Draft of 2.0 config schema/file, removed legacy support, validate config.

[shibboleth/cpp-sp.git] / schemas / shibboleth-spconfig-2.0.xsd

diff --git a/schemas/shibboleth-spconfig-2.0.xsd b/schemas/shibboleth-spconfig-2.0.xsd
index 61d13f6..87d9bc0 100644 (file)
--- a/schemas/shibboleth-spconfig-2.0.xsd
+++ b/schemas/shibboleth-spconfig-2.0.xsd
@@ -19,41 +19,42 @@
        </documentation>\r
     </annotation>\r
 \r
+       <simpleType name="string">
+               <restriction base="string">
+                       <minLength value="1"/>\r
+               </restriction>
+       </simpleType>\r
+\r
+       <simpleType name="listOfStrings">\r
+               <list itemType="conf:string"/>\r
+       </simpleType>\r
+       \r
        <complexType name="PluggableType">\r
                <sequence>\r
                        <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                </sequence>\r
-               <attribute name="type" type="string" use="required"/>\r
+               <attribute name="type" type="conf:string" use="required"/>\r
                <anyAttribute namespace="##any" processContents="lax"/>\r
        </complexType>\r
 \r
-       <element name="ShibbolethTargetConfig" type="conf:SPConfigType"/> <!-- deprecated -->\r
-       <element name="ShibbolethSPConfig" type="conf:SPConfigType"/>\r
-       <element name="SPConfig" type="conf:SPConfigType"/>\r
-       <complexType name="SPConfigType">\r
-               <annotation>\r
-                       <documentation>Root of configuration</documentation>\r
-               </annotation>\r
-               <sequence>\r
-                       <element ref="conf:Extensions" minOccurs="0"/>\r
-                       <choice minOccurs="0">\r
-                               <element name="OutOfProcess" type="conf:OutOfProcessType"/>\r
-                               <element name="Global" type="conf:OutOfProcessType"/> <!-- deprecated -->\r
-                       </choice>\r
-                       <choice minOccurs="0">\r
-                               <element name="InProcess" type="conf:InProcessType"/>\r
-                               <element name="Local" type="conf:InProcessType"/> <!-- deprecated -->\r
-                       </choice>\r
-                       <element ref="conf:Applications"/>\r
-                       <choice minOccurs="0">\r
-                               <element name="CredentialsProvider" type="conf:PluggableType"/> <!-- deprecated -->\r
-                               <element ref="conf:Credentials"/>\r
-                       </choice>\r
-               </sequence>\r
-               <attribute name="logger" type="anyURI" use="optional"/>\r
-               <attribute name="clockSkew" type="unsignedInt" use="optional"/>\r
-               <anyAttribute namespace="##other" processContents="lax"/>\r
-       </complexType>\r
+       <element name="SPConfig">\r
+               <complexType>
+                       <annotation>
+                               <documentation>Root of configuration</documentation>
+                       </annotation>
+                       <sequence>
+                               <element ref="conf:Extensions" minOccurs="0"/>
+                               <element ref="conf:OutOfProcess"/>
+                               <element ref="conf:InProcess"/>
+                               <element ref="conf:Applications"/>
+                               <element ref="conf:Credentials" minOccurs="0"/>
+                               <element ref="conf:SecurityPolicies"/>
+                       </sequence>
+                       <attribute name="logger" type="anyURI" use="optional"/>
+                       <attribute name="clockSkew" type="unsignedInt" use="optional"/>
+                       <anyAttribute namespace="##other" processContents="lax"/>
+               </complexType>\r
+       </element>\r
 \r
        <element name="Extensions">\r
                <annotation>\r
@@ -63,12 +64,15 @@
                        <sequence>\r
                                <element name="Library" minOccurs="0" maxOccurs="unbounded">\r
                                        <complexType>\r
-                                               <sequence>\r
-                                                       <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
-                                               </sequence>\r
-                                               <attribute name="path" type="anyURI" use="required"/>\r
-                                               <attribute name="fatal" type="boolean" use="optional"/>\r
-                                               <anyAttribute namespace="##any" processContents="lax"/>\r
+                                               <complexContent>\r
+                                                       <restriction base="conf:PluggableType">\r
+                                                               <sequence>\r
+                                                                       <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
+                                                               </sequence>\r
+                                                               <attribute name="path" type="anyURI" use="required"/>\r
+                                                               <attribute name="fatal" type="boolean" use="optional"/>\r
+                                                       </restriction>\r
+                                               </complexContent>\r
                                        </complexType>\r
                                </element>\r
                                <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
@@ -76,81 +80,109 @@
                </complexType>\r
        </element>\r
 \r
-       <element name="SessionCache">\r
+       <element name="StorageService">\r
+               <annotation>\r
+                       <documentation>References StorageService plugins</documentation>\r
+               </annotation>\r
                <complexType>\r
                        <complexContent>\r
                                <restriction base="conf:PluggableType">\r
                                        <sequence>\r
                                                <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                                        </sequence>\r
+                                       <attribute name="id" type="conf:string" use="required"/>\r
                                        <attribute name="cleanupInterval" type="unsignedInt" use="optional" default="900"/>\r
+                                       <anyAttribute namespace="##any" processContents="lax"/>\r
+                               </restriction>\r
+                       </complexContent>\r
+               </complexType>\r
+       </element>\r
+\r
+       <element name="SessionCache">\r
+               <annotation>\r
+                       <documentation>References SessionCache plugins</documentation>\r
+               </annotation>\r
+               <complexType>\r
+                       <complexContent>\r
+                               <restriction base="conf:PluggableType">\r
+                                       <sequence>\r
+                                               <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
+                                       </sequence>\r
                                        <attribute name="cacheTimeout" type="unsignedInt" use="optional" default="28800"/>\r
+                                       <anyAttribute namespace="##any" processContents="lax"/>\r
                                </restriction>\r
                        </complexContent>\r
                </complexType>\r
        </element>\r
        \r
-       <element name="ReplayCache" type="conf:PluggableType"/>\r
+       <element name="ReplayCache">
+               <annotation>\r
+                       <documentation>Ties ReplayCache to custom StorageService</documentation>\r
+               </annotation>\r
+               <complexType>
+                       <sequence/>\r
+                       <attribute name="StorageService" type="conf:string" use="required"/>
+               </complexType>
+       </element>\r
        \r
-       <complexType name="OutOfProcessType">\r
+       <element name="OutOfProcess">\r
                <annotation>\r
                        <documentation>Container for shibd out-of-process configuration</documentation>\r
                </annotation>\r
-               <sequence>\r
-                       <element ref="conf:Extensions" minOccurs="0"/>\r
-                       <choice>\r
-                               <element name="UnixListener">\r
-                                       <complexType>\r
-                                               <attribute name="address" type="string" use="required"/>\r
-                                       </complexType>\r
-                               </element>\r
-                               <element name="TCPListener">\r
-                                       <complexType>\r
-                                               <attribute name="address" type="string" use="required"/>\r
-                                               <attribute name="port" type="unsignedInt" use="required"/>\r
-                                               <attribute name="acl" use="optional" default="127.0.0.1">\r
-                                                       <simpleType>\r
-                                                               <list itemType="string"/>\r
-                                                       </simpleType>\r
-                                               </attribute>\r
-                                       </complexType>\r
-                               </element>\r
-                               <element name="Listener" type="conf:PluggableType"/>\r
-                       </choice>\r
-                       <element ref="conf:SessionCache" minOccurs="0"/>\r
-                       <element ref="conf:ReplayCache" minOccurs="0"/>\r
-                       <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
-               </sequence>\r
-               <attribute name="logger" type="anyURI" use="optional"/>\r
-               <anyAttribute namespace="##other" processContents="lax"/>\r
-       </complexType>\r
+               <complexType>\r
+                       <sequence>
+                               <element ref="conf:Extensions" minOccurs="0"/>
+                               <choice>
+                                       <element name="UnixListener">
+                                               <complexType>
+                                                       <attribute name="address" type="conf:string" use="required"/>
+                                               </complexType>
+                                       </element>
+                                       <element name="TCPListener">
+                                               <complexType>
+                                                       <attribute name="address" type="conf:string" use="required"/>
+                                                       <attribute name="port" type="unsignedInt" use="required"/>
+                                                       <attribute name="acl" type="conf:listOfStrings" use="optional" default="127.0.0.1"/>
+                                               </complexType>
+                                       </element>
+                                       <element name="Listener" type="conf:PluggableType"/>
+                               </choice>
+                               <element ref="conf:StorageService" minOccurs="0" maxOccurs="unbounded"/>
+                               <element ref="conf:SessionCache" minOccurs="0"/>
+                               <element ref="conf:ReplayCache" minOccurs="0"/>
+                               <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+                       </sequence>
+                       <attribute name="logger" type="anyURI" use="optional"/>
+                       <anyAttribute namespace="##other" processContents="lax"/>\r
+               </complexType>\r
+       </element>\r
 \r
-       <complexType name="InProcessType">\r
+       <element name="InProcess">\r
                <annotation>\r
                        <documentation>\r
                        Container for configuration of locally integrated or platform-specific\r
                        features (e.g. web server filters)\r
                        </documentation>\r
                </annotation>\r
-               <sequence>\r
-                       <element ref="conf:Extensions" minOccurs="0"/>\r
-                       <element ref="conf:SessionCache" minOccurs="0"/>\r
-                       <element ref="conf:ReplayCache" minOccurs="0"/>\r
-                       <element name="RequestMapProvider" type="conf:PluggableType" minOccurs="0"/>\r
-                       <element name="Implementation" minOccurs="0">\r
-                               <complexType>\r
-                                       <sequence>\r
-                                               <element ref="conf:ISAPI" minOccurs="0"/>\r
-                                               <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
-                                       </sequence>\r
-                               </complexType>\r
-                       </element>\r
-                       <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
-               </sequence>\r
-               <attribute name="logger" type="anyURI" use="optional"/>\r
-               <attribute name="localRelayState" type="boolean" use="optional" default="false"/>\r
-               <anyAttribute namespace="##other" processContents="lax"/>\r
-       </complexType>\r
+               <complexType>\r
+                       <sequence>
+                               <element ref="conf:Extensions" minOccurs="0"/>
+                               <element name="RequestMapper" type="conf:PluggableType"/>
+                               <element name="Implementation" minOccurs="0">
+                                       <complexType>
+                                               <sequence>
+                                                       <element ref="conf:ISAPI" minOccurs="0"/>
+                                                       <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+                                               </sequence>
+                                       </complexType>
+                               </element>
+                               <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+                       </sequence>
+                       <attribute name="logger" type="anyURI" use="optional"/>
+                       <attribute name="localRelayState" type="boolean" use="optional" default="false"/>
+                       <anyAttribute namespace="##other" processContents="lax"/>\r
+               </complexType>\r
+       </element>\r
        \r
        <element name="ISAPI">\r
                <complexType>\r
@@ -161,10 +193,10 @@
                                                        <element name="Alias" type="string" minOccurs="0" maxOccurs="unbounded"/>\r
                                                </sequence>\r
                                                <attribute name="id" type="unsignedInt" use="required"/>\r
-                                               <attribute name="name" type="string" use="required"/>\r
+                                               <attribute name="name" type="conf:string" use="required"/>\r
                                                <attribute name="port" type="unsignedInt" use="optional"/>\r
                                                <attribute name="sslport" type="unsignedInt" use="optional"/>\r
-                                               <attribute name="scheme" type="string" use="optional"/>\r
+                                               <attribute name="scheme" type="conf:string" use="optional"/>\r
                                        </complexType>\r
                                </element>\r
                                <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
@@ -204,19 +236,16 @@
                <complexType>\r
                        <simpleContent>\r
                                <extension base="conf:listOfStrings">\r
-                                       <attribute name="require" type="string" use="required"/>\r
+                                       <attribute name="require" type="conf:string" use="required"/>\r
                                </extension>\r
                        </simpleContent>\r
                </complexType>\r
        </element>\r
-       <simpleType name="listOfStrings">\r
-               <list itemType="string"/>\r
-       </simpleType>\r
        \r
        <attributeGroup name="ContentSettings">\r
-               <attribute name="authType" type="string" use="optional"/>\r
+               <attribute name="authType" type="conf:string" use="optional"/>\r
                <attribute name="requireSession" type="boolean" use="optional"/>\r
-               <attribute name="requireSessionWith" type="string" use="optional"/>\r
+               <attribute name="requireSessionWith" type="conf:string" use="optional"/>\r
                <attribute name="exportAssertion" type="boolean" use="optional"/>\r
                <attribute name="redirectToSSL" type="unsignedInt" use="optional"/>\r
                <anyAttribute namespace="##other" processContents="lax"/>\r
@@ -239,7 +268,7 @@
                    </choice>\r
                 <element ref="conf:Host" minOccurs="0" maxOccurs="unbounded"/>\r
             </sequence>\r
-            <attribute name="applicationId" type="string" fixed="default"/>\r
+            <attribute name="applicationId" type="conf:string" fixed="default"/>\r
                <attributeGroup ref="conf:ContentSettings"/>\r
         </complexType>\r
     </element>\r
@@ -256,7 +285,7 @@
                </sequence>\r
                <attribute name="scheme" use="optional">\r
                            <simpleType>\r
-                               <restriction base="string">\r
+                               <restriction base="conf:string">\r
                                    <enumeration value="http"/>\r
                                    <enumeration value="https"/>\r
                                    <enumeration value="ftp"/>\r
@@ -265,9 +294,9 @@
                                </restriction>\r
                            </simpleType>\r
                </attribute>\r
-               <attribute name="name" type="string" use="required"/>\r
+               <attribute name="name" type="conf:string" use="required"/>\r
                <attribute name="port" type="unsignedInt" use="optional"/>\r
-               <attribute name="applicationId" type="string" use="optional"/>\r
+               <attribute name="applicationId" type="conf:string" use="optional"/>\r
                <attributeGroup ref="conf:ContentSettings"/>\r
        </complexType>\r
     </element>\r
@@ -282,8 +311,8 @@
                    </choice>\r
                        <element ref="conf:Path" minOccurs="0" maxOccurs="unbounded"/>\r
                </sequence>\r
-               <attribute name="name" type="string" use="required"/>\r
-               <attribute name="applicationId" type="string" use="optional"/>\r
+               <attribute name="name" type="conf:string" use="required"/>\r
+               <attribute name="applicationId" type="conf:string" use="optional"/>\r
                <attributeGroup ref="conf:ContentSettings"/>\r
         </complexType>\r
     </element>\r
@@ -297,15 +326,12 @@
                                <element ref="conf:Sessions"/>\r
                                <element ref="conf:Errors"/>\r
                                <element ref="conf:CredentialUse" minOccurs="0"/>\r
-                               <choice minOccurs="0" maxOccurs="unbounded">\r
-                    <element ref="saml:Attribute"/>\r
-                    <element ref="saml:Audience"/>\r
-                    <element name="MetadataProvider" type="conf:PluggableType"/>\r
-                    <element name="TrustProvider" type="conf:PluggableType"/>\r
-                               </choice>\r
+                               <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>
+                <element name="MetadataProvider" type="conf:PluggableType"/>
+                               <element name="TrustEngine" type="conf:PluggableType"/>\r
                                <element ref="conf:Application" minOccurs="0" maxOccurs="unbounded"/>\r
                        </sequence>\r
-                       <attribute name="id" type="string" fixed="default"/>\r
+                       <attribute name="id" type="conf:string" fixed="default"/>\r
                        <attribute name="providerId" type="anyURI" use="required"/>\r
                        <attribute name="homeURL" type="anyURI" use="optional"/>\r
                <anyAttribute namespace="##other" processContents="lax"/>\r
@@ -321,14 +347,11 @@
                                <element ref="conf:Sessions" minOccurs="0"/>\r
                                <element ref="conf:Errors" minOccurs="0"/>\r
                                <element ref="conf:CredentialUse" minOccurs="0"/>\r
-                               <choice minOccurs="0" maxOccurs="unbounded">\r
-                    <element ref="saml:Attribute"/>\r
-                    <element ref="saml:Audience"/>\r
-                    <element name="MetadataProvider" type="conf:PluggableType"/>\r
-                    <element name="TrustProvider" type="conf:PluggableType"/>\r
-                               </choice>\r
+                               <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>\r
+                               <element name="MetadataProvider" type="conf:PluggableType" minOccurs="0"/>\r
+                               <element name="TrustEngine" type="conf:PluggableType" minOccurs="0"/>\r
                        </sequence>\r
-                       <attribute name="id" type="string" use="required"/>\r
+                       <attribute name="id" type="conf:string" use="required"/>\r
                        <attribute name="providerId" type="anyURI" use="optional"/>\r
                        <attribute name="homeURL" type="anyURI" use="optional"/>\r
                <anyAttribute namespace="##other" processContents="lax"/>\r
@@ -360,14 +383,15 @@
                        </choice>\r
                        <attribute name="handlerURL" type="anyURI" use="optional"/>\r
                        <attribute name="handlerSSL" type="boolean" use="optional" default="true"/>\r
-                       <attribute name="cookieName" type="string" use="optional"/>\r
-                       <attribute name="cookieProps" type="string" use="optional"/>\r
+                       <attribute name="cookieName" type="conf:string" use="optional"/>\r
+                       <attribute name="cookieProps" type="conf:string" use="optional"/>\r
                        <attribute name="idpHistory" type="boolean" use="optional" default="true"/>\r
                        <attribute name="idpHistoryDays" type="unsignedInt" use="optional"/>\r
                        <attribute name="lifetime" type="unsignedInt" use="optional"/>\r
                        <attribute name="timeout" type="unsignedInt" use="optional"/>\r
                        <attribute name="checkAddress" type="boolean" use="optional"/>\r
                        <attribute name="consistentAddress" type="boolean" use="optional" default="true"/>\r
+                       <attribute name="validate" type="boolean" use="optional"/>\r
                        <anyAttribute namespace="##other" processContents="lax"/>\r
                </complexType>\r
        </element>\r
@@ -385,7 +409,7 @@
                        <attribute name="wayfBinding" type="anyURI" use="optional"/>\r
                        <attribute name="checkCDC" type="anyURI" use="optional"/>\r
                        <attribute name="isDefault" type="boolean" use="optional"/>\r
-                       <attribute name="id" type="string" use="optional"/>\r
+                       <attribute name="id" type="conf:string" use="optional"/>\r
                        <anyAttribute namespace="##any" processContents="lax"/>\r
                </complexType>\r
        </element>\r
@@ -403,7 +427,7 @@
                        <attribute name="rm" type="anyURI" use="optional"/>\r
                        <attribute name="access" type="anyURI" use="optional"/>\r
                        <attribute name="ssl" type="anyURI" use="optional"/>\r
-                       <attribute name="supportContact" type="string" use="optional"/>\r
+                       <attribute name="supportContact" type="conf:string" use="optional"/>\r
                        <attribute name="logoLocation" type="anyURI" use="optional"/>\r
                        <attribute name="styleSheet" type="anyURI" use="optional"/>\r
                        <anyAttribute namespace="##any" processContents="lax"/>\r
@@ -411,14 +435,14 @@
        </element>\r
 \r
        <attributeGroup name="CredentialUseGroup">\r
-               <attribute name="TLS" type="string" use="optional"/>\r
-               <attribute name="Signing" type="string" use="optional"/>\r
+               <attribute name="TLS" type="conf:string" use="optional"/>\r
+               <attribute name="Signing" type="conf:string" use="optional"/>\r
                <attribute name="signRequest" type="boolean" use="optional" default="false"/>\r
                <attribute name="signatureAlg" type="anyURI" use="optional"/>\r
                <attribute name="signedAssertions" type="boolean" use="optional" default="false"/>\r
                <attribute name="authType" use="optional">\r
                        <simpleType>\r
-                               <restriction base="string">\r
+                               <restriction base="conf:string">\r
                                        <enumeration value="basic"/>\r
                                        <enumeration value="digest"/>\r
                                        <enumeration value="ntlm"/>\r
@@ -441,7 +465,7 @@
                                                <sequence>\r
                                                        <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
                                                </sequence>\r
-                                               <attribute name="Name" type="string" use="required"/>\r
+                                               <attribute name="Name" type="conf:string" use="required"/>\r
                                                <attributeGroup ref="conf:CredentialUseGroup"/>\r
                                                <anyAttribute namespace="##other" processContents="lax"/>\r
                                        </complexType>\r
@@ -460,13 +484,17 @@
                <complexType>\r
                        <sequence>\r
                                <element name="CredentialResolver" minOccurs="1" maxOccurs="unbounded">
+                                       <annotation>\r
+                                               <documentation>References CredentialResolver plugins</documentation>\r
+                                       </annotation>\r
                                        <complexType>
                                                <complexContent>
                                                        <restriction base="conf:PluggableType">
                                                                <sequence>
                                                                        <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                                                                </sequence>
-                                                               <attribute name="Id" type="string" use="required"/>
+                                                               <attribute name="id" type="conf:string" use="required"/>\r
+                                                               <anyAttribute namespace="##any" processContents="lax"/>
                                                        </restriction>
                                                </complexContent>
                                        </complexType>
@@ -475,5 +503,26 @@
                </complexType>
        </element>\r
        \r
+       <element name="SecurityPolicies">
+               <annotation>\r
+                       <documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>\r
+               </annotation>\r
+               <complexType>\r
+                       <sequence>\r
+                               <element name="Policy" minOccurs="1" maxOccurs="unbounded">\r
+                                       <annotation>\r
+                                               <documentation>Specifies a set of SecurityPolicyRule plugins</documentation>\r
+                                       </annotation>\r
+                                       <complexType>\r
+                                               <sequence>
+                                                       <element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
+                                               </sequence>
+                                               <attribute name="id" type="conf:string" use="required"/>\r
+                                       </complexType>\r
+                               </element>\r
+                       </sequence>\r
+                       <attribute name="default" type="conf:string" use="required"/>\r
+               </complexType>\r
+       </element>\r
+       \r
 </schema>\r
-\r