Config changes and rework for new credential APIs.
[shibboleth/sp.git] / schemas / shibboleth-spconfig-2.0.xsd
1 <?xml version="1.0" encoding="US-ASCII"?>\r
2 <schema targetNamespace="urn:mace:shibboleth:sp:config:2.0"\r
3         xmlns="http://www.w3.org/2001/XMLSchema"\r
4         xmlns:conf="urn:mace:shibboleth:sp:config:2.0"\r
5         xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"\r
6         xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"\r
7         elementFormDefault="qualified"\r
8         attributeFormDefault="unqualified"\r
9         blockDefault="substitution"\r
10         version="2.0">\r
11 \r
12         <import namespace="urn:oasis:names:tc:SAML:2.0:assertion" schemaLocation="saml-schema-assertion-2.0.xsd"/>\r
13         <import namespace="urn:oasis:names:tc:SAML:2.0:metadata" schemaLocation="saml-schema-metadata-2.0.xsd"/>\r
14 \r
15         <annotation>\r
16                 <documentation>\r
17         2.0 schema for XML-based configuration of Shibboleth SP instances.\r
18         First appearing in Shibboleth 2.0 release.\r
19         </documentation>\r
20     </annotation>\r
21 \r
22         <simpleType name="string">
23                 <restriction base="string">
24                         <minLength value="1"/>\r
25                 </restriction>
26         </simpleType>\r
27 \r
28         <simpleType name="listOfStrings">\r
29                 <list itemType="conf:string"/>\r
30         </simpleType>\r
31         \r
32         <complexType name="PluggableType">\r
33                 <sequence>\r
34                         <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
35                 </sequence>\r
36                 <attribute name="type" type="conf:string" use="required"/>\r
37                 <anyAttribute namespace="##any" processContents="lax"/>\r
38         </complexType>\r
39 \r
40         <element name="SPConfig">\r
41                 <complexType>
42                         <annotation>
43                                 <documentation>Root of configuration</documentation>
44                         </annotation>
45                         <sequence>
46                                 <element ref="conf:Extensions" minOccurs="0"/>
47                                 <element ref="conf:OutOfProcess"/>
48                                 <element ref="conf:InProcess"/>
49                                 <element ref="conf:Applications"/>
50                                 <element ref="conf:SecurityPolicies"/>
51                         </sequence>
52                         <attribute name="logger" type="anyURI"/>
53                         <attribute name="clockSkew" type="unsignedInt"/>
54                         <anyAttribute namespace="##other" processContents="lax"/>
55                 </complexType>\r
56         </element>\r
57 \r
58         <element name="Extensions">\r
59                 <annotation>\r
60                         <documentation>Container for extension libraries and custom configuration</documentation>\r
61                 </annotation>\r
62                 <complexType>\r
63                         <sequence>\r
64                                 <element name="Library" minOccurs="0" maxOccurs="unbounded">\r
65                                         <complexType>\r
66                                                 <complexContent>\r
67                                                         <restriction base="conf:PluggableType">\r
68                                                                 <sequence>\r
69                                                                         <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
70                                                                 </sequence>\r
71                                                                 <attribute name="path" type="anyURI" use="required"/>\r
72                                                                 <attribute name="fatal" type="boolean" default="true"/>\r
73                                                         </restriction>\r
74                                                 </complexContent>\r
75                                         </complexType>\r
76                                 </element>\r
77                                 <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
78                         </sequence>\r
79                 </complexType>\r
80         </element>\r
81 \r
82         <element name="StorageService">\r
83                 <annotation>\r
84                         <documentation>References StorageService plugins</documentation>\r
85                 </annotation>\r
86                 <complexType>\r
87                         <complexContent>\r
88                                 <restriction base="conf:PluggableType">\r
89                                         <sequence>\r
90                                                 <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
91                                         </sequence>\r
92                                         <attribute name="id" type="ID" use="required"/>\r
93                                         <attribute name="cleanupInterval" type="unsignedInt" default="900"/>\r
94                                         <anyAttribute namespace="##any" processContents="lax"/>\r
95                                 </restriction>\r
96                         </complexContent>\r
97                 </complexType>\r
98         </element>\r
99 \r
100         <element name="SessionCache">\r
101                 <annotation>\r
102                         <documentation>References SessionCache plugins</documentation>\r
103                 </annotation>\r
104                 <complexType>\r
105                         <complexContent>\r
106                                 <restriction base="conf:PluggableType">\r
107                                         <sequence>\r
108                                                 <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
109                                         </sequence>\r
110                                         <attribute name="StorageService" type="IDREF"/>\r
111                                         <attribute name="cacheTimeout" type="unsignedInt" default="28800"/>\r
112                                         <anyAttribute namespace="##any" processContents="lax"/>\r
113                                 </restriction>\r
114                         </complexContent>\r
115                 </complexType>\r
116         </element>\r
117         \r
118         <element name="ReplayCache">
119                 <annotation>\r
120                         <documentation>Ties ReplayCache to a custom StorageService</documentation>\r
121                 </annotation>\r
122                 <complexType>\r
123                         <sequence/>
124                         <attribute name="StorageService" type="IDREF" use="required"/>\r
125                 </complexType>\r
126         </element>
127         \r
128         <element name="ArtifactMap">
129                 <annotation>\r
130                         <documentation>Customizes an ArtifactMap</documentation>\r
131                 </annotation>\r
132                 <complexType>\r
133                         <sequence/>
134                         <attribute name="StorageService" type="IDREF"/>
135                         <attribute name="context" type="conf:string"/>
136                         <attribute name="artifactTTL" type="unsignedInt" default="180"/>\r
137                 </complexType>
138         </element>\r
139         \r
140         <element name="OutOfProcess">\r
141                 <annotation>\r
142                         <documentation>Container for shibd out-of-process configuration</documentation>\r
143                 </annotation>\r
144                 <complexType>\r
145                         <sequence>
146                                 <element ref="conf:Extensions" minOccurs="0"/>
147                                 <choice>
148                                         <element name="UnixListener">
149                                                 <complexType>
150                                                         <attribute name="address" type="conf:string" use="required"/>
151                                                 </complexType>
152                                         </element>
153                                         <element name="TCPListener">
154                                                 <complexType>
155                                                         <attribute name="address" type="conf:string" use="required"/>
156                                                         <attribute name="port" type="unsignedInt" use="required"/>
157                                                         <attribute name="acl" type="conf:listOfStrings" default="127.0.0.1"/>
158                                                 </complexType>
159                                         </element>
160                                         <element name="Listener" type="conf:PluggableType"/>
161                                 </choice>
162                                 <element ref="conf:StorageService" minOccurs="0" maxOccurs="unbounded"/>
163                                 <element ref="conf:SessionCache" minOccurs="0"/>
164                                 <element ref="conf:ReplayCache" minOccurs="0"/>\r
165                                 <element ref="conf:ArtifactMap" minOccurs="0"/>
166                                 <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
167                         </sequence>
168                         <attribute name="logger" type="anyURI"/>
169                         <anyAttribute namespace="##other" processContents="lax"/>\r
170                 </complexType>\r
171         </element>\r
172 \r
173         <element name="InProcess">\r
174                 <annotation>\r
175                         <documentation>\r
176                         Container for configuration of locally integrated or platform-specific\r
177                         features (e.g. web server filters)\r
178                         </documentation>\r
179                 </annotation>\r
180                 <complexType>\r
181                         <sequence>
182                                 <element ref="conf:Extensions" minOccurs="0"/>
183                                 <element ref="conf:SessionCache" minOccurs="0"/>\r
184                                 <element name="RequestMapper" type="conf:PluggableType"/>
185                                 <element name="Implementation" minOccurs="0">
186                                         <complexType>
187                                                 <sequence>
188                                                         <element ref="conf:ISAPI" minOccurs="0"/>
189                                                         <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
190                                                 </sequence>
191                                         </complexType>
192                                 </element>
193                                 <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
194                         </sequence>
195                         <attribute name="logger" type="anyURI"/>
196                         <anyAttribute namespace="##other" processContents="lax"/>\r
197                 </complexType>\r
198         </element>\r
199         \r
200         <element name="ISAPI">\r
201                 <complexType>\r
202                         <sequence>\r
203                                 <element name="Site" maxOccurs="unbounded">\r
204                                         <complexType>\r
205                                                 <sequence>\r
206                                                         <element name="Alias" type="string" minOccurs="0" maxOccurs="unbounded"/>\r
207                                                 </sequence>\r
208                                                 <attribute name="id" type="unsignedInt" use="required"/>\r
209                                                 <attribute name="name" type="conf:string" use="required"/>\r
210                                                 <attribute name="port" type="unsignedInt"/>\r
211                                                 <attribute name="sslport" type="unsignedInt"/>\r
212                                                 <attribute name="scheme" type="conf:string"/>\r
213                                         </complexType>\r
214                                 </element>\r
215                                 <any namespace="##other" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
216                         </sequence>\r
217                         <attribute name="normalizeRequest" type="boolean" default="true"/>\r
218                         <anyAttribute namespace="##other" processContents="lax"/>\r
219                 </complexType>\r
220         </element>\r
221 \r
222         <element name="AccessControl" type="conf:UniOperatorType">\r
223                 <annotation>\r
224                         <documentation>\r
225                         A simple example access policy language extension that supersedes Apache .htaccess\r
226                         </documentation>\r
227                 </annotation>\r
228         </element>\r
229         <element name="OR" type="conf:MultiOperatorType"/>\r
230         <element name="AND" type="conf:MultiOperatorType"/>\r
231         <element name="NOT" type="conf:UniOperatorType"/>\r
232         <complexType name="UniOperatorType">\r
233                 <choice>\r
234                         <element ref="conf:AND"/>\r
235                         <element ref="conf:OR"/>\r
236                         <element ref="conf:NOT"/>\r
237                         <element ref="conf:Rule"/>\r
238                 </choice>\r
239         </complexType>\r
240         <complexType name="MultiOperatorType">\r
241                 <choice minOccurs="2" maxOccurs="unbounded">\r
242                         <element ref="conf:AND"/>\r
243                         <element ref="conf:OR"/>\r
244                         <element ref="conf:NOT"/>\r
245                         <element ref="conf:Rule"/>\r
246                 </choice>\r
247         </complexType>\r
248         <element name="Rule">\r
249                 <complexType>\r
250                         <simpleContent>\r
251                                 <extension base="conf:listOfStrings">\r
252                                         <attribute name="require" type="conf:string" use="required"/>\r
253                                 </extension>\r
254                         </simpleContent>\r
255                 </complexType>\r
256         </element>\r
257         \r
258         <attributeGroup name="ContentSettings">\r
259                 <attribute name="authType" type="conf:string"/>\r
260                 <attribute name="requireSession" type="boolean"/>\r
261                 <attribute name="requireSessionWith" type="conf:string"/>\r
262                 <attribute name="exportAssertion" type="boolean"/>\r
263                 <attribute name="redirectToSSL" type="unsignedInt"/>\r
264                 <anyAttribute namespace="##other" processContents="lax"/>\r
265         </attributeGroup>\r
266         <element name="AccessControlProvider" type="conf:PluggableType"/>\r
267         <element name="htaccess" type="conf:PluggableType"/>\r
268 \r
269     <element name="RequestMap">\r
270                 <annotation>\r
271                         <documentation>\r
272                         Built-in request mapping syntax, decomposes URLs into Host/Path/Path/...\r
273                         </documentation>\r
274                 </annotation>\r
275         <complexType>\r
276             <sequence>\r
277                 <choice minOccurs="0">\r
278                         <element ref="conf:htaccess"/>\r
279                                         <element ref="conf:AccessControl"/>\r
280                         <element ref="conf:AccessControlProvider"/>\r
281                     </choice>\r
282                 <element ref="conf:Host" minOccurs="0" maxOccurs="unbounded"/>\r
283             </sequence>\r
284             <attribute name="applicationId" type="conf:string" fixed="default"/>\r
285                 <attributeGroup ref="conf:ContentSettings"/>\r
286         </complexType>\r
287     </element>\r
288 \r
289     <element name="Host">\r
290         <complexType>\r
291                 <sequence>\r
292                 <choice minOccurs="0">\r
293                         <element ref="conf:htaccess"/>\r
294                                         <element ref="conf:AccessControl"/>\r
295                         <element ref="conf:AccessControlProvider"/>\r
296                     </choice>\r
297                         <element ref="conf:Path" minOccurs="0" maxOccurs="unbounded"/>\r
298                 </sequence>\r
299                 <attribute name="scheme">\r
300                             <simpleType>\r
301                                 <restriction base="conf:string">\r
302                                     <enumeration value="http"/>\r
303                                     <enumeration value="https"/>\r
304                                     <enumeration value="ftp"/>\r
305                                     <enumeration value="ldap"/>\r
306                                     <enumeration value="ldaps"/>\r
307                                 </restriction>\r
308                             </simpleType>\r
309                 </attribute>\r
310                 <attribute name="name" type="conf:string" use="required"/>\r
311                 <attribute name="port" type="unsignedInt"/>\r
312                 <attribute name="applicationId" type="conf:string"/>\r
313                 <attributeGroup ref="conf:ContentSettings"/>\r
314         </complexType>\r
315     </element>\r
316 \r
317     <element name="Path">\r
318         <complexType>\r
319                 <sequence>\r
320                 <choice minOccurs="0">\r
321                         <element ref="conf:htaccess"/>\r
322                                         <element ref="conf:AccessControl"/>\r
323                         <element ref="conf:AccessControlProvider"/>\r
324                     </choice>\r
325                         <element ref="conf:Path" minOccurs="0" maxOccurs="unbounded"/>\r
326                 </sequence>\r
327                 <attribute name="name" type="conf:string" use="required"/>\r
328                 <attribute name="applicationId" type="conf:string"/>\r
329                 <attributeGroup ref="conf:ContentSettings"/>\r
330         </complexType>\r
331     </element>\r
332 \r
333         <element name="Applications">\r
334                 <annotation>\r
335                         <documentation>Container for global settings and application-specific overrides</documentation>\r
336                 </annotation>\r
337                 <complexType>\r
338                         <sequence>\r
339                                 <element ref="conf:Sessions"/>\r
340                                 <element ref="conf:Errors"/>\r
341                                 <element ref="conf:DefaultRelyingParty"/>\r
342                                 <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>
343                 <element name="MetadataProvider" type="conf:PluggableType"/>
344                                 <element name="TrustEngine" type="conf:PluggableType"/>\r
345                                 <element name="AttributeResolver" type="conf:PluggableType"/>\r
346                                 <element name="CredentialResolver" type="conf:PluggableType" minOccurs="0"/>\r
347                                 <element ref="conf:Application" minOccurs="0" maxOccurs="unbounded"/>\r
348                         </sequence>\r
349                         <attribute name="id" type="conf:string" fixed="default"/>\r
350                         <attribute name="providerId" type="anyURI" use="required"/>\r
351                         <attribute name="policyId" type="conf:string" use="required"/>\r
352                         <attribute name="homeURL" type="anyURI"/>\r
353                 <anyAttribute namespace="##other" processContents="lax"/>\r
354                 </complexType>\r
355         </element>\r
356         \r
357         <element name="Application">\r
358                 <annotation>\r
359                         <documentation>Container for application-specific overrides</documentation>\r
360                 </annotation>\r
361                 <complexType>\r
362                         <sequence>\r
363                                 <element ref="conf:Sessions" minOccurs="0"/>\r
364                                 <element ref="conf:Errors" minOccurs="0"/>\r
365                                 <element ref="conf:DefaultRelyingParty" minOccurs="0"/>\r
366                                 <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>\r
367                                 <element name="MetadataProvider" type="conf:PluggableType" minOccurs="0"/>\r
368                                 <element name="TrustEngine" type="conf:PluggableType" minOccurs="0"/>\r
369                                 <element name="AttributeResolver" type="conf:PluggableType" minOccurs="0"/>\r
370                                 <element name="CredentialResolver" type="conf:PluggableType" minOccurs="0"/>\r
371                         </sequence>\r
372                         <attribute name="id" type="conf:string" use="required"/>\r
373                         <attribute name="providerId" type="anyURI"/>\r
374                         <attribute name="policyId" type="conf:string"/>\r
375                         <attribute name="homeURL" type="anyURI"/>\r
376                 <anyAttribute namespace="##other" processContents="lax"/>\r
377                 </complexType>\r
378         </element>\r
379 \r
380         <element name="Sessions">\r
381                 <annotation>\r
382                         <documentation>Container for specifying protocol handlers and session policy</documentation>\r
383                 </annotation>\r
384                 <complexType>\r
385                         <choice maxOccurs="unbounded">\r
386                                 <element ref="conf:SessionInitiator"/>\r
387                                 <element ref="md:AssertionConsumerService"/>\r
388                                 <element ref="md:SingleLogoutService"/>\r
389                                 <element ref="md:ManageNameIDService"/>\r
390                                 <element name="Handler">
391                                         <complexType>\r
392                                                 <complexContent>\r
393                                                         <restriction base="conf:PluggableType">\r
394                                                                 <sequence>\r
395                                                                         <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
396                                                                 </sequence>\r
397                                                                 <attribute name="Location" type="anyURI" use="required"/>\r
398                                                         </restriction>\r
399                                                 </complexContent>\r
400                                         </complexType>\r
401                                 </element>\r
402                         </choice>\r
403                         <attribute name="handlerURL" type="anyURI"/>\r
404                         <attribute name="handlerSSL" type="boolean" default="true"/>\r
405                         <attribute name="redirectErrors" type="anyURI"/>\r
406                         <attribute name="cookieName" type="conf:string"/>\r
407                         <attribute name="cookieProps" type="conf:string"/>\r
408                         <attribute name="idpHistory" type="boolean" default="true"/>\r
409                         <attribute name="idpHistoryDays" type="unsignedInt"/>\r
410                         <attribute name="lifetime" type="unsignedInt" default="28800"/>\r
411                         <attribute name="timeout" type="unsignedInt" default="3600"/>\r
412                         <attribute name="checkAddress" type="boolean" default="true"/>\r
413                         <attribute name="consistentAddress" type="boolean" default="true"/>\r
414                         <anyAttribute namespace="##other" processContents="lax"/>\r
415                 </complexType>\r
416         </element>\r
417         \r
418         <attribute name="policyId" type="conf:string">
419                 <annotation>
420                         <documentation>Used to reference Policy elements from profile endpoints.</documentation>
421                 </annotation>
422         </attribute>\r
423 \r
424         <element name="SessionInitiator">\r
425                 <annotation>\r
426                         <documentation>Used to specify handlers that can issue AuthnRequests</documentation>\r
427                 </annotation>\r
428                 <complexType>\r
429                         <sequence>\r
430                                 <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
431                         </sequence>\r
432                         <attribute name="Location" type="anyURI" use="required"/>\r
433                         <attribute name="Binding" type="anyURI" use="required"/>\r
434                         <attribute name="id" type="conf:string"/>\r
435                         <attribute name="isDefault" type="boolean"/>\r
436                         <attribute name="wayfURL" type="anyURI"/>\r
437                         <attribute name="wayfBinding" type="anyURI"/>\r
438                         <attribute name="relayState" type="conf:string"/>\r
439                         <anyAttribute namespace="##any" processContents="lax"/>\r
440                 </complexType>\r
441         </element>\r
442 \r
443         <element name="Errors">\r
444                 <annotation>\r
445                         <documentation>Container for error templates and associated details</documentation>\r
446                 </annotation>\r
447                 <complexType>\r
448                         <sequence>\r
449                                 <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>\r
450                         </sequence>\r
451                         <attribute name="session" type="anyURI" use="required"/>\r
452                         <attribute name="metadata" type="anyURI"/>\r
453                         <attribute name="rm" type="anyURI"/>\r
454                         <attribute name="access" type="anyURI"/>\r
455                         <attribute name="ssl" type="anyURI"/>\r
456                         <attribute name="supportContact" type="conf:string"/>\r
457                         <attribute name="logoLocation" type="anyURI"/>\r
458                         <attribute name="styleSheet" type="anyURI"/>\r
459                         <anyAttribute namespace="##any" processContents="lax"/>\r
460                 </complexType>\r
461         </element>\r
462 \r
463         <element name="DefaultRelyingParty">\r
464                 <annotation>\r
465                         <documentation>Container for specifying security methods to use with particular peers</documentation>\r
466                 </annotation>\r
467                 <complexType>\r
468                         <sequence>\r
469                                 <element name="RelyingParty" minOccurs="0" maxOccurs="unbounded">\r
470                                         <complexType>\r
471                                                 <sequence/>\r
472                                                 <attribute name="Name" type="conf:string" use="required"/>\r
473                                                 <attributeGroup ref="conf:RelyingPartyGroup"/>\r
474                                                 <anyAttribute namespace="##other" processContents="lax"/>\r
475                                         </complexType>\r
476                                 </element>\r
477                         </sequence>\r
478                         <attributeGroup ref="conf:RelyingPartyGroup"/>\r
479                 <anyAttribute namespace="##other" processContents="lax"/>\r
480                 </complexType>\r
481         </element>\r
482         \r
483         <attributeGroup name="RelyingPartyGroup">\r
484                 <attribute name="authType" type="conf:string" default="TLS"/>\r
485                 <attribute name="authUsername" type="conf:string"/>\r
486                 <attribute name="authPassword" type="conf:string"/>\r
487                 <attribute name="signRequests" type="boolean" default="false"/>
488                 <attribute name="signatureAlg" type="anyURI"/>\r
489                 <attribute name="encryptRequests" type="boolean" default="true"/>\r
490         </attributeGroup>\r
491         \r
492         <element name="SecurityPolicies">
493                 <annotation>\r
494                         <documentation>Container for specifying sets of policy rules to apply to incoming messages</documentation>\r
495                 </annotation>\r
496                 <complexType>\r
497                         <sequence>\r
498                                 <element name="Policy" minOccurs="1" maxOccurs="unbounded">\r
499                                         <annotation>\r
500                                                 <documentation>Specifies a set of SecurityPolicyRule plugins</documentation>\r
501                                         </annotation>\r
502                                         <complexType>\r
503                                                 <sequence>
504                                                         <element name="Rule" type="conf:PluggableType" minOccurs="1" maxOccurs="unbounded"/>
505                                                 </sequence>
506                                                 <attribute name="id" type="conf:string" use="required"/>\r
507                                                 <attribute name="validate" type="boolean" default="false"/>\r
508                                                 <attribute name="signedAssertions" type="boolean" default="false"/>\r
509                                                 <attribute name="requireConfidentiality" type="boolean" default="true"/>\r
510                                                 <attribute name="requireTransportAuth" type="boolean" default="true"/>\r
511                                                 <attribute name="chunkedEncoding" type="boolean" default="true"/>\r
512                                                 <attribute name="connectTimeout" type="unsignedShort" default="15"/>\r
513                                                 <attribute name="timeout" type="unsignedShort" default="30"/>\r
514                                                 <anyAttribute namespace="##any" processContents="lax"/>\r
515                                         </complexType>\r
516                                 </element>\r
517                         </sequence>\r
518                 </complexType>\r
519         </element>\r
520         \r
521 </schema>\r