schemas/shibboleth.xsd

   1 <?xml version="1.0" encoding="US-ASCII"?>
   2 <schema targetNamespace="urn:mace:shibboleth:1.0"
   3         xmlns="http://www.w3.org/2001/XMLSchema"
   4         xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
   5         xmlns:xml="http://www.w3.org/XML/1998/namespace"
   6         xmlns:shib="urn:mace:shibboleth:1.0"
   7         elementFormDefault="qualified"
   8         attributeFormDefault="unqualified"
   9         version="1.3">
  10
  11     <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
  12     <import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="xml.xsd"/>
  13
  14     <!-- Status-Related Information -->
  15
  16     <!--
  17     The following SAML sub-status codes are defined in this namespace:
  18
  19         "InvalidHandle"
  20             Used with samlp:Requester, signals AA did not recognize handle as valid
  21     -->
  22
  23     <!--
  24     Relaxes SAML AttributeValue type definition. Xerces-C has a bug that prevents
  25     anyAttribute content appearing on anyType. It works in 2.2 but not in later versions.
  26     -->
  27
  28         <complexType name="AttributeValueType" mixed="true">
  29                 <annotation>
  30                         <documentation xml:lang="en">
  31                         By convention, all Shibboleth 1.1 origin attribute values carry this unconstrained xsi:type.
  32                         </documentation>
  33                 </annotation>
  34                 <complexContent>
  35                         <extension base="anyType"/>
  36                 </complexContent>
  37         </complexType>
  38
  39     <!-- Attribute Acceptance Policies -->
  40
  41     <simpleType name="AttributeRuleValueType">
  42         <restriction base="string">
  43             <enumeration value="literal"/>
  44             <enumeration value="regexp"/>
  45             <enumeration value="xpath"/>
  46         </restriction>
  47     </simpleType>
  48
  49     <complexType name="SiteRuleType">
  50         <sequence>
  51                 <element name="Scope" minOccurs="0" maxOccurs="unbounded">
  52                         <complexType>
  53                     <simpleContent>
  54                         <extension base="string">
  55                                 <attribute name="Accept" type="boolean" use="optional" default="true"/>
  56                             <attribute name="Type" type="shib:AttributeRuleValueType" use="optional" default="literal"/>
  57                             <anyAttribute namespace="##other" processContents="lax"/>
  58                         </extension>
  59                     </simpleContent>
  60                         </complexType>
  61                 </element>
  62                 <choice minOccurs="0">
  63                         <element name="AnyValue">
  64                                 <complexType>
  65                                         <sequence/>
  66                                         <anyAttribute namespace="##other" processContents="lax"/>
  67                                 </complexType>
  68                         </element>
  69                     <element name="Value" maxOccurs="unbounded">
  70                         <complexType>
  71                             <simpleContent>
  72                                 <extension base="string">
  73                                                                 <attribute name="Accept" type="boolean" use="optional" default="true"/>
  74                                     <attribute name="Type" type="shib:AttributeRuleValueType" use="optional" default="literal"/>
  75                                     <anyAttribute namespace="##other" processContents="lax"/>
  76                                 </extension>
  77                             </simpleContent>
  78                         </complexType>
  79                     </element>
  80                 </choice>
  81         </sequence>
  82     </complexType>
  83
  84     <element name="AnySite" type="shib:SiteRuleType"/>
  85     <element name="SiteRule">
  86         <complexType>
  87             <complexContent>
  88                 <extension base="shib:SiteRuleType">
  89                     <attribute name="Name" type="string" use="required"/>
  90                     <anyAttribute namespace="##other" processContents="lax"/>
  91                 </extension>
  92             </complexContent>
  93         </complexType>
  94     </element>
  95
  96     <complexType name="AttributeRuleType">
  97         <sequence>
  98             <element ref="shib:AnySite" minOccurs="0"/>
  99             <element ref="shib:SiteRule" minOccurs="0" maxOccurs="unbounded"/>
 100         </sequence>
 101         <attribute name="Name" type="string" use="required"/>
 102         <attribute name="Namespace" type="string" use="optional"/>
 103         <attribute name="Alias" type="string" use="optional"/>
 104                 <attribute name="Header" type="string" use="optional"/>
 105                 <attribute name="Scoped" type="boolean" use="optional" default="false"/>
 106                 <attribute name="CaseSensitive" type="boolean" use="optional" default="true"/>
 107                 <anyAttribute namespace="##other" processContents="lax"/>
 108     </complexType>
 109
 110     <element name="AttributeRule" type="shib:AttributeRuleType">
 111         <key name="SiteRuleKey">
 112             <selector xpath="./shib:SiteRule"/>
 113             <field xpath="@Name"/>
 114         </key>
 115     </element>
 116
 117     <element name="AttributeAcceptancePolicy">
 118         <complexType>
 119             <sequence>
 120                 <element name="AnyAttribute" minOccurs="0">
 121                     <complexType>
 122                         <sequence/>
 123                     </complexType>
 124                 </element>
 125                 <element ref="shib:AttributeRule" minOccurs="0" maxOccurs="unbounded"/>
 126             </sequence>
 127             <anyAttribute namespace="##other" processContents="lax"/>
 128         </complexType>
 129     </element>
 130
 131
 132     <!-- Shibboleth Metadata -->
 133
 134     <complexType name="SiteType">
 135         <annotation>
 136                 <documentation xml:lang="en">All sites have a Name attribute, plus optional i18n-ized aliases.</documentation>
 137         </annotation>
 138         <sequence>
 139             <element name="Alias" minOccurs="0" maxOccurs="unbounded">
 140                 <complexType>
 141                     <simpleContent>
 142                         <extension base="string">
 143                             <attribute ref="xml:lang"/>
 144                         </extension>
 145                     </simpleContent>
 146                 </complexType>
 147             </element>
 148             <element name="Contact" type="shib:ContactType" minOccurs="0" maxOccurs="unbounded"/>
 149         </sequence>
 150         <attribute name="Name" type="string" use="required"/>
 151         <attribute name="ErrorURL" type="anyURI" use="optional"/>
 152         <anyAttribute namespace="##any" processContents="lax"/>
 153     </complexType>
 154
 155         <simpleType name="ContactTypeType">
 156                 <restriction base="string">
 157             <enumeration value="technical"/>
 158             <enumeration value="support"/>
 159             <enumeration value="administrative"/>
 160             <enumeration value="billing"/>
 161             <enumeration value="other"/>
 162         </restriction>
 163     </simpleType>
 164
 165         <complexType name="ContactType">
 166                 <annotation><documentation xml:lang="en">A human contact for a site.</documentation></annotation>
 167                 <sequence/>
 168         <attribute name="Type" type="shib:ContactTypeType" use="required"/>
 169         <attribute name="Name" type="string" use="required"/>
 170         <attribute name="Email" type="string" use="optional"/>
 171         </complexType>
 172
 173     <complexType name="regexp_string">
 174         <annotation>
 175                 <documentation xml:lang="en">A string element with an optional attribute signaling regexp content.</documentation>
 176         </annotation>
 177         <simpleContent>
 178             <extension base="string">
 179                 <attribute name="regexp" type="boolean" use="optional" default="false"/>
 180             </extension>
 181         </simpleContent>
 182     </complexType>
 183
 184         <complexType name="AuthorityType">
 185                 <annotation>
 186                         <documentation xml:lang="en">Metadata about a SAML authority.</documentation>
 187                 </annotation>
 188         <sequence/>
 189         <attribute name="Name" type="string" use="required"/>
 190         <attribute name="Location" type="anyURI" use="required"/>
 191         <anyAttribute namespace="##any" processContents="lax"/>
 192         </complexType>
 193
 194     <complexType name="OriginSiteType">
 195         <annotation>
 196                 <documentation xml:lang="en">
 197                 Origin sites add at least one handle service (with a name), plus optional domains trusted for attribute scoping.
 198                 </documentation>
 199         </annotation>
 200         <complexContent>
 201                 <extension base="shib:SiteType">
 202                     <sequence>
 203                         <element name="HandleService" type="shib:AuthorityType" maxOccurs="unbounded"/>
 204                         <element name="AttributeAuthority" type="shib:AuthorityType" minOccurs="0" maxOccurs="unbounded"/>
 205                         <element ref="shib:Domain" minOccurs="0" maxOccurs="unbounded"/>
 206                     </sequence>
 207                 </extension>
 208         </complexContent>
 209     </complexType>
 210
 211         <element name="Domain" type="shib:regexp_string">
 212                 <annotation>
 213                         <documentation xml:lang="en">A metadata extension used to regulate allowable attribute scopes.</documentation>
 214                 </annotation>
 215         </element>
 216
 217     <complexType name="DestinationSiteType">
 218         <annotation>
 219                 <documentation xml:lang="en">
 220                 Destination sites add at least one attribute requester (with a name).
 221                 </documentation>
 222         </annotation>
 223         <complexContent>
 224                 <extension base="shib:SiteType">
 225                     <sequence>
 226                         <element name="AssertionConsumerServiceURL" maxOccurs="unbounded">
 227                                 <complexType>
 228                                         <attribute name="Location" type="string" use="required"/>
 229                                                 <attribute name="Id" type="string" use="optional"/>
 230                                                 <anyAttribute namespace="##any" processContents="lax"/>
 231                                 </complexType>
 232                         </element>
 233                         <element name="AttributeRequester" maxOccurs="unbounded">
 234                                 <complexType>
 235                                         <attribute name="Name" type="string" use="required"/>
 236                                                 <anyAttribute namespace="##any" processContents="lax"/>
 237                                 </complexType>
 238                         </element>
 239                     </sequence>
 240                 </extension>
 241         </complexContent>
 242     </complexType>
 243
 244     <complexType name="SiteGroupType">
 245         <annotation>
 246                 <documentation xml:lang="en">Used to logically group sites together, optionally signed.</documentation>
 247         </annotation>
 248         <sequence>
 249             <choice maxOccurs="unbounded">
 250                 <element ref="shib:OriginSite"/>
 251                 <element ref="shib:DestinationSite"/>
 252                 <element ref="shib:SiteGroup"/>
 253             </choice>
 254             <element ref="ds:Signature" minOccurs="0"/>
 255         </sequence>
 256         <attribute name="Name" type="string" use="required"/>
 257         <attribute name="lastChanged" type="dateTime" use="optional"/>
 258         <attribute name="validUntil" type="dateTime" use="optional"/>
 259         <attribute name="cacheDuration" type="duration" use="optional"/>
 260         <anyAttribute namespace="##any" processContents="lax"/>
 261     </complexType>
 262
 263     <element name="OriginSite" type="shib:OriginSiteType"/>
 264     <element name="DestinationSite" type="shib:DestinationSiteType"/>
 265     <element name="SiteGroup" type="shib:SiteGroupType"/>
 266
 267
 268         <!-- Old (pre 1.2) Trust Metadata -->
 269
 270         <complexType name="KeyAuthorityType">
 271                 <annotation>
 272                         <documentation xml:lang="en">
 273                         Binds a set of keying material to one or more named system entities.
 274                         </documentation>
 275                 </annotation>
 276                 <sequence>
 277                         <element ref="ds:KeyInfo"/>
 278                         <element name="Subject" type="shib:regexp_string" minOccurs="0" maxOccurs="unbounded"/>
 279                 </sequence>
 280                 <anyAttribute namespace="##any" processContents="lax"/>
 281         </complexType>
 282         <element name="KeyAuthority" type="shib:KeyAuthorityType"/>
 283
 284         <element name="Trust">
 285                 <annotation>
 286                         <documentation xml:lang="en">An optionally signed collection of KeyAuthority data.</documentation>
 287                 </annotation>
 288                 <complexType>
 289                         <sequence>
 290                                 <element ref="shib:KeyAuthority" maxOccurs="unbounded"/>
 291                                 <element ref="ds:Signature" minOccurs="0"/>
 292                         </sequence>
 293                 <attribute name="lastChanged" type="dateTime" use="optional"/>
 294                 <attribute name="validUntil" type="dateTime" use="optional"/>
 295                 <attribute name="cacheDuration" type="duration" use="optional"/>
 296                 <anyAttribute namespace="##any" processContents="lax"/>
 297                 </complexType>
 298         </element>
 299
 300 </schema>