https://issues.shibboleth.net/jira/browse/SSPCPP-255

[shibboleth/cpp-sp.git] / schemas / shibboleth-targetconfig-1.0.xsd

diff --git a/schemas/shibboleth-targetconfig-1.0.xsd b/schemas/shibboleth-targetconfig-1.0.xsd
index 9deb120..e1b6e44 100644 (file)
--- a/schemas/shibboleth-targetconfig-1.0.xsd
+++ b/schemas/shibboleth-targetconfig-1.0.xsd
@@ -7,9 +7,8 @@
        elementFormDefault="qualified"
        attributeFormDefault="unqualified"
        blockDefault="substitution"
-       version="1.1">
+       version="1.3.5">
 
-       <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
        <import namespace="urn:oasis:names:tc:SAML:1.0:assertion" schemaLocation="cs-sstc-schema-assertion-1.1.xsd"/>
        <import namespace="urn:oasis:names:tc:SAML:2.0:metadata" schemaLocation="saml-schema-metadata-2.0.xsd"/>
 
@@ -20,12 +19,26 @@
        </documentation>
     </annotation>
 
+       <simpleType name="string">
+               <restriction base="string">
+                       <minLength value="1"/>
+               </restriction>
+       </simpleType>
+       
+       <simpleType name="listOfStrings">
+               <list itemType="conf:string"/>
+       </simpleType>
+       
+       <simpleType name="listOfURIs">
+               <list itemType="anyURI"/>
+       </simpleType>
+       
        <complexType name="PluggableType">
                <sequence>
                        <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                </sequence>
-               <attribute name="type" type="string" use="required"/>
-               <attribute name="uri" type="anyURI" use="optional"/>
+               <attribute name="type" type="conf:string" use="required"/>
+               <attribute name="uri" type="anyURI"/>
                <anyAttribute namespace="##any" processContents="lax"/>
        </complexType>
 
@@ -47,9 +60,10 @@
                        </choice>
                        <element ref="conf:Applications"/>
                        <element name="CredentialsProvider" type="conf:PluggableType" minOccurs="0" maxOccurs="unbounded"/>
+                       <element ref="conf:AttributeFactory" minOccurs="0" maxOccurs="unbounded"/>
                </sequence>
-               <attribute name="logger" type="anyURI" use="optional"/>
-               <attribute name="clockSkew" type="unsignedInt" use="optional"/>
+               <attribute name="logger" type="anyURI"/>
+               <attribute name="clockSkew" type="unsignedInt"/>
                <anyAttribute namespace="##other" processContents="lax"/>
        </complexType>
 
@@ -65,7 +79,7 @@
                                                        <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                                                </sequence>
                                                <attribute name="path" type="anyURI" use="required"/>
-                                               <attribute name="fatal" type="boolean" use="optional"/>
+                                               <attribute name="fatal" type="boolean"/>
                                                <anyAttribute namespace="##other" processContents="lax"/>
                                        </complexType>
                                </element>
@@ -83,20 +97,17 @@
                        <choice>
                                <element name="UnixListener">
                                        <complexType>
-                                               <attribute name="address" type="string" use="required"/>
+                                               <attribute name="address" type="conf:string" use="required"/>
                                        </complexType>
                                </element>
                                <element name="TCPListener">
                                        <complexType>
-                                               <attribute name="address" type="string" use="required"/>
+                                               <attribute name="address" type="conf:string" use="required"/>
                                                <attribute name="port" type="unsignedInt" use="required"/>
-                                               <attribute name="acl" use="optional" default="127.0.0.1">
-                                                       <simpleType>
-                                                               <list itemType="string"/>
-                                                       </simpleType>
-                                               </attribute>
+                                               <attribute name="acl" type="conf:listOfStrings" default="127.0.0.1"/>
                                        </complexType>
                                </element>
+                               <element name="MemoryListener" type="conf:PluggableType"/>
                                <element name="Listener" type="conf:PluggableType"/>
                        </choice>
                        <choice>
@@ -109,11 +120,11 @@
                                <element name="MySQLSessionCache">
                                        <complexType>
                                                <sequence>
-                                                       <element name="Argument" type="string" minOccurs="0" maxOccurs="unbounded"/>
+                                                       <element name="Argument" type="conf:string" minOccurs="0" maxOccurs="unbounded"/>
                                                </sequence>
                                                <attributeGroup ref="conf:SessionCacheProperties"/>
-                                               <attribute name="mysqlTimeout" type="unsignedInt" use="optional" default="14400"/>
-                                               <attribute name="storeAttributes" type="boolean" use="optional" default="false"/>
+                                               <attribute name="mysqlTimeout" type="unsignedInt" default="14400"/>
+                                               <attribute name="storeAttributes" type="boolean" default="false"/>
                                                <anyAttribute namespace="##other" processContents="lax"/>
                                        </complexType>
                                </element>
@@ -131,7 +142,7 @@
                                <element name="MySQLReplayCache">
                                        <complexType>
                                                <sequence>
-                                                       <element name="Argument" type="string" minOccurs="0" maxOccurs="unbounded"/>
+                                                       <element name="Argument" type="conf:string" minOccurs="0" maxOccurs="unbounded"/>
                                                </sequence>
                                                <anyAttribute namespace="##other" processContents="lax"/>
                                        </complexType>
@@ -140,19 +151,19 @@
                        </choice>
                        <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                </sequence>
-               <attribute name="logger" type="anyURI" use="optional"/>
+               <attribute name="logger" type="anyURI"/>
                <anyAttribute namespace="##other" processContents="lax"/>
        </complexType>
 
        <attributeGroup name="SessionCacheProperties">
-       <attribute name="cleanupInterval" type="unsignedInt" use="optional" default="300"/>
-       <attribute name="cacheTimeout" type="unsignedInt" use="optional" default="28800"/>
-               <attribute name="AAConnectTimeout" type="unsignedInt" use="optional" default="15"/>
-               <attribute name="AATimeout" type="unsignedInt" use="optional" default="30"/>
-               <attribute name="defaultLifetime" type="unsignedInt" use="optional" default="1800"/>
-               <attribute name="retryInterval" type="unsignedInt" use="optional" default="300"/>
-               <attribute name="strictValidity" type="boolean" use="optional" default="true"/>
-               <attribute name="propagateErrors" type="boolean" use="optional" default="false"/>
+       <attribute name="cleanupInterval" type="unsignedInt" default="300"/>
+       <attribute name="cacheTimeout" type="unsignedInt" default="28800"/>
+               <attribute name="AAConnectTimeout" type="unsignedInt" default="15"/>
+               <attribute name="AATimeout" type="unsignedInt" default="30"/>
+               <attribute name="defaultLifetime" type="unsignedInt" default="1800"/>
+               <attribute name="retryInterval" type="unsignedInt" default="300"/>
+               <attribute name="strictValidity" type="boolean" default="true"/>
+               <attribute name="propagateErrors" type="boolean" default="false"/>
        </attributeGroup>
 
        <complexType name="LocalConfigurationType">
@@ -175,8 +186,13 @@
                        </element>
                        <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                </sequence>
-               <attribute name="logger" type="anyURI" use="optional"/>
-               <attribute name="localRelayState" type="boolean" use="optional" default="false"/>
+               <attribute name="logger" type="anyURI"/>
+               <attribute name="localRelayState" type="boolean" default="false"/>
+               <attribute name="unsetHeaderValue" type="conf:string"/>
+               <attribute name="checkSpoofing" type="boolean"/>
+        <attribute name="spoofKey" type="conf:string"/>
+               <attribute name="catchAll" type="boolean"/>
+        <attribute name="allowedSchemes" type="conf:listOfStrings"/>
                <anyAttribute namespace="##other" processContents="lax"/>
        </complexType>
        
@@ -186,18 +202,19 @@
                                <element name="Site" maxOccurs="unbounded">
                                        <complexType>
                                                <sequence>
-                                                       <element name="Alias" type="string" minOccurs="0" maxOccurs="unbounded"/>
+                                                       <element name="Alias" type="conf:string" minOccurs="0" maxOccurs="unbounded"/>
                                                </sequence>
                                                <attribute name="id" type="unsignedInt" use="required"/>
-                                               <attribute name="name" type="string" use="required"/>
-                                               <attribute name="port" type="unsignedInt" use="optional"/>
-                                               <attribute name="sslport" type="unsignedInt" use="optional"/>
-                                               <attribute name="scheme" type="string" use="optional"/>
+                                               <attribute name="name" type="conf:string" use="required"/>
+                                               <attribute name="port" type="unsignedInt"/>
+                                               <attribute name="sslport" type="unsignedInt"/>
+                                               <attribute name="scheme" type="conf:string"/>
                                        </complexType>
                                </element>
                                <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                        </sequence>
-                       <attribute name="normalizeRequest" type="boolean" use="optional"/>
+                       <attribute name="normalizeRequest" type="boolean"/>
+            <attribute name="safeHeaderNames" type="boolean"/>
                        <anyAttribute namespace="##other" processContents="lax"/>
                </complexType>
        </element>
@@ -234,20 +251,18 @@
                <complexType>
                        <simpleContent>
                                <extension base="conf:listOfStrings">
-                                       <attribute name="require" type="string" use="required"/>
+                                       <attribute name="require" type="conf:string" use="required"/>
                                </extension>
                        </simpleContent>
                </complexType>
        </element>
-       <simpleType name="listOfStrings">
-               <list itemType="string"/>
-       </simpleType>
        
        <attributeGroup name="ContentSettings">
-               <attribute name="authType" type="string" use="optional"/>
-               <attribute name="requireSession" type="boolean" use="optional"/>
-               <attribute name="requireSessionWith" type="string" use="optional"/>
-               <attribute name="exportAssertion" type="boolean" use="optional"/>
+               <attribute name="authType" type="conf:string"/>
+               <attribute name="requireSession" type="boolean"/>
+               <attribute name="requireSessionWith" type="conf:string"/>
+               <attribute name="exportAssertion" type="boolean"/>
+               <attribute name="redirectToSSL" type="unsignedInt"/>
                <anyAttribute namespace="##other" processContents="lax"/>
        </attributeGroup>
        <element name="AccessControlProvider" type="conf:PluggableType"/>
@@ -266,9 +281,12 @@
                                        <element ref="conf:AccessControl"/>
                        <element ref="conf:AccessControlProvider"/>
                    </choice>
-                <element ref="conf:Host" minOccurs="0" maxOccurs="unbounded"/>
+               <choice minOccurs="0" maxOccurs="unbounded">
+                       <element ref="conf:Host"/>
+                       <element ref="conf:HostRegex"/>
+               </choice>
             </sequence>
-            <attribute name="applicationId" type="string" fixed="default"/>
+            <attribute name="applicationId" type="conf:string" fixed="default"/>
                <attributeGroup ref="conf:ContentSettings"/>
         </complexType>
     </element>
@@ -281,9 +299,12 @@
                                        <element ref="conf:AccessControl"/>
                        <element ref="conf:AccessControlProvider"/>
                    </choice>
-                       <element ref="conf:Path" minOccurs="0" maxOccurs="unbounded"/>
+                       <choice minOccurs="0" maxOccurs="unbounded">
+                               <element ref="conf:Path"/>
+                               <element ref="conf:PathRegex"/>
+                       </choice>
                </sequence>
-               <attribute name="scheme" use="optional">
+               <attribute name="scheme">
                            <simpleType>
                                <restriction base="string">
                                    <enumeration value="http"/>
@@ -294,13 +315,33 @@
                                </restriction>
                            </simpleType>
                </attribute>
-               <attribute name="name" type="string" use="required"/>
-               <attribute name="port" type="unsignedInt" use="optional"/>
-               <attribute name="applicationId" type="string" use="optional"/>
+               <attribute name="name" type="conf:string" use="required"/>
+               <attribute name="port" type="unsignedInt"/>
+               <attribute name="applicationId" type="conf:string"/>
                <attributeGroup ref="conf:ContentSettings"/>
        </complexType>
     </element>
 
+       <element name="HostRegex">
+               <complexType>
+                       <sequence>
+                               <choice minOccurs="0">
+                                       <element ref="conf:htaccess"/>
+                                       <element ref="conf:AccessControl"/>
+                                       <element ref="conf:AccessControlProvider"/>
+                               </choice>
+                               <choice minOccurs="0" maxOccurs="unbounded">
+                                       <element ref="conf:Path"/>
+                                       <element ref="conf:PathRegex"/>
+                               </choice>
+                       </sequence>
+                       <attribute name="regex" type="conf:string" use="required"/>
+                       <attribute name="ignoreCase" type="boolean" default="true"/>
+                       <attribute name="applicationId" type="conf:string"/>
+                       <attributeGroup ref="conf:ContentSettings"/>
+               </complexType>
+       </element>
+       
     <element name="Path">
         <complexType>
                <sequence>
@@ -309,21 +350,39 @@
                                        <element ref="conf:AccessControl"/>
                        <element ref="conf:AccessControlProvider"/>
                    </choice>
-                       <element ref="conf:Path" minOccurs="0" maxOccurs="unbounded"/>
+                       <choice minOccurs="0" maxOccurs="unbounded">
+                               <element ref="conf:Path"/>
+                               <element ref="conf:PathRegex"/>
+                       </choice>
                </sequence>
-               <attribute name="name" type="string" use="required"/>
-               <attribute name="applicationId" type="string" use="optional"/>
+               <attribute name="name" type="conf:string" use="required"/>
+               <attribute name="applicationId" type="conf:string"/>
                <attributeGroup ref="conf:ContentSettings"/>
         </complexType>
     </element>
 
+       <element name="PathRegex">
+               <complexType>
+                       <sequence>
+                               <choice minOccurs="0">
+                                       <element ref="conf:htaccess"/>
+                                       <element ref="conf:AccessControl"/>
+                                       <element ref="conf:AccessControlProvider"/>
+                               </choice>
+                       </sequence>
+                       <attribute name="regex" type="conf:string" use="required"/>
+                       <attribute name="ignoreCase" type="boolean" default="true"/>
+                       <attribute name="applicationId" type="conf:string"/>
+                       <attributeGroup ref="conf:ContentSettings"/>
+               </complexType>
+       </element>
+       
        <element name="Applications">
                <annotation>
                        <documentation>Container for global target settings and application-specific overrides</documentation>
                </annotation>
                <complexType>
                        <sequence>
-                               <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                                <element ref="conf:Sessions"/>
                                <element ref="conf:Errors"/>
                                <element ref="conf:CredentialUse" minOccurs="0"/>
@@ -337,9 +396,9 @@
                                </choice>
                                <element ref="conf:Application" minOccurs="0" maxOccurs="unbounded"/>
                        </sequence>
-                       <attribute name="id" type="string" fixed="default"/>
+                       <attribute name="id" type="conf:string" fixed="default"/>
                        <attribute name="providerId" type="anyURI" use="required"/>
-                       <attribute name="homeURL" type="anyURI" use="optional"/>
+                       <attribute name="homeURL" type="anyURI"/>
                <anyAttribute namespace="##other" processContents="lax"/>
                </complexType>
        </element>
@@ -350,7 +409,6 @@
                </annotation>
                <complexType>
                        <sequence>
-                               <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                                <element ref="conf:Sessions" minOccurs="0"/>
                                <element ref="conf:Errors" minOccurs="0"/>
                                <element ref="conf:CredentialUse" minOccurs="0"/>
@@ -363,9 +421,9 @@
                     <element name="TrustProvider" type="conf:PluggableType"/>
                                </choice>
                        </sequence>
-                       <attribute name="id" type="string" use="required"/>
-                       <attribute name="providerId" type="anyURI" use="optional"/>
-                       <attribute name="homeURL" type="anyURI" use="optional"/>
+                       <attribute name="id" type="conf:string" use="required"/>
+                       <attribute name="providerId" type="anyURI"/>
+                       <attribute name="homeURL" type="anyURI"/>
                <anyAttribute namespace="##other" processContents="lax"/>
                </complexType>
        </element>
@@ -388,20 +446,22 @@
                                <element ref="conf:SessionInitiator"/>
                                <element ref="md:AssertionConsumerService"/>
                                <element ref="md:SingleLogoutService"/>
+                               <element name="ExtensionService" type="conf:PluggableType"/>
                        </choice>
-                       <!-- deprecated --> <attribute name="wayfURL" type="anyURI" use="optional"/>
-                       <!-- deprecated --> <attribute name="shireURL" type="anyURI" use="optional"/>
-                       <!-- deprecated --> <attribute name="shireSSL" type="boolean" use="optional"/>
-                       <attribute name="handlerURL" type="anyURI" use="optional"/>
-                       <attribute name="handlerSSL" type="boolean" use="optional" default="true"/>
-                       <attribute name="cookieName" type="string" use="optional"/>
-                       <attribute name="cookieProps" type="string" use="optional"/>
-                       <attribute name="idpHistory" type="boolean" use="optional" default="true"/>
-                       <attribute name="idpHistoryDays" type="unsignedInt" use="optional"/>
-                       <attribute name="lifetime" type="unsignedInt" use="optional"/>
-                       <attribute name="timeout" type="unsignedInt" use="optional"/>
-                       <attribute name="checkAddress" type="boolean" use="optional"/>
-                       <attribute name="checkReplay" type="boolean" use="optional" default="true"/>
+                       <!-- deprecated --> <attribute name="wayfURL" type="anyURI"/>
+                       <!-- deprecated --> <attribute name="shireURL" type="anyURI"/>
+                       <!-- deprecated --> <attribute name="shireSSL" type="boolean"/>
+                       <attribute name="handlerURL" type="anyURI"/>
+                       <attribute name="handlerSSL" type="boolean" default="true"/>
+                       <attribute name="cookieName" type="conf:string"/>
+                       <attribute name="cookieProps" type="conf:string"/>
+                       <attribute name="idpHistory" type="boolean" default="true"/>
+                       <attribute name="idpHistoryDays" type="unsignedInt"/>
+                       <attribute name="lifetime" type="unsignedInt"/>
+                       <attribute name="timeout" type="unsignedInt"/>
+                       <attribute name="checkAddress" type="boolean"/>
+                       <attribute name="consistentAddress" type="boolean" default="true"/>
+                       <attribute name="checkReplay" type="boolean" default="true"/>
                        <anyAttribute namespace="##other" processContents="lax"/>
                </complexType>
        </element>
@@ -415,11 +475,12 @@
                        </sequence>
                        <attribute name="Location" type="anyURI" use="required"/>
                        <attribute name="Binding" type="anyURI" use="required"/>
-                       <attribute name="wayfURL" type="anyURI" use="optional"/>
-                       <attribute name="wayfBinding" type="anyURI" use="optional"/>
-                       <attribute name="checkCDC" type="anyURI" use="optional"/>
-                       <attribute name="isDefault" type="boolean" use="optional"/>
-                       <attribute name="id" type="string" use="optional"/>
+                       <attribute name="wayfURL" type="anyURI"/>
+                       <attribute name="wayfBinding" type="anyURI"/>
+                       <attribute name="checkCDC" type="anyURI"/>
+                       <attribute name="isDefault" type="boolean"/>
+                       <attribute name="id" type="conf:string"/>
+                       <anyAttribute namespace="##any" processContents="lax"/>
                </complexType>
        </element>
 
@@ -431,24 +492,39 @@
                        <sequence>
                                <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                        </sequence>
-                       <!-- deprecated --> <attribute name="shire" type="anyURI" use="optional"/>
-                       <attribute name="session" type="anyURI" use="optional"/>
-                       <attribute name="metadata" type="anyURI" use="optional"/>
+                       <!-- deprecated --> <attribute name="shire" type="anyURI"/>
+                       <attribute name="session" type="anyURI"/>
+                       <attribute name="metadata" type="anyURI"/>
                        <attribute name="rm" type="anyURI" use="required"/>
-                       <attribute name="access" type="anyURI" use="optional"/>
-                       <attribute name="supportContact" type="string" use="optional"/>
-                       <attribute name="logoLocation" type="anyURI" use="optional"/>
-                       <attribute name="styleSheet" type="anyURI" use="optional"/>
+                       <attribute name="access" type="anyURI"/>
+                       <attribute name="ssl" type="anyURI"/>
+                       <attribute name="supportContact" type="conf:string"/>
+                       <attribute name="logoLocation" type="anyURI"/>
+                       <attribute name="styleSheet" type="anyURI"/>
                        <anyAttribute namespace="##any" processContents="lax"/>
                </complexType>
        </element>
 
        <attributeGroup name="CredentialUseGroup">
-               <attribute name="TLS" type="string" use="required"/>
-               <attribute name="Signing" type="string" use="required"/>
-               <attribute name="signRequest" type="boolean" use="optional" default="false"/>
-               <attribute name="signedResponse" type="boolean" use="optional" default="false"/>
-               <attribute name="signedAssertions" type="boolean" use="optional" default="false"/>
+               <attribute name="TLS" type="conf:string"/>
+               <attribute name="Signing" type="conf:string"/>
+               <attribute name="signRequest" type="boolean" default="false"/>
+               <attribute name="signatureAlg" type="anyURI"/>
+               <attribute name="digestAlg" type="anyURI"/>
+               <attribute name="signedResponse" type="boolean" default="false"/>
+               <attribute name="signedAssertions" type="boolean" default="false"/>
+               <attribute name="authType">
+                       <simpleType>
+                               <restriction base="string">
+                                       <enumeration value="basic"/>
+                                       <enumeration value="digest"/>
+                                       <enumeration value="ntlm"/>
+                                       <enumeration value="gss"/>
+                               </restriction>
+                       </simpleType>
+               </attribute>
+               <attribute name="authUsername"/>
+               <attribute name="authPassword"/>
        </attributeGroup>
 
        <element name="CredentialUse">
@@ -462,7 +538,7 @@
                                                <sequence>
                                                        <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
                                                </sequence>
-                                               <attribute name="Name" type="string" use="required"/>
+                                               <attribute name="Name" type="conf:string" use="required"/>
                                                <attributeGroup ref="conf:CredentialUseGroup"/>
                                                <anyAttribute namespace="##other" processContents="lax"/>
                                        </complexType>
@@ -473,5 +549,20 @@
                <anyAttribute namespace="##other" processContents="lax"/>
                </complexType>
        </element>
+       
+       <element name="AttributeFactory">
+               <annotation>
+                       <documentation>Specifies a plugin that implements a specialized SAML attribute</documentation>
+               </annotation>
+               <complexType>
+                       <sequence>
+                               <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
+                       </sequence>
+                       <attribute name="type" type="conf:string" use="required"/>
+                       <attribute name="AttributeName" type="conf:string" use="required"/>
+               <anyAttribute namespace="##other" processContents="lax"/>
+               </complexType>
+       </element>
+       
 </schema>