional"/>\r
+      </xs:restriction>\r
+    </xs:complexContent>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="RestrictedLengthType">\r
+    <xs:complexContent>\r
+      <xs:restriction base="LengthType">\r
+        <xs:attribute name="min" use="required">\r
+          <xs:simpleType>\r
+            <xs:restriction base="xs:integer">\r
+              <xs:minInclusive value="3"/>\r
+            </xs:restriction>\r
+          </xs:simpleType>\r
+        </xs:attribute>\r
+        <xs:attribute name="max" type="xs:integer" use="optional"/>\r
+      </xs:restriction>\r
+    </xs:complexContent>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="ActivationPinType">\r
+    <xs:sequence>\r
+      <xs:element ref="Length" minOccurs="0"/>\r
+      <xs:element ref="Alphabet" minOccurs="0"/>\r
+      <xs:element ref="Generation" minOccurs="0"/>\r
+      <xs:element ref="ActivationLimit" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+  \r
+  <xs:element name="Alphabet" type="AlphabetType"/>\r
+  <xs:complexType name="AlphabetType">\r
+    <xs:attribute name="requiredChars" type="xs:string" use="required"/>\r
+    <xs:attribute name="excludedChars" type="xs:string" use="optional"/>\r
+    <xs:attribute name="case" type="xs:string" use="optional"/>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="TokenType">\r
+    <xs:sequence>\r
+      <xs:element ref="TimeSyncToken"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+  \r
+  <xs:simpleType name="DeviceTypeType">\r
+    <xs:restriction base="xs:NMTOKEN">\r
+      <xs:enumeration value="hardware"/>\r
+      <xs:enumeration value="software"/>\r
+    </xs:restriction>\r
+  </xs:simpleType>\r
+  \r
+  <xs:simpleType name="booleanType">\r
+    <xs:restriction base="xs:NMTOKEN">\r
+      <xs:enumeration value="true"/>\r
+      <xs:enumeration value="false"/>\r
+    </xs:restriction>\r
+  </xs:simpleType>\r
+  \r
+  <xs:complexType name="TimeSyncTokenType">\r
+    <xs:attribute name="DeviceType" type="DeviceTypeType" use="required"/>\r
+    <xs:attribute name="SeedLength" type="xs:integer" use="required"/>\r
+    <xs:attribute name="DeviceInHand" type="booleanType" use="required"/>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="ActivationLimitType">\r
+    <xs:choice>\r
+      <xs:element ref="ActivationLimitDuration"/>\r
+      <xs:element ref="ActivationLimitUsages"/>\r
+      <xs:element ref="ActivationLimitSession"/>\r
+    </xs:choice>\r
+  </xs:complexType>\r
+  \r
+  <xs:element name="ActivationLimitDuration" type="ActivationLimitDurationType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Key Activation Limit is\r
+        defined as a specific duration of time.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  \r
+  <xs:element name="ActivationLimitUsages" type="ActivationLimitUsagesType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Key Activation Limit is\r
+        defined as a number of usages.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  \r
+  <xs:element name="ActivationLimitSession" type="ActivationLimitSessionType">\r
+    <xs:annotation>\r
+      <xs:documentation>\r
+        This element indicates that the Key Activation Limit is\r
+        the session.\r
+      </xs:documentation>\r
+    </xs:annotation>\r
+  </xs:element>\r
+  \r
+  <xs:complexType name="ActivationLimitDurationType">\r
+    <xs:attribute name="duration" type="xs:duration" use="required"/>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="ActivationLimitUsagesType">\r
+    <xs:attribute name="number" type="xs:integer" use="required"/>\r
+  </xs:complexType>\r
+  \r
+  <xs:complexType name="ActivationLimitSessionType"/>\r
+  \r
+  <xs:complexType name="LengthType">\r
+    <xs:attribute name="min" type="xs:integer" use="required"/>\r
+    <xs:attribute name="max" type="xs:integer" use="optional"/>\r
+  </xs:complexType>\r
+\r
+  <xs:simpleType name="mediumType">\r
+    <xs:restriction base="xs:NMTOKEN">\r
+      <xs:enumeration value="memory"/>\r
+      <xs:enumeration value="smartcard"/>\r
+      <xs:enumeration value="token"/>\r
+      <xs:enumeration value="MobileDevice"/>\r
+      <xs:enumeration value="MobileAuthCard"/>\r
+    </xs:restriction>\r
+  </xs:simpleType>\r
+\r
+  <xs:complexType name="KeyStorageType">\r
+    <xs:attribute name="medium" type="mediumType" use="required"/>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="SecretKeyProtectionType">\r
+    <xs:sequence>\r
+      <xs:element ref="KeyActivation" minOccurs="0"/>\r
+      <xs:element ref="KeyStorage" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="SecurityAuditType">\r
+    <xs:sequence>\r
+      <xs:element ref="SwitchAudit" minOccurs="0"/>\r
+      <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="ExtensionOnlyType">\r
+    <xs:sequence>\r
+      <xs:element ref="Extension" minOccurs="0"  maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+  \r
+  <xs:element name="Extension" type="ExtensionType"/>\r
+\r
+  <xs:complexType name="ExtensionType">\r
+    <xs:sequence>\r
+      <xs:any namespace="##other" processContents="lax" maxOccurs="unbounded"/>\r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-x509-2.0.xsd b/schemas/saml-schema-authn-context-x509-2.0.xsd
new file mode 100644 (file)
index 0000000..7ea725f
--- /dev/null
+++ b/schemas/saml-schema-authn-context-x509-2.0.xsd
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:X509"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:X509"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:X509\r
+        Document identifier: saml-schema-authn-context-x509-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="preauth" type="xs:integer" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+    \r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="DigSig"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PublicKeyType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PublicKeyType">\r
+          <xs:attribute name="keyValidation" type="xs:anyURI" fixed="urn:oasis:names:tc:SAML:2.0:ac:classes:X509"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-authn-context-xmldsig-2.0.xsd b/schemas/saml-schema-authn-context-xmldsig-2.0.xsd
new file mode 100644 (file)
index 0000000..2616411
--- /dev/null
+++ b/schemas/saml-schema-authn-context-xmldsig-2.0.xsd
@@ -0,0 +1,83 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+\r
+<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig"\r
+  xmlns:xs="http://www.w3.org/2001/XMLSchema" \r
+  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig"\r
+  finalDefault="extension"\r
+  blockDefault="substitution"\r
+  version="2.0">\r
+\r
+  <xs:redefine schemaLocation="saml-schema-authn-context-types-2.0.xsd">\r
+\r
+    <xs:annotation>\r
+      <xs:documentation> \r
+        Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig\r
+        Document identifier: saml-schema-authn-context-xmldsig-2.0\r
+        Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+        Revision history:\r
+          V2.0 (March, 2005):\r
+            New authentication context class schema for SAML V2.0. \r
+      </xs:documentation>\r
+    </xs:annotation>\r
+\r
+    <xs:complexType name="AuthnContextDeclarationBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnContextDeclarationBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="Identification" minOccurs="0"/>\r
+            <xs:element ref="TechnicalProtection" minOccurs="0"/>\r
+            <xs:element ref="OperationalProtection" minOccurs="0"/>\r
+            <xs:element ref="AuthnMethod"/>\r
+            <xs:element ref="GoverningAgreements" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="ID" type="xs:ID" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthnMethodBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthnMethodBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="PrincipalAuthenticationMechanism"/>\r
+            <xs:element ref="Authenticator"/>\r
+            <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>\r
+            <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>    \r
+    \r
+    <xs:complexType name="PrincipalAuthenticationMechanismType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PrincipalAuthenticationMechanismType">\r
+          <xs:sequence>\r
+            <xs:element ref="RestrictedPassword"/>\r
+          </xs:sequence>\r
+          <xs:attribute name="preauth" type="xs:integer" use="optional"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="AuthenticatorBaseType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="AuthenticatorBaseType">\r
+          <xs:sequence>\r
+            <xs:element ref="DigSig"/>\r
+          </xs:sequence>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+    <xs:complexType name="PublicKeyType">\r
+      <xs:complexContent>\r
+        <xs:restriction base="PublicKeyType">\r
+          <xs:attribute name="keyValidation" type="xs:anyURI" fixed="urn:ietf:rfc:3075"/>\r
+        </xs:restriction>\r
+      </xs:complexContent>\r
+    </xs:complexType>\r
+\r
+  </xs:redefine>\r
+\r
+</xs:schema>\r

diff --git a/schemas/saml-schema-dce-2.0.xsd b/schemas/saml-schema-dce-2.0.xsd
new file mode 100644 (file)
index 0000000..719dfe9
--- /dev/null
+++ b/schemas/saml-schema-dce-2.0.xsd
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<schema targetNamespace="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE"\r
+    xmlns:dce="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE"\r
+    xmlns="http://www.w3.org/2001/XMLSchema"\r
+    elementFormDefault="unqualified"\r
+    attributeFormDefault="unqualified"\r
+    blockDefault="substitution"\r
+    version="2.0">\r
+    <annotation>\r
+        <documentation>\r
+            Document identifier: saml-schema-dce-2.0\r
+            Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+            Revision history:\r
+            V2.0 (March, 2005):\r
+                Custom schema for DCE attribute profile, first published in SAML 2.0.\r
+        </documentation>\r
+    </annotation>\r
+    <complexType name="DCEValueType">\r
+        <simpleContent>\r
+            <extension base="anyURI">\r
+                <attribute ref="dce:Realm" use="optional"/>\r
+                <attribute ref="dce:FriendlyName" use="optional"/>\r
+            </extension>\r
+        </simpleContent>\r
+    </complexType>\r
+    <attribute name="Realm" type="anyURI"/>\r
+    <attribute name="FriendlyName" type="string"/>\r
+</schema>\r
+\r

diff --git a/schemas/saml-schema-ecp-2.0.xsd b/schemas/saml-schema-ecp-2.0.xsd
new file mode 100644 (file)
index 0000000..9eb457b
--- /dev/null
+++ b/schemas/saml-schema-ecp-2.0.xsd
@@ -0,0 +1,57 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<schema\r
+    targetNamespace="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"\r
+    xmlns="http://www.w3.org/2001/XMLSchema"\r
+    xmlns:ecp="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp"\r
+    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"\r
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"\r
+    xmlns:S="http://schemas.xmlsoap.org/soap/envelope/"\r
+    elementFormDefault="unqualified"\r
+    attributeFormDefault="unqualified"\r
+    blockDefault="substitution"\r
+    version="2.0">\r
+    <import namespace="urn:oasis:names:tc:SAML:2.0:protocol"\r
+        schemaLocation="saml-schema-protocol-2.0.xsd"/>\r
+    <import namespace="urn:oasis:names:tc:SAML:2.0:assertion"\r
+        schemaLocation="saml-schema-assertion-2.0.xsd"/>\r
+    <import namespace="http://schemas.xmlsoap.org/soap/envelope/"\r
+        schemaLocation="http://schemas.xmlsoap.org/soap/envelope/"/>\r
+    <annotation>\r
+        <documentation>\r
+            Document identifier: saml-schema-ecp-2.0\r
+            Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+            Revision history:\r
+              V2.0 (March, 2005):\r
+                Custom schema for ECP profile, first published in SAML 2.0.\r
+        </documentation>\r
+    </annotation>\r
+\r
+    <element name="Request" type="ecp:RequestType"/>\r
+    <complexType name="RequestType">\r
+        <sequence>\r
+            <element ref="saml:Issuer"/>\r
+            <element ref="samlp:IDPList" minOccurs="0"/>\r
+        </sequence>\r
+        <attribute ref="S:mustUnderstand" use="required"/>\r
+        <attribute ref="S:actor" use="required"/>\r
+        <attribute name="ProviderName" type="string" use="optional"/>\r
+        <attribute name="IsPassive" type="boolean" use="optional"/>\r
+    </complexType>\r
+    \r
+    <element name="Response" type="ecp:ResponseType"/>\r
+    <complexType name="ResponseType">\r
+        <attribute ref="S:mustUnderstand" use="required"/>\r
+        <attribute ref="S:actor" use="required"/>\r
+        <attribute name="AssertionConsumerServiceURL" type="anyURI" use="required"/>\r
+    </complexType>\r
+    \r
+    <element name="RelayState" type="ecp:RelayStateType"/>\r
+    <complexType name="RelayStateType">\r
+        <simpleContent>\r
+            <extension base="string">\r
+                <attribute ref="S:mustUnderstand" use="required"/>\r
+                <attribute ref="S:actor" use="required"/>\r
+            </extension>\r
+        </simpleContent>\r
+    </complexType>\r
+</schema>\r

diff --git a/schemas/saml-schema-metadata-2.0.xsd b/schemas/saml-schema-metadata-2.0.xsd
new file mode 100644 (file)
index 0000000..0d158c0
--- /dev/null
+++ b/schemas/saml-schema-metadata-2.0.xsd
@@ -0,0 +1,337 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<schema\r
+    targetNamespace="urn:oasis:names:tc:SAML:2.0:metadata"\r
+    xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"\r
+    xmlns:ds="http://www.w3.org/2000/09/xmldsig#"\r
+    xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"\r
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"\r
+    xmlns="http://www.w3.org/2001/XMLSchema"\r
+    elementFormDefault="unqualified"\r
+    attributeFormDefault="unqualified"\r
+    blockDefault="substitution"\r
+    version="2.0">\r
+    <import namespace="http://www.w3.org/2000/09/xmldsig#"\r
+        schemaLocation="http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"/>\r
+    <import namespace="http://www.w3.org/2001/04/xmlenc#"\r
+        schemaLocation="http://www.w3.org/TR/2002/REC-xmlenc-core-20021210/xenc-schema.xsd"/>\r
+    <import namespace="urn:oasis:names:tc:SAML:2.0:assertion"\r
+        schemaLocation="saml-schema-assertion-2.0.xsd"/>\r
+    <import namespace="http://www.w3.org/XML/1998/namespace"\r
+        schemaLocation="http://www.w3.org/2001/xml.xsd"/>\r
+    <annotation>\r
+        <documentation>\r
+            Document identifier: saml-schema-metadata-2.0\r
+            Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+            Revision history:\r
+              V2.0 (March, 2005):\r
+                Schema for SAML metadata, first published in SAML 2.0.\r
+        </documentation>\r
+    </annotation>\r
+\r
+    <simpleType name="entityIDType">\r
+        <restriction base="anyURI">\r
+            <maxLength value="1024"/>\r
+        </restriction>\r
+    </simpleType>\r
+    <complexType name="localizedNameType">\r
+        <simpleContent>\r
+            <extension base="string">\r
+                <attribute ref="xml:lang" use="required"/>\r
+            </extension>\r
+        </simpleContent>\r
+    </complexType>\r
+    <complexType name="localizedURIType">\r
+        <simpleContent>\r
+            <extension base="anyURI">\r
+                <attribute ref="xml:lang" use="required"/>\r
+            </extension>\r
+        </simpleContent>\r
+    </complexType>\r
+    \r
+    <element name="Extensions" type="md:ExtensionsType"/>\r
+    <complexType final="#all" name="ExtensionsType">\r
+        <sequence>\r
+            <any namespace="##other" processContents="lax" maxOccurs="unbounded"/>\r
+        </sequence>\r
+    </complexType>\r
+    \r
+    <complexType name="EndpointType">\r
+        <sequence>\r
+            <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="Binding" type="anyURI" use="required"/>\r
+        <attribute name="Location" type="anyURI" use="required"/>\r
+        <attribute name="ResponseLocation" type="anyURI" use="optional"/>\r
+        <anyAttribute namespace="##other" processContents="lax"/>\r
+    </complexType>\r
+    \r
+    <complexType name="IndexedEndpointType">\r
+        <complexContent>\r
+            <extension base="md:EndpointType">\r
+                <attribute name="index" type="unsignedShort" use="required"/>\r
+                <attribute name="isDefault" type="boolean" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    \r
+    <element name="EntitiesDescriptor" type="md:EntitiesDescriptorType"/>\r
+    <complexType name="EntitiesDescriptorType">\r
+        <sequence>\r
+            <element ref="ds:Signature" minOccurs="0"/>\r
+            <element ref="md:Extensions" minOccurs="0"/>\r
+            <choice minOccurs="1" maxOccurs="unbounded">\r
+                <element ref="md:EntityDescriptor"/>\r
+                <element ref="md:EntitiesDescriptor"/>\r
+            </choice>\r
+        </sequence>\r
+        <attribute name="validUntil" type="dateTime" use="optional"/>\r
+        <attribute name="cacheDuration" type="duration" use="optional"/>\r
+        <attribute name="ID" type="ID" use="optional"/>\r
+        <attribute name="Name" type="string" use="optional"/>\r
+    </complexType>\r
+\r
+    <element name="EntityDescriptor" type="md:EntityDescriptorType"/>\r
+    <complexType name="EntityDescriptorType">\r
+        <sequence>\r
+            <element ref="ds:Signature" minOccurs="0"/>\r
+            <element ref="md:Extensions" minOccurs="0"/>\r
+            <choice>\r
+                <choice maxOccurs="unbounded">\r
+                    <element ref="md:RoleDescriptor"/>\r
+                    <element ref="md:IDPSSODescriptor"/>\r
+                    <element ref="md:SPSSODescriptor"/>\r
+                    <element ref="md:AuthnAuthorityDescriptor"/>\r
+                    <element ref="md:AttributeAuthorityDescriptor"/>\r
+                    <element ref="md:PDPDescriptor"/>\r
+                </choice>\r
+                <element ref="md:AffiliationDescriptor"/>\r
+            </choice>\r
+            <element ref="md:Organization" minOccurs="0"/>\r
+            <element ref="md:ContactPerson" minOccurs="0" maxOccurs="unbounded"/>\r
+            <element ref="md:AdditionalMetadataLocation" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="entityID" type="md:entityIDType" use="required"/>\r
+        <attribute name="validUntil" type="dateTime" use="optional"/>\r
+        <attribute name="cacheDuration" type="duration" use="optional"/>\r
+        <attribute name="ID" type="ID" use="optional"/>\r
+        <anyAttribute namespace="##other" processContents="lax"/>\r
+    </complexType>\r
+    \r
+    <element name="Organization" type="md:OrganizationType"/>\r
+    <complexType name="OrganizationType">\r
+        <sequence>\r
+            <element ref="md:Extensions" minOccurs="0"/>\r
+            <element ref="md:OrganizationName" maxOccurs="unbounded"/>\r
+            <element ref="md:OrganizationDisplayName" maxOccurs="unbounded"/>\r
+            <element ref="md:OrganizationURL" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <anyAttribute namespace="##other" processContents="lax"/>\r
+    </complexType>\r
+    <element name="OrganizationName" type="md:localizedNameType"/>\r
+    <element name="OrganizationDisplayName" type="md:localizedNameType"/>\r
+    <element name="OrganizationURL" type="md:localizedURIType"/>\r
+    <element name="ContactPerson" type="md:ContactType"/>\r
+    <complexType name="ContactType">\r
+        <sequence>\r
+            <element ref="md:Extensions" minOccurs="0"/>\r
+            <element ref="md:Company" minOccurs="0"/>\r
+            <element ref="md:GivenName" minOccurs="0"/>\r
+            <element ref="md:SurName" minOccurs="0"/>\r
+            <element ref="md:EmailAddress" minOccurs="0" maxOccurs="unbounded"/>\r
+            <element ref="md:TelephoneNumber" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="contactType" type="md:ContactTypeType" use="required"/>\r
+        <anyAttribute namespace="##other" processContents="lax"/>\r
+    </complexType>\r
+    <element name="Company" type="string"/>\r
+    <element name="GivenName" type="string"/>\r
+    <element name="SurName" type="string"/>\r
+    <element name="EmailAddress" type="anyURI"/>\r
+    <element name="TelephoneNumber" type="string"/>\r
+    <simpleType name="ContactTypeType">\r
+        <restriction base="string">\r
+            <enumeration value="technical"/>\r
+            <enumeration value="support"/>\r
+            <enumeration value="administrative"/>\r
+            <enumeration value="billing"/>\r
+            <enumeration value="other"/>\r
+        </restriction>\r
+    </simpleType>\r
+\r
+    <element name="AdditionalMetadataLocation" type="md:AdditionalMetadataLocationType"/>\r
+    <complexType name="AdditionalMetadataLocationType">\r
+        <simpleContent>\r
+            <extension base="anyURI">\r
+                <attribute name="namespace" type="anyURI" use="required"/>\r
+            </extension>\r
+        </simpleContent>\r
+    </complexType>\r
+\r
+    <element name="RoleDescriptor" type="md:RoleDescriptorType"/>\r
+    <complexType name="RoleDescriptorType" abstract="true">\r
+        <sequence>\r
+            <element ref="ds:Signature" minOccurs="0"/>\r
+            <element ref="md:Extensions" minOccurs="0"/>\r
+            <element ref="md:KeyDescriptor" minOccurs="0" maxOccurs="unbounded"/>\r
+            <element ref="md:Organization" minOccurs="0"/>\r
+            <element ref="md:ContactPerson" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="ID" type="ID" use="optional"/>\r
+        <attribute name="validUntil" type="dateTime" use="optional"/>\r
+        <attribute name="cacheDuration" type="duration" use="optional"/>\r
+        <attribute name="protocolSupportEnumeration" type="md:anyURIListType" use="required"/>\r
+        <attribute name="errorURL" type="anyURI" use="optional"/>\r
+        <anyAttribute namespace="##other" processContents="lax"/>\r
+    </complexType>\r
+    <simpleType name="anyURIListType">\r
+        <list itemType="anyURI"/>\r
+    </simpleType>\r
+\r
+    <element name="KeyDescriptor" type="md:KeyDescriptorType"/>\r
+    <complexType name="KeyDescriptorType">\r
+        <sequence>\r
+            <element ref="ds:KeyInfo"/>\r
+            <element ref="md:EncryptionMethod" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="use" type="md:KeyTypes" use="optional"/>\r
+    </complexType>\r
+    <simpleType name="KeyTypes">\r
+        <restriction base="string">\r
+            <enumeration value="encryption"/>\r
+            <enumeration value="signing"/>\r
+        </restriction>\r
+    </simpleType>\r
+    <element name="EncryptionMethod" type="xenc:EncryptionMethodType"/>\r
+    \r
+    <complexType name="SSODescriptorType" abstract="true">\r
+        <complexContent>\r
+            <extension base="md:RoleDescriptorType">\r
+                <sequence>\r
+                    <element ref="md:ArtifactResolutionService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:SingleLogoutService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:ManageNameIDService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="ArtifactResolutionService" type="md:IndexedEndpointType"/>\r
+    <element name="SingleLogoutService" type="md:EndpointType"/>\r
+    <element name="ManageNameIDService" type="md:EndpointType"/>\r
+    <element name="NameIDFormat" type="anyURI"/>\r
+\r
+    <element name="IDPSSODescriptor" type="md:IDPSSODescriptorType"/>\r
+    <complexType name="IDPSSODescriptorType">\r
+        <complexContent>\r
+            <extension base="md:SSODescriptorType">\r
+                <sequence>\r
+                    <element ref="md:SingleSignOnService" maxOccurs="unbounded"/>\r
+                    <element ref="md:NameIDMappingService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:AssertionIDRequestService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:AttributeProfile" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="saml:Attribute" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+                <attribute name="WantAuthnRequestsSigned" type="boolean" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="SingleSignOnService" type="md:EndpointType"/>\r
+    <element name="NameIDMappingService" type="md:EndpointType"/>\r
+    <element name="AssertionIDRequestService" type="md:EndpointType"/>\r
+    <element name="AttributeProfile" type="anyURI"/>\r
+    \r
+    <element name="SPSSODescriptor" type="md:SPSSODescriptorType"/>\r
+    <complexType name="SPSSODescriptorType">\r
+        <complexContent>\r
+            <extension base="md:SSODescriptorType">\r
+                <sequence>\r
+                    <element ref="md:AssertionConsumerService" maxOccurs="unbounded"/>\r
+                    <element ref="md:AttributeConsumingService" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+                <attribute name="AuthnRequestsSigned" type="boolean" use="optional"/>\r
+                <attribute name="WantAssertionsSigned" type="boolean" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="AssertionConsumerService" type="md:IndexedEndpointType"/>\r
+    <element name="AttributeConsumingService" type="md:AttributeConsumingServiceType"/>\r
+    <complexType name="AttributeConsumingServiceType">\r
+        <sequence>\r
+            <element ref="md:ServiceName" maxOccurs="unbounded"/>\r
+            <element ref="md:ServiceDescription" minOccurs="0" maxOccurs="unbounded"/>\r
+            <element ref="md:RequestedAttribute" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="index" type="unsignedShort" use="required"/>\r
+        <attribute name="isDefault" type="boolean" use="optional"/>\r
+    </complexType>\r
+    <element name="ServiceName" type="md:localizedNameType"/>\r
+    <element name="ServiceDescription" type="md:localizedNameType"/>\r
+    <element name="RequestedAttribute" type="md:RequestedAttributeType"/>\r
+    <complexType name="RequestedAttributeType">\r
+        <complexContent>\r
+            <extension base="saml:AttributeType">\r
+                <attribute name="isRequired" type="boolean" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+  \r
+    <element name="AuthnAuthorityDescriptor" type="md:AuthnAuthorityDescriptorType"/>\r
+    <complexType name="AuthnAuthorityDescriptorType">\r
+        <complexContent>\r
+            <extension base="md:RoleDescriptorType">\r
+                <sequence>\r
+                    <element ref="md:AuthnQueryService" maxOccurs="unbounded"/>\r
+                    <element ref="md:AssertionIDRequestService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="AuthnQueryService" type="md:EndpointType"/>\r
+\r
+    <element name="PDPDescriptor" type="md:PDPDescriptorType"/>\r
+    <complexType name="PDPDescriptorType">\r
+        <complexContent>\r
+            <extension base="md:RoleDescriptorType">\r
+                <sequence>\r
+                    <element ref="md:AuthzService" maxOccurs="unbounded"/>\r
+                    <element ref="md:AssertionIDRequestService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="AuthzService" type="md:EndpointType"/>\r
+\r
+    <element name="AttributeAuthorityDescriptor" type="md:AttributeAuthorityDescriptorType"/>\r
+    <complexType name="AttributeAuthorityDescriptorType">\r
+        <complexContent>\r
+            <extension base="md:RoleDescriptorType">\r
+                <sequence>\r
+                    <element ref="md:AttributeService" maxOccurs="unbounded"/>\r
+                    <element ref="md:AssertionIDRequestService" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:NameIDFormat" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="md:AttributeProfile" minOccurs="0" maxOccurs="unbounded"/>\r
+                    <element ref="saml:Attribute" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="AttributeService" type="md:EndpointType"/>\r
+   \r
+    <element name="AffiliationDescriptor" type="md:AffiliationDescriptorType"/>\r
+    <complexType name="AffiliationDescriptorType">\r
+        <sequence>\r
+            <element ref="ds:Signature" minOccurs="0"/>\r
+            <element ref="md:Extensions" minOccurs="0"/>\r
+            <element ref="md:AffiliateMember" maxOccurs="unbounded"/>\r
+            <element ref="md:KeyDescriptor" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="affiliationOwnerID" type="md:entityIDType" use="required"/>\r
+        <attribute name="validUntil" type="dateTime" use="optional"/>\r
+        <attribute name="cacheDuration" type="duration" use="optional"/>\r
+        <attribute name="ID" type="ID" use="optional"/>\r
+        <anyAttribute namespace="##other" processContents="lax"/>\r
+    </complexType>\r
+    <element name="AffiliateMember" type="md:entityIDType"/>\r
+</schema>\r

diff --git a/schemas/saml-schema-protocol-2.0.xsd b/schemas/saml-schema-protocol-2.0.xsd
new file mode 100644 (file)
index 0000000..eb480e5
--- /dev/null
+++ b/schemas/saml-schema-protocol-2.0.xsd
@@ -0,0 +1,302 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<schema\r
+    targetNamespace="urn:oasis:names:tc:SAML:2.0:protocol"\r
+    xmlns="http://www.w3.org/2001/XMLSchema"\r
+    xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"\r
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"\r
+    xmlns:ds="http://www.w3.org/2000/09/xmldsig#"\r
+    elementFormDefault="unqualified"\r
+    attributeFormDefault="unqualified"\r
+    blockDefault="substitution"\r
+    version="2.0">\r
+    <import namespace="urn:oasis:names:tc:SAML:2.0:assertion"\r
+        schemaLocation="saml-schema-assertion-2.0.xsd"/>\r
+    <import namespace="http://www.w3.org/2000/09/xmldsig#"\r
+        schemaLocation="http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd"/>\r
+    <annotation>\r
+        <documentation>\r
+            Document identifier: saml-schema-protocol-2.0\r
+            Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+            Revision history:\r
+            V1.0 (November, 2002):\r
+              Initial Standard Schema.\r
+            V1.1 (September, 2003):\r
+              Updates within the same V1.0 namespace.\r
+            V2.0 (March, 2005):\r
+              New protocol schema based in a SAML V2.0 namespace.\r
+     </documentation>\r
+    </annotation>\r
+    <complexType name="RequestAbstractType" abstract="true">\r
+        <sequence>\r
+            <element ref="saml:Issuer" minOccurs="0"/>\r
+            <element ref="ds:Signature" minOccurs="0"/>\r
+            <element ref="samlp:Extensions" minOccurs="0"/>\r
+        </sequence>\r
+        <attribute name="ID" type="ID" use="required"/>\r
+        <attribute name="Version" type="string" use="required"/>\r
+        <attribute name="IssueInstant" type="dateTime" use="required"/>\r
+        <attribute name="Destination" type="anyURI" use="optional"/>\r
+       <attribute name="Consent" type="anyURI" use="optional"/>\r
+    </complexType>\r
+    <element name="Extensions" type="samlp:ExtensionsType"/>\r
+    <complexType name="ExtensionsType">\r
+        <sequence>\r
+            <any namespace="##other" processContents="lax" maxOccurs="unbounded"/>\r
+        </sequence>\r
+    </complexType>\r
+    <complexType name="StatusResponseType">\r
+       <sequence>\r
+            <element ref="saml:Issuer" minOccurs="0"/>\r
+            <element ref="ds:Signature" minOccurs="0"/>\r
+            <element ref="samlp:Extensions" minOccurs="0"/>\r
+            <element ref="samlp:Status"/>\r
+       </sequence>\r
+       <attribute name="ID" type="ID" use="required"/>\r
+       <attribute name="InResponseTo" type="NCName" use="optional"/>\r
+       <attribute name="Version" type="string" use="required"/>\r
+       <attribute name="IssueInstant" type="dateTime" use="required"/>\r
+       <attribute name="Destination" type="anyURI" use="optional"/>\r
+       <attribute name="Consent" type="anyURI" use="optional"/>\r
+    </complexType>\r
+    <element name="Status" type="samlp:StatusType"/>\r
+    <complexType name="StatusType">\r
+        <sequence>\r
+            <element ref="samlp:StatusCode"/>\r
+            <element ref="samlp:StatusMessage" minOccurs="0"/>\r
+            <element ref="samlp:StatusDetail" minOccurs="0"/>\r
+        </sequence>\r
+    </complexType>\r
+    <element name="StatusCode" type="samlp:StatusCodeType"/>\r
+    <complexType name="StatusCodeType">\r
+        <sequence>\r
+            <element ref="samlp:StatusCode" minOccurs="0"/>\r
+        </sequence>\r
+        <attribute name="Value" type="anyURI" use="required"/>\r
+    </complexType>\r
+    <element name="StatusMessage" type="string"/>\r
+    <element name="StatusDetail" type="samlp:StatusDetailType"/>\r
+    <complexType name="StatusDetailType">\r
+        <sequence>\r
+            <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+    </complexType>\r
+    <element name="AssertionIDRequest" type="samlp:AssertionIDRequestType"/>\r
+    <complexType name="AssertionIDRequestType">\r
+       <complexContent>\r
+            <extension base="samlp:RequestAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:AssertionIDRef" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </extension>\r
+       </complexContent>\r
+    </complexType>\r
+    <element name="SubjectQuery" type="samlp:SubjectQueryAbstractType"/>\r
+    <complexType name="SubjectQueryAbstractType" abstract="true">\r
+       <complexContent>\r
+            <extension base="samlp:RequestAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:Subject"/>\r
+                </sequence>\r
+            </extension>\r
+       </complexContent>\r
+    </complexType>\r
+    <element name="AuthnQuery" type="samlp:AuthnQueryType"/>\r
+    <complexType name="AuthnQueryType">\r
+        <complexContent>\r
+            <extension base="samlp:SubjectQueryAbstractType">\r
+                <sequence>\r
+                    <element ref="samlp:RequestedAuthnContext" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="SessionIndex" type="string" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="RequestedAuthnContext" type="samlp:RequestedAuthnContextType"/>\r
+    <complexType name="RequestedAuthnContextType">\r
+        <choice>\r
+            <element ref="saml:AuthnContextClassRef" maxOccurs="unbounded"/>\r
+            <element ref="saml:AuthnContextDeclRef" maxOccurs="unbounded"/>\r
+        </choice>\r
+        <attribute name="Comparison" type="samlp:AuthnContextComparisonType" use="optional"/>\r
+    </complexType>\r
+    <simpleType name="AuthnContextComparisonType">\r
+        <restriction base="string">\r
+            <enumeration value="exact"/>\r
+            <enumeration value="minimum"/>\r
+            <enumeration value="maximum"/>\r
+            <enumeration value="better"/>\r
+        </restriction>\r
+    </simpleType>\r
+    <element name="AttributeQuery" type="samlp:AttributeQueryType"/>\r
+    <complexType name="AttributeQueryType">\r
+        <complexContent>\r
+            <extension base="samlp:SubjectQueryAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:Attribute" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="AuthzDecisionQuery" type="samlp:AuthzDecisionQueryType"/>\r
+    <complexType name="AuthzDecisionQueryType">\r
+        <complexContent>\r
+            <extension base="samlp:SubjectQueryAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:Action" maxOccurs="unbounded"/>\r
+                    <element ref="saml:Evidence" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="Resource" type="anyURI" use="required"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="AuthnRequest" type="samlp:AuthnRequestType"/>\r
+    <complexType name="AuthnRequestType">\r
+        <complexContent>\r
+            <extension base="samlp:RequestAbstractType">\r
+                <sequence>\r
+                    <element ref="saml:Subject" minOccurs="0"/>\r
+                    <element ref="samlp:NameIDPolicy" minOccurs="0"/>\r
+                    <element ref="saml:Conditions" minOccurs="0"/>\r
+                    <element ref="samlp:RequestedAuthnContext" minOccurs="0"/>\r
+                    <element ref="samlp:Scoping" minOccurs="0"/>\r
+                </sequence>\r
+                <attribute name="ForceAuthn" type="boolean" use="optional"/>\r
+                <attribute name="IsPassive" type="boolean" use="optional"/>\r
+                <attribute name="ProtocolBinding" type="anyURI" use="optional"/>\r
+                <attribute name="AssertionConsumerServiceIndex" type="unsignedShort" use="optional"/>\r
+                <attribute name="AssertionConsumerServiceURL" type="anyURI" use="optional"/>\r
+                <attribute name="AttributeConsumingServiceIndex" type="unsignedShort" use="optional"/>\r
+                <attribute name="ProviderName" type="string" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="NameIDPolicy" type="samlp:NameIDPolicyType"/>\r
+    <complexType name="NameIDPolicyType">\r
+        <attribute name="Format" type="anyURI" use="optional"/>\r
+        <attribute name="SPNameQualifier" type="string" use="optional"/>\r
+        <attribute name="AllowCreate" type="boolean" use="optional"/>\r
+    </complexType>\r
+    <element name="Scoping" type="samlp:ScopingType"/>\r
+    <complexType name="ScopingType">\r
+        <sequence>\r
+            <element ref="samlp:IDPList" minOccurs="0"/>\r
+            <element ref="samlp:RequesterID" minOccurs="0" maxOccurs="unbounded"/>\r
+        </sequence>\r
+        <attribute name="ProxyCount" type="nonNegativeInteger" use="optional"/>\r
+    </complexType>\r
+    <element name="RequesterID" type="anyURI"/>\r
+    <element name="IDPList" type="samlp:IDPListType"/>\r
+    <complexType name="IDPListType">\r
+        <sequence>\r
+            <element ref="samlp:IDPEntry" maxOccurs="unbounded"/>\r
+            <element ref="samlp:GetComplete" minOccurs="0"/>\r
+        </sequence>\r
+    </complexType>\r
+    <element name="IDPEntry" type="samlp:IDPEntryType"/>\r
+    <complexType name="IDPEntryType">\r
+        <attribute name="ProviderID" type="anyURI" use="required"/>\r
+        <attribute name="Name" type="string" use="optional"/>\r
+        <attribute name="Loc" type="anyURI" use="optional"/>\r
+    </complexType>\r
+    <element name="GetComplete" type="anyURI"/>\r
+    <element name="Response" type="samlp:ResponseType"/>\r
+    <complexType name="ResponseType">\r
+       <complexContent>\r
+            <extension base="samlp:StatusResponseType">\r
+                <choice minOccurs="0" maxOccurs="unbounded">\r
+                    <element ref="saml:Assertion"/>\r
+                    <element ref="saml:EncryptedAssertion"/>\r
+                </choice>\r
+            </extension>\r
+       </complexContent>\r
+    </complexType>\r
+    <element name="ArtifactResolve" type="samlp:ArtifactResolveType"/>\r
+    <complexType name="ArtifactResolveType">\r
+       <complexContent>\r
+            <extension base="samlp:RequestAbstractType">\r
+                <sequence>\r
+                    <element ref="samlp:Artifact"/>\r
+                </sequence>\r
+            </extension>\r
+       </complexContent>\r
+    </complexType>\r
+    <element name="Artifact" type="string"/>\r
+    <element name="ArtifactResponse" type="samlp:ArtifactResponseType"/>\r
+    <complexType name="ArtifactResponseType">\r
+       <complexContent>\r
+            <extension base="samlp:StatusResponseType">\r
+                <sequence>\r
+                    <any namespace="##any" processContents="lax" minOccurs="0"/>\r
+                </sequence>\r
+            </extension>\r
+       </complexContent>\r
+    </complexType>\r
+    <element name="ManageNameIDRequest" type="samlp:ManageNameIDRequestType"/>\r
+    <complexType name="ManageNameIDRequestType">\r
+       <complexContent>\r
+            <extension base="samlp:RequestAbstractType">\r
+                <sequence>\r
+                    <choice>\r
+                        <element ref="saml:NameID"/>\r
+                        <element ref="saml:EncryptedID"/>\r
+                    </choice>\r
+                    <choice>\r
+                        <element ref="samlp:NewID"/>\r
+                        <element ref="samlp:NewEncryptedID"/>\r
+                        <element ref="samlp:Terminate"/>\r
+                    </choice>\r
+                </sequence>\r
+            </extension>\r
+       </complexContent>\r
+    </complexType>\r
+    <element name="NewID" type="string"/>\r
+    <element name="NewEncryptedID" type="saml:EncryptedElementType"/>\r
+    <element name="Terminate" type="samlp:TerminateType"/>\r
+    <complexType name="TerminateType"/>\r
+    <element name="ManageNameIDResponse" type="samlp:StatusResponseType"/>\r
+    <element name="LogoutRequest" type="samlp:LogoutRequestType"/>\r
+    <complexType name="LogoutRequestType">\r
+        <complexContent>\r
+            <extension base="samlp:RequestAbstractType">\r
+                <sequence>\r
+                    <choice>\r
+                        <element ref="saml:BaseID"/>\r
+                        <element ref="saml:NameID"/>\r
+                        <element ref="saml:EncryptedID"/>\r
+                    </choice>\r
+                    <element ref="samlp:SessionIndex" minOccurs="0" maxOccurs="unbounded"/>\r
+                </sequence>\r
+                <attribute name="Reason" type="string" use="optional"/>\r
+                <attribute name="NotOnOrAfter" type="dateTime" use="optional"/>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="SessionIndex" type="string"/>\r
+    <element name="LogoutResponse" type="samlp:StatusResponseType"/>\r
+    <element name="NameIDMappingRequest" type="samlp:NameIDMappingRequestType"/>\r
+    <complexType name="NameIDMappingRequestType">\r
+        <complexContent>\r
+            <extension base="samlp:RequestAbstractType">\r
+                <sequence>\r
+                    <choice>\r
+                        <element ref="saml:BaseID"/>\r
+                        <element ref="saml:NameID"/>\r
+                        <element ref="saml:EncryptedID"/>\r
+                    </choice>\r
+                    <element ref="samlp:NameIDPolicy"/>\r
+                </sequence>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+    <element name="NameIDMappingResponse" type="samlp:NameIDMappingResponseType"/>\r
+    <complexType name="NameIDMappingResponseType">\r
+        <complexContent>\r
+            <extension base="samlp:StatusResponseType">\r
+                <choice>\r
+                    <element ref="saml:NameID"/>\r
+                    <element ref="saml:EncryptedID"/>\r
+                </choice>\r
+            </extension>\r
+        </complexContent>\r
+    </complexType>\r
+</schema>\r

diff --git a/schemas/saml-schema-x500-2.0.xsd b/schemas/saml-schema-x500-2.0.xsd
new file mode 100644 (file)
index 0000000..141b634
--- /dev/null
+++ b/schemas/saml-schema-x500-2.0.xsd
@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<schema\r
+    targetNamespace="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500"\r
+    xmlns="http://www.w3.org/2001/XMLSchema"\r
+    elementFormDefault="unqualified"\r
+    attributeFormDefault="unqualified"\r
+    blockDefault="substitution"\r
+    version="2.0">\r
+    <annotation>\r
+        <documentation>\r
+            Document identifier: saml-schema-x500-2.0\r
+            Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+            Revision history:\r
+              V2.0 (March, 2005):\r
+                Custom schema for X.500 attribute profile, first published in SAML 2.0.\r
+        </documentation>\r
+    </annotation>\r
+    <attribute name="Encoding" type="string"/>\r
+</schema>\r
+\r

diff --git a/schemas/saml-schema-xacml-2.0.xsd b/schemas/saml-schema-xacml-2.0.xsd
new file mode 100644 (file)
index 0000000..a83bc02
--- /dev/null
+++ b/schemas/saml-schema-xacml-2.0.xsd
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>\r
+<schema\r
+    targetNamespace="urn:oasis:names:tc:SAML:2.0:profiles:attribute:XACML"\r
+    xmlns="http://www.w3.org/2001/XMLSchema"\r
+    elementFormDefault="unqualified"\r
+    attributeFormDefault="unqualified"\r
+    blockDefault="substitution"\r
+    version="2.0">\r
+    <annotation>\r
+        <documentation>\r
+            Document identifier: saml-schema-xacml-2.0\r
+            Location: http://docs.oasis-open.org/security/saml/v2.0/\r
+            Revision history:\r
+            V2.0 (March, 2005):\r
+              Custom schema for XACML attribute profile, first published in SAML 2.0.\r
+        </documentation>\r
+    </annotation>\r
+    <attribute name="DataType" type="anyURI"/>\r
+</schema>\r

diff --git a/schemas/saml10-catalog.xml.in b/schemas/saml10-catalog.xml.in
new file mode 100644 (file)
index 0000000..e861335
--- /dev/null
+++ b/schemas/saml10-catalog.xml.in
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE catalog PUBLIC "-//OASIS//DTD Entity Resolution XML Catalog V1.0//EN" "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd">
+<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
+    <uri name="http://schemas.xmlsoap.org/soap/envelope/" uri="@-PKGXMLDIR-@/soap-envelope.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:1.0:assertion" uri="@-PKGXMLDIR-@/cs-sstc-schema-assertion-01.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:1.0:protocol" uri="@-PKGXMLDIR-@/cs-sstc-schema-protocol-01.xsd"/>
+</catalog>

diff --git a/schemas/saml11-catalog.xml.in b/schemas/saml11-catalog.xml.in
new file mode 100644 (file)
index 0000000..5f484d9
--- /dev/null
+++ b/schemas/saml11-catalog.xml.in
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE catalog PUBLIC "-//OASIS//DTD Entity Resolution XML Catalog V1.0//EN" "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd">
+<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
+    <uri name="http://schemas.xmlsoap.org/soap/envelope/" uri="@-PKGXMLDIR-@/soap-envelope.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:1.0:assertion" uri="@-PKGXMLDIR-@/cs-sstc-schema-assertion-1.1.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:1.0:protocol" uri="@-PKGXMLDIR-@/cs-sstc-schema-protocol-1.1.xsd"/>
+</catalog>

diff --git a/schemas/saml20-catalog.xml.in b/schemas/saml20-catalog.xml.in
new file mode 100644 (file)
index 0000000..1e2b797
--- /dev/null
+++ b/schemas/saml20-catalog.xml.in
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE catalog PUBLIC "-//OASIS//DTD Entity Resolution XML Catalog V1.0//EN" "http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd">
+<catalog xmlns="urn:oasis:names:tc:entity:xmlns:xml:catalog">
+    <uri name="http://schemas.xmlsoap.org/soap/envelope/" uri="@-PKGXMLDIR-@/soap-envelope.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:assertion" uri="@-PKGXMLDIR-@/saml-schema-assertion-2.0.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:protocol" uri="@-PKGXMLDIR-@/saml-schema-protocol-2.0.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:metadata" uri="@-PKGXMLDIR-@/saml-schema-metadata-2.0.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:ac" uri="@-PKGXMLDIR-@/saml-schema-authn-context-2.0.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:profiles:SSO:ecp" uri="@-PKGXMLDIR-@/saml-schema-ecp-2.0.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:profiles:attribute:DCE" uri="@-PKGXMLDIR-@/saml-schema-dce-2.0.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:profiles:attribute:X500" uri="@-PKGXMLDIR-@/saml-schema-x500-2.0.xsd"/>
+    <uri name="urn:oasis:names:tc:SAML:2.0:profiles:attribute:XACML" uri="@-PKGXMLDIR-@/saml-schema-xacml-2.0.xsd"/>
+</catalog>

diff --git a/schemas/soap-envelope.xsd b/schemas/soap-envelope.xsd
new file mode 100644 (file)
index 0000000..224e815
--- /dev/null
+++ b/schemas/soap-envelope.xsd
@@ -0,0 +1,120 @@
+<?xml version='1.0' encoding='UTF-8' ?>\r
+\r
+<!-- Schema for the SOAP/1.1 envelope\r
+\r
+     This schema has been produced using W3C's SOAP Version 1.2 schema\r
+     found at:\r
+\r
+     http://www.w3.org/2001/06/soap-envelope\r
+\r
+     Copyright 2001 Martin Gudgin, Developmentor.\r
+\r
+     Changes made are the following:\r
+     - reverted namespace to http://schemas.xmlsoap.org/soap/envelope/\r
+     - reverted mustUnderstand to only allow 0 and 1 as lexical values\r
+        - made encodingStyle a global attribute 20020825\r
+\r
+        Further changes:\r
+\r
+        - removed default value from mustUnderstand attribute declaration - 20030314\r
+\r
+     Original copyright:\r
+     \r
+     Copyright 2001 W3C (Massachusetts Institute of Technology,\r
+     Institut National de Recherche en Informatique et en Automatique,\r
+     Keio University). All Rights Reserved.\r
+     http://www.w3.org/Consortium/Legal/\r
+\r
+     This document is governed by the W3C Software License [1] as\r
+     described in the FAQ [2].\r
+\r
+     [1] http://www.w3.org/Consortium/Legal/copyright-software-19980720\r
+     [2] http://www.w3.org/Consortium/Legal/IPR-FAQ-20000620.html#DTD\r
+-->\r
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"\r
+           xmlns:tns="http://schemas.xmlsoap.org/soap/envelope/"\r
+           targetNamespace="http://schemas.xmlsoap.org/soap/envelope/" >\r
+\r
+     \r
+  <!-- Envelope, header and body -->\r
+  <xs:element name="Envelope" type="tns:Envelope" />\r
+  <xs:complexType name="Envelope" >\r
+    <xs:sequence>\r
+      <xs:element ref="tns:Header" minOccurs="0" />\r
+      <xs:element ref="tns:Body" minOccurs="1" />\r
+      <xs:any namespace="##other" minOccurs="0" maxOccurs="unbounded" processContents="lax" />\r
+    </xs:sequence>\r
+    <xs:anyAttribute namespace="##any" processContents="lax" />\r
+  </xs:complexType>\r
+\r
+  <xs:element name="Header" type="tns:Header" />\r
+  <xs:complexType name="Header" >\r
+    <xs:sequence>\r
+      <xs:any namespace="##other" minOccurs="0" maxOccurs="unbounded" processContents="lax" />\r
+    </xs:sequence>\r
+    <xs:anyAttribute namespace="##any" processContents="lax" />\r
+  </xs:complexType>\r
+  \r
+  <xs:element name="Body" type="tns:Body" />\r
+  <xs:complexType name="Body" >\r
+    <xs:sequence>\r
+      <xs:any namespace="##any" minOccurs="0" maxOccurs="unbounded" processContents="lax" />\r
+    </xs:sequence>\r
+    <xs:anyAttribute namespace="##any" processContents="lax" >\r
+         <xs:annotation>\r
+           <xs:documentation>\r
+                 Prose in the spec does not specify that attributes are allowed on the Body element\r
+               </xs:documentation>\r
+         </xs:annotation>\r
+       </xs:anyAttribute>\r
+  </xs:complexType>\r
+\r
+       \r
+  <!-- Global Attributes.  The following attributes are intended to be usable via qualified attribute names on any complex type referencing them.  -->\r
+  <xs:attribute name="mustUnderstand" >        \r
+     <xs:simpleType>\r
+     <xs:restriction base='xs:boolean'>\r
+          <xs:pattern value='0|1' />\r
+        </xs:restriction>\r
+   </xs:simpleType>\r
+  </xs:attribute>\r
+  <xs:attribute name="actor" type="xs:anyURI" />\r
+\r
+  <xs:simpleType name="encodingStyle" >\r
+    <xs:annotation>\r
+         <xs:documentation>\r
+           'encodingStyle' indicates any canonicalization conventions followed in the contents of the containing element.  For example, the value 'http://schemas.xmlsoap.org/soap/encoding/' indicates the pattern described in SOAP specification\r
+         </xs:documentation>\r
+       </xs:annotation>\r
+    <xs:list itemType="xs:anyURI" />\r
+  </xs:simpleType>\r
+\r
+  <xs:attribute name="encodingStyle" type="tns:encodingStyle" />\r
+  <xs:attributeGroup name="encodingStyle" >\r
+    <xs:attribute ref="tns:encodingStyle" />\r
+  </xs:attributeGroup>\r
+\r
+  <xs:element name="Fault" type="tns:Fault" />\r
+  <xs:complexType name="Fault" final="extension" >\r
+    <xs:annotation>\r
+         <xs:documentation>\r
+           Fault reporting structure\r
+         </xs:documentation>\r
+       </xs:annotation>\r
+    <xs:sequence>\r
+      <xs:element name="faultcode" type="xs:QName" />\r
+      <xs:element name="faultstring" type="xs:string" />\r
+      <xs:element name="faultactor" type="xs:anyURI" minOccurs="0" />\r
+      <xs:element name="detail" type="tns:detail" minOccurs="0" />      \r
+    </xs:sequence>\r
+  </xs:complexType>\r
+\r
+  <xs:complexType name="detail">\r
+    <xs:sequence>\r
+      <xs:any namespace="##any" minOccurs="0" maxOccurs="unbounded" processContents="lax" />\r
+    </xs:sequence>\r
+    <xs:anyAttribute namespace="##any" processContents="lax" /> \r
+  </xs:complexType>\r
+\r
+</xs:schema>\r
+\r