samlsso 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (41) hide show
  1. checksums.yaml +7 -0
  2. data/.gitignore +50 -0
  3. data/CODE_OF_CONDUCT.md +49 -0
  4. data/Gemfile +4 -0
  5. data/LICENSE +21 -0
  6. data/README.md +36 -0
  7. data/Rakefile +2 -0
  8. data/bin/console +14 -0
  9. data/bin/setup +8 -0
  10. data/lib/samlsso.rb +16 -0
  11. data/lib/samlsso/attribute_service.rb +32 -0
  12. data/lib/samlsso/attributes.rb +107 -0
  13. data/lib/samlsso/authrequest.rb +124 -0
  14. data/lib/samlsso/idp_metadata_parser.rb +85 -0
  15. data/lib/samlsso/logging.rb +20 -0
  16. data/lib/samlsso/logoutrequest.rb +100 -0
  17. data/lib/samlsso/logoutresponse.rb +110 -0
  18. data/lib/samlsso/metadata.rb +94 -0
  19. data/lib/samlsso/response.rb +271 -0
  20. data/lib/samlsso/saml_message.rb +117 -0
  21. data/lib/samlsso/settings.rb +115 -0
  22. data/lib/samlsso/slo_logoutrequest.rb +64 -0
  23. data/lib/samlsso/slo_logoutresponse.rb +99 -0
  24. data/lib/samlsso/utils.rb +42 -0
  25. data/lib/samlsso/validation_error.rb +5 -0
  26. data/lib/samlsso/version.rb +3 -0
  27. data/lib/schemas/saml-schema-assertion-2.0.xsd +283 -0
  28. data/lib/schemas/saml-schema-authn-context-2.0.xsd +23 -0
  29. data/lib/schemas/saml-schema-authn-context-types-2.0.xsd +821 -0
  30. data/lib/schemas/saml-schema-metadata-2.0.xsd +339 -0
  31. data/lib/schemas/saml-schema-protocol-2.0.xsd +302 -0
  32. data/lib/schemas/sstc-metadata-attr.xsd +35 -0
  33. data/lib/schemas/sstc-saml-attribute-ext.xsd +25 -0
  34. data/lib/schemas/sstc-saml-metadata-algsupport-v1.0.xsd +41 -0
  35. data/lib/schemas/sstc-saml-metadata-ui-v1.0.xsd +89 -0
  36. data/lib/schemas/xenc-schema.xsd +136 -0
  37. data/lib/schemas/xml.xsd +287 -0
  38. data/lib/schemas/xmldsig-core-schema.xsd +309 -0
  39. data/lib/xml_security.rb +276 -0
  40. data/samlsso.gemspec +44 -0
  41. metadata +168 -0
@@ -0,0 +1,3 @@
1
+ module Samlsso
2
+ VERSION = "0.1.0"
3
+ end
@@ -0,0 +1,283 @@
1
+ <?xml version="1.0" encoding="US-ASCII"?>
2
+ <schema
3
+ targetNamespace="urn:oasis:names:tc:SAML:2.0:assertion"
4
+ xmlns="http://www.w3.org/2001/XMLSchema"
5
+ xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
6
+ xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
7
+ xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
8
+ elementFormDefault="unqualified"
9
+ attributeFormDefault="unqualified"
10
+ blockDefault="substitution"
11
+ version="2.0">
12
+ <import namespace="http://www.w3.org/2000/09/xmldsig#"
13
+ schemaLocation="xmldsig-core-schema.xsd"/>
14
+ <import namespace="http://www.w3.org/2001/04/xmlenc#"
15
+ schemaLocation="xenc-schema.xsd"/>
16
+ <annotation>
17
+ <documentation>
18
+ Document identifier: saml-schema-assertion-2.0
19
+ Location: http://docs.oasis-open.org/security/saml/v2.0/
20
+ Revision history:
21
+ V1.0 (November, 2002):
22
+ Initial Standard Schema.
23
+ V1.1 (September, 2003):
24
+ Updates within the same V1.0 namespace.
25
+ V2.0 (March, 2005):
26
+ New assertion schema for SAML V2.0 namespace.
27
+ </documentation>
28
+ </annotation>
29
+ <attributeGroup name="IDNameQualifiers">
30
+ <attribute name="NameQualifier" type="string" use="optional"/>
31
+ <attribute name="SPNameQualifier" type="string" use="optional"/>
32
+ </attributeGroup>
33
+ <element name="BaseID" type="saml:BaseIDAbstractType"/>
34
+ <complexType name="BaseIDAbstractType" abstract="true">
35
+ <attributeGroup ref="saml:IDNameQualifiers"/>
36
+ </complexType>
37
+ <element name="NameID" type="saml:NameIDType"/>
38
+ <complexType name="NameIDType">
39
+ <simpleContent>
40
+ <extension base="string">
41
+ <attributeGroup ref="saml:IDNameQualifiers"/>
42
+ <attribute name="Format" type="anyURI" use="optional"/>
43
+ <attribute name="SPProvidedID" type="string" use="optional"/>
44
+ </extension>
45
+ </simpleContent>
46
+ </complexType>
47
+ <complexType name="EncryptedElementType">
48
+ <sequence>
49
+ <element ref="xenc:EncryptedData"/>
50
+ <element ref="xenc:EncryptedKey" minOccurs="0" maxOccurs="unbounded"/>
51
+ </sequence>
52
+ </complexType>
53
+ <element name="EncryptedID" type="saml:EncryptedElementType"/>
54
+ <element name="Issuer" type="saml:NameIDType"/>
55
+ <element name="AssertionIDRef" type="NCName"/>
56
+ <element name="AssertionURIRef" type="anyURI"/>
57
+ <element name="Assertion" type="saml:AssertionType"/>
58
+ <complexType name="AssertionType">
59
+ <sequence>
60
+ <element ref="saml:Issuer"/>
61
+ <element ref="ds:Signature" minOccurs="0"/>
62
+ <element ref="saml:Subject" minOccurs="0"/>
63
+ <element ref="saml:Conditions" minOccurs="0"/>
64
+ <element ref="saml:Advice" minOccurs="0"/>
65
+ <choice minOccurs="0" maxOccurs="unbounded">
66
+ <element ref="saml:Statement"/>
67
+ <element ref="saml:AuthnStatement"/>
68
+ <element ref="saml:AuthzDecisionStatement"/>
69
+ <element ref="saml:AttributeStatement"/>
70
+ </choice>
71
+ </sequence>
72
+ <attribute name="Version" type="string" use="required"/>
73
+ <attribute name="ID" type="ID" use="required"/>
74
+ <attribute name="IssueInstant" type="dateTime" use="required"/>
75
+ </complexType>
76
+ <element name="Subject" type="saml:SubjectType"/>
77
+ <complexType name="SubjectType">
78
+ <choice>
79
+ <sequence>
80
+ <choice>
81
+ <element ref="saml:BaseID"/>
82
+ <element ref="saml:NameID"/>
83
+ <element ref="saml:EncryptedID"/>
84
+ </choice>
85
+ <element ref="saml:SubjectConfirmation" minOccurs="0" maxOccurs="unbounded"/>
86
+ </sequence>
87
+ <element ref="saml:SubjectConfirmation" maxOccurs="unbounded"/>
88
+ </choice>
89
+ </complexType>
90
+ <element name="SubjectConfirmation" type="saml:SubjectConfirmationType"/>
91
+ <complexType name="SubjectConfirmationType">
92
+ <sequence>
93
+ <choice minOccurs="0">
94
+ <element ref="saml:BaseID"/>
95
+ <element ref="saml:NameID"/>
96
+ <element ref="saml:EncryptedID"/>
97
+ </choice>
98
+ <element ref="saml:SubjectConfirmationData" minOccurs="0"/>
99
+ </sequence>
100
+ <attribute name="Method" type="anyURI" use="required"/>
101
+ </complexType>
102
+ <element name="SubjectConfirmationData" type="saml:SubjectConfirmationDataType"/>
103
+ <complexType name="SubjectConfirmationDataType" mixed="true">
104
+ <complexContent>
105
+ <restriction base="anyType">
106
+ <sequence>
107
+ <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
108
+ </sequence>
109
+ <attribute name="NotBefore" type="dateTime" use="optional"/>
110
+ <attribute name="NotOnOrAfter" type="dateTime" use="optional"/>
111
+ <attribute name="Recipient" type="anyURI" use="optional"/>
112
+ <attribute name="InResponseTo" type="NCName" use="optional"/>
113
+ <attribute name="Address" type="string" use="optional"/>
114
+ <anyAttribute namespace="##other" processContents="lax"/>
115
+ </restriction>
116
+ </complexContent>
117
+ </complexType>
118
+ <complexType name="KeyInfoConfirmationDataType" mixed="false">
119
+ <complexContent>
120
+ <restriction base="saml:SubjectConfirmationDataType">
121
+ <sequence>
122
+ <element ref="ds:KeyInfo" maxOccurs="unbounded"/>
123
+ </sequence>
124
+ </restriction>
125
+ </complexContent>
126
+ </complexType>
127
+ <element name="Conditions" type="saml:ConditionsType"/>
128
+ <complexType name="ConditionsType">
129
+ <choice minOccurs="0" maxOccurs="unbounded">
130
+ <element ref="saml:Condition"/>
131
+ <element ref="saml:AudienceRestriction"/>
132
+ <element ref="saml:OneTimeUse"/>
133
+ <element ref="saml:ProxyRestriction"/>
134
+ </choice>
135
+ <attribute name="NotBefore" type="dateTime" use="optional"/>
136
+ <attribute name="NotOnOrAfter" type="dateTime" use="optional"/>
137
+ </complexType>
138
+ <element name="Condition" type="saml:ConditionAbstractType"/>
139
+ <complexType name="ConditionAbstractType" abstract="true"/>
140
+ <element name="AudienceRestriction" type="saml:AudienceRestrictionType"/>
141
+ <complexType name="AudienceRestrictionType">
142
+ <complexContent>
143
+ <extension base="saml:ConditionAbstractType">
144
+ <sequence>
145
+ <element ref="saml:Audience" maxOccurs="unbounded"/>
146
+ </sequence>
147
+ </extension>
148
+ </complexContent>
149
+ </complexType>
150
+ <element name="Audience" type="anyURI"/>
151
+ <element name="OneTimeUse" type="saml:OneTimeUseType" />
152
+ <complexType name="OneTimeUseType">
153
+ <complexContent>
154
+ <extension base="saml:ConditionAbstractType"/>
155
+ </complexContent>
156
+ </complexType>
157
+ <element name="ProxyRestriction" type="saml:ProxyRestrictionType"/>
158
+ <complexType name="ProxyRestrictionType">
159
+ <complexContent>
160
+ <extension base="saml:ConditionAbstractType">
161
+ <sequence>
162
+ <element ref="saml:Audience" minOccurs="0" maxOccurs="unbounded"/>
163
+ </sequence>
164
+ <attribute name="Count" type="nonNegativeInteger" use="optional"/>
165
+ </extension>
166
+ </complexContent>
167
+ </complexType>
168
+ <element name="Advice" type="saml:AdviceType"/>
169
+ <complexType name="AdviceType">
170
+ <choice minOccurs="0" maxOccurs="unbounded">
171
+ <element ref="saml:AssertionIDRef"/>
172
+ <element ref="saml:AssertionURIRef"/>
173
+ <element ref="saml:Assertion"/>
174
+ <element ref="saml:EncryptedAssertion"/>
175
+ <any namespace="##other" processContents="lax"/>
176
+ </choice>
177
+ </complexType>
178
+ <element name="EncryptedAssertion" type="saml:EncryptedElementType"/>
179
+ <element name="Statement" type="saml:StatementAbstractType"/>
180
+ <complexType name="StatementAbstractType" abstract="true"/>
181
+ <element name="AuthnStatement" type="saml:AuthnStatementType"/>
182
+ <complexType name="AuthnStatementType">
183
+ <complexContent>
184
+ <extension base="saml:StatementAbstractType">
185
+ <sequence>
186
+ <element ref="saml:SubjectLocality" minOccurs="0"/>
187
+ <element ref="saml:AuthnContext"/>
188
+ </sequence>
189
+ <attribute name="AuthnInstant" type="dateTime" use="required"/>
190
+ <attribute name="SessionIndex" type="string" use="optional"/>
191
+ <attribute name="SessionNotOnOrAfter" type="dateTime" use="optional"/>
192
+ </extension>
193
+ </complexContent>
194
+ </complexType>
195
+ <element name="SubjectLocality" type="saml:SubjectLocalityType"/>
196
+ <complexType name="SubjectLocalityType">
197
+ <attribute name="Address" type="string" use="optional"/>
198
+ <attribute name="DNSName" type="string" use="optional"/>
199
+ </complexType>
200
+ <element name="AuthnContext" type="saml:AuthnContextType"/>
201
+ <complexType name="AuthnContextType">
202
+ <sequence>
203
+ <choice>
204
+ <sequence>
205
+ <element ref="saml:AuthnContextClassRef"/>
206
+ <choice minOccurs="0">
207
+ <element ref="saml:AuthnContextDecl"/>
208
+ <element ref="saml:AuthnContextDeclRef"/>
209
+ </choice>
210
+ </sequence>
211
+ <choice>
212
+ <element ref="saml:AuthnContextDecl"/>
213
+ <element ref="saml:AuthnContextDeclRef"/>
214
+ </choice>
215
+ </choice>
216
+ <element ref="saml:AuthenticatingAuthority" minOccurs="0" maxOccurs="unbounded"/>
217
+ </sequence>
218
+ </complexType>
219
+ <element name="AuthnContextClassRef" type="anyURI"/>
220
+ <element name="AuthnContextDeclRef" type="anyURI"/>
221
+ <element name="AuthnContextDecl" type="anyType"/>
222
+ <element name="AuthenticatingAuthority" type="anyURI"/>
223
+ <element name="AuthzDecisionStatement" type="saml:AuthzDecisionStatementType"/>
224
+ <complexType name="AuthzDecisionStatementType">
225
+ <complexContent>
226
+ <extension base="saml:StatementAbstractType">
227
+ <sequence>
228
+ <element ref="saml:Action" maxOccurs="unbounded"/>
229
+ <element ref="saml:Evidence" minOccurs="0"/>
230
+ </sequence>
231
+ <attribute name="Resource" type="anyURI" use="required"/>
232
+ <attribute name="Decision" type="saml:DecisionType" use="required"/>
233
+ </extension>
234
+ </complexContent>
235
+ </complexType>
236
+ <simpleType name="DecisionType">
237
+ <restriction base="string">
238
+ <enumeration value="Permit"/>
239
+ <enumeration value="Deny"/>
240
+ <enumeration value="Indeterminate"/>
241
+ </restriction>
242
+ </simpleType>
243
+ <element name="Action" type="saml:ActionType"/>
244
+ <complexType name="ActionType">
245
+ <simpleContent>
246
+ <extension base="string">
247
+ <attribute name="Namespace" type="anyURI" use="required"/>
248
+ </extension>
249
+ </simpleContent>
250
+ </complexType>
251
+ <element name="Evidence" type="saml:EvidenceType"/>
252
+ <complexType name="EvidenceType">
253
+ <choice maxOccurs="unbounded">
254
+ <element ref="saml:AssertionIDRef"/>
255
+ <element ref="saml:AssertionURIRef"/>
256
+ <element ref="saml:Assertion"/>
257
+ <element ref="saml:EncryptedAssertion"/>
258
+ </choice>
259
+ </complexType>
260
+ <element name="AttributeStatement" type="saml:AttributeStatementType"/>
261
+ <complexType name="AttributeStatementType">
262
+ <complexContent>
263
+ <extension base="saml:StatementAbstractType">
264
+ <choice maxOccurs="unbounded">
265
+ <element ref="saml:Attribute"/>
266
+ <element ref="saml:EncryptedAttribute"/>
267
+ </choice>
268
+ </extension>
269
+ </complexContent>
270
+ </complexType>
271
+ <element name="Attribute" type="saml:AttributeType"/>
272
+ <complexType name="AttributeType">
273
+ <sequence>
274
+ <element ref="saml:AttributeValue" minOccurs="0" maxOccurs="unbounded"/>
275
+ </sequence>
276
+ <attribute name="Name" type="string" use="required"/>
277
+ <attribute name="NameFormat" type="anyURI" use="optional"/>
278
+ <attribute name="FriendlyName" type="string" use="optional"/>
279
+ <anyAttribute namespace="##other" processContents="lax"/>
280
+ </complexType>
281
+ <element name="AttributeValue" type="anyType" nillable="true"/>
282
+ <element name="EncryptedAttribute" type="saml:EncryptedElementType"/>
283
+ </schema>
@@ -0,0 +1,23 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <xs:schema
3
+ targetNamespace="urn:oasis:names:tc:SAML:2.0:ac"
4
+ xmlns:xs="http://www.w3.org/2001/XMLSchema"
5
+ xmlns="urn:oasis:names:tc:SAML:2.0:ac"
6
+ blockDefault="substitution"
7
+ version="2.0">
8
+
9
+ <xs:annotation>
10
+ <xs:documentation>
11
+ Document identifier: saml-schema-authn-context-2.0
12
+ Location: http://docs.oasis-open.org/security/saml/v2.0/
13
+ Revision history:
14
+ V2.0 (March, 2005):
15
+ New core authentication context schema for SAML V2.0.
16
+ This is just an include of all types from the schema
17
+ referred to in the include statement below.
18
+ </xs:documentation>
19
+ </xs:annotation>
20
+
21
+ <xs:include schemaLocation="saml-schema-authn-context-types-2.0.xsd"/>
22
+
23
+ </xs:schema>
@@ -0,0 +1,821 @@
1
+ <?xml version="1.0" encoding="UTF-8"?>
2
+ <xs:schema
3
+ xmlns:xs="http://www.w3.org/2001/XMLSchema"
4
+ elementFormDefault="qualified"
5
+ version="2.0">
6
+
7
+ <xs:annotation>
8
+ <xs:documentation>
9
+ Document identifier: saml-schema-authn-context-types-2.0
10
+ Location: http://docs.oasis-open.org/security/saml/v2.0/
11
+ Revision history:
12
+ V2.0 (March, 2005):
13
+ New core authentication context schema types for SAML V2.0.
14
+ </xs:documentation>
15
+ </xs:annotation>
16
+
17
+ <xs:element name="AuthenticationContextDeclaration" type="AuthnContextDeclarationBaseType">
18
+ <xs:annotation>
19
+ <xs:documentation>
20
+ A particular assertion on an identity
21
+ provider's part with respect to the authentication
22
+ context associated with an authentication assertion.
23
+ </xs:documentation>
24
+ </xs:annotation>
25
+ </xs:element>
26
+
27
+ <xs:element name="Identification" type="IdentificationType">
28
+ <xs:annotation>
29
+ <xs:documentation>
30
+ Refers to those characteristics that describe the
31
+ processes and mechanisms
32
+ the Authentication Authority uses to initially create
33
+ an association between a Principal
34
+ and the identity (or name) by which the Principal will
35
+ be known
36
+ </xs:documentation>
37
+ </xs:annotation>
38
+ </xs:element>
39
+
40
+ <xs:element name="PhysicalVerification">
41
+ <xs:annotation>
42
+ <xs:documentation>
43
+ This element indicates that identification has been
44
+ performed in a physical
45
+ face-to-face meeting with the principal and not in an
46
+ online manner.
47
+ </xs:documentation>
48
+ </xs:annotation>
49
+ <xs:complexType>
50
+ <xs:attribute name="credentialLevel">
51
+ <xs:simpleType>
52
+ <xs:restriction base="xs:NMTOKEN">
53
+ <xs:enumeration value="primary"/>
54
+ <xs:enumeration value="secondary"/>
55
+ </xs:restriction>
56
+ </xs:simpleType>
57
+ </xs:attribute>
58
+ </xs:complexType>
59
+ </xs:element>
60
+
61
+ <xs:element name="WrittenConsent" type="ExtensionOnlyType"/>
62
+
63
+ <xs:element name="TechnicalProtection" type="TechnicalProtectionBaseType">
64
+ <xs:annotation>
65
+ <xs:documentation>
66
+ Refers to those characterstics that describe how the
67
+ 'secret' (the knowledge or possession
68
+ of which allows the Principal to authenticate to the
69
+ Authentication Authority) is kept secure
70
+ </xs:documentation>
71
+ </xs:annotation>
72
+ </xs:element>
73
+
74
+ <xs:element name="SecretKeyProtection" type="SecretKeyProtectionType">
75
+ <xs:annotation>
76
+ <xs:documentation>
77
+ This element indicates the types and strengths of
78
+ facilities
79
+ of a UA used to protect a shared secret key from
80
+ unauthorized access and/or use.
81
+ </xs:documentation>
82
+ </xs:annotation>
83
+ </xs:element>
84
+
85
+ <xs:element name="PrivateKeyProtection" type="PrivateKeyProtectionType">
86
+ <xs:annotation>
87
+ <xs:documentation>
88
+ This element indicates the types and strengths of
89
+ facilities
90
+ of a UA used to protect a private key from
91
+ unauthorized access and/or use.
92
+ </xs:documentation>
93
+ </xs:annotation>
94
+ </xs:element>
95
+
96
+ <xs:element name="KeyActivation" type="KeyActivationType">
97
+ <xs:annotation>
98
+ <xs:documentation>The actions that must be performed
99
+ before the private key can be used. </xs:documentation>
100
+ </xs:annotation>
101
+ </xs:element>
102
+
103
+ <xs:element name="KeySharing" type="KeySharingType">
104
+ <xs:annotation>
105
+ <xs:documentation>Whether or not the private key is shared
106
+ with the certificate authority.</xs:documentation>
107
+ </xs:annotation>
108
+ </xs:element>
109
+
110
+ <xs:element name="KeyStorage" type="KeyStorageType">
111
+ <xs:annotation>
112
+ <xs:documentation>
113
+ In which medium is the key stored.
114
+ memory - the key is stored in memory.
115
+ smartcard - the key is stored in a smartcard.
116
+ token - the key is stored in a hardware token.
117
+ MobileDevice - the key is stored in a mobile device.
118
+ MobileAuthCard - the key is stored in a mobile
119
+ authentication card.
120
+ </xs:documentation>
121
+ </xs:annotation>
122
+ </xs:element>
123
+
124
+ <xs:element name="SubscriberLineNumber" type="ExtensionOnlyType"/>
125
+ <xs:element name="UserSuffix" type="ExtensionOnlyType"/>
126
+
127
+ <xs:element name="Password" type="PasswordType">
128
+ <xs:annotation>
129
+ <xs:documentation>
130
+ This element indicates that a password (or passphrase)
131
+ has been used to
132
+ authenticate the Principal to a remote system.
133
+ </xs:documentation>
134
+ </xs:annotation>
135
+ </xs:element>
136
+
137
+ <xs:element name="ActivationPin" type="ActivationPinType">
138
+ <xs:annotation>
139
+ <xs:documentation>
140
+ This element indicates that a Pin (Personal
141
+ Identification Number) has been used to authenticate the Principal to
142
+ some local system in order to activate a key.
143
+ </xs:documentation>
144
+ </xs:annotation>
145
+ </xs:element>
146
+
147
+ <xs:element name="Token" type="TokenType">
148
+ <xs:annotation>
149
+ <xs:documentation>
150
+ This element indicates that a hardware or software
151
+ token is used
152
+ as a method of identifying the Principal.
153
+ </xs:documentation>
154
+ </xs:annotation>
155
+ </xs:element>
156
+
157
+ <xs:element name="TimeSyncToken" type="TimeSyncTokenType">
158
+ <xs:annotation>
159
+ <xs:documentation>
160
+ This element indicates that a time synchronization
161
+ token is used to identify the Principal. hardware -
162
+ the time synchonization
163
+ token has been implemented in hardware. software - the
164
+ time synchronization
165
+ token has been implemented in software. SeedLength -
166
+ the length, in bits, of the
167
+ random seed used in the time synchronization token.
168
+ </xs:documentation>
169
+ </xs:annotation>
170
+ </xs:element>
171
+
172
+ <xs:element name="Smartcard" type="ExtensionOnlyType">
173
+ <xs:annotation>
174
+ <xs:documentation>
175
+ This element indicates that a smartcard is used to
176
+ identity the Principal.
177
+ </xs:documentation>
178
+ </xs:annotation>
179
+ </xs:element>
180
+
181
+ <xs:element name="Length" type="LengthType">
182
+ <xs:annotation>
183
+ <xs:documentation>
184
+ This element indicates the minimum and/or maximum
185
+ ASCII length of the password which is enforced (by the UA or the
186
+ IdP). In other words, this is the minimum and/or maximum number of
187
+ ASCII characters required to represent a valid password.
188
+ min - the minimum number of ASCII characters required
189
+ in a valid password, as enforced by the UA or the IdP.
190
+ max - the maximum number of ASCII characters required
191
+ in a valid password, as enforced by the UA or the IdP.
192
+ </xs:documentation>
193
+ </xs:annotation>
194
+ </xs:element>
195
+
196
+ <xs:element name="ActivationLimit" type="ActivationLimitType">
197
+ <xs:annotation>
198
+ <xs:documentation>
199
+ This element indicates the length of time for which an
200
+ PIN-based authentication is valid.
201
+ </xs:documentation>
202
+ </xs:annotation>
203
+ </xs:element>
204
+
205
+ <xs:element name="Generation">
206
+ <xs:annotation>
207
+ <xs:documentation>
208
+ Indicates whether the password was chosen by the
209
+ Principal or auto-supplied by the Authentication Authority.
210
+ principalchosen - the Principal is allowed to choose
211
+ the value of the password. This is true even if
212
+ the initial password is chosen at random by the UA or
213
+ the IdP and the Principal is then free to change
214
+ the password.
215
+ automatic - the password is chosen by the UA or the
216
+ IdP to be cryptographically strong in some sense,
217
+ or to satisfy certain password rules, and that the
218
+ Principal is not free to change it or to choose a new password.
219
+ </xs:documentation>
220
+ </xs:annotation>
221
+
222
+ <xs:complexType>
223
+ <xs:attribute name="mechanism" use="required">
224
+ <xs:simpleType>
225
+ <xs:restriction base="xs:NMTOKEN">
226
+ <xs:enumeration value="principalchosen"/>
227
+ <xs:enumeration value="automatic"/>
228
+ </xs:restriction>
229
+ </xs:simpleType>
230
+ </xs:attribute>
231
+ </xs:complexType>
232
+ </xs:element>
233
+
234
+ <xs:element name="AuthnMethod" type="AuthnMethodBaseType">
235
+ <xs:annotation>
236
+ <xs:documentation>
237
+ Refers to those characteristics that define the
238
+ mechanisms by which the Principal authenticates to the Authentication
239
+ Authority.
240
+ </xs:documentation>
241
+ </xs:annotation>
242
+ </xs:element>
243
+
244
+ <xs:element name="PrincipalAuthenticationMechanism" type="PrincipalAuthenticationMechanismType">
245
+ <xs:annotation>
246
+ <xs:documentation>
247
+ The method that a Principal employs to perform
248
+ authentication to local system components.
249
+ </xs:documentation>
250
+ </xs:annotation>
251
+ </xs:element>
252
+
253
+ <xs:element name="Authenticator" type="AuthenticatorBaseType">
254
+ <xs:annotation>
255
+ <xs:documentation>
256
+ The method applied to validate a principal's
257
+ authentication across a network
258
+ </xs:documentation>
259
+ </xs:annotation>
260
+ </xs:element>
261
+
262
+ <xs:element name="ComplexAuthenticator" type="ComplexAuthenticatorType">
263
+ <xs:annotation>
264
+ <xs:documentation>
265
+ Supports Authenticators with nested combinations of
266
+ additional complexity.
267
+ </xs:documentation>
268
+ </xs:annotation>
269
+ </xs:element>
270
+
271
+ <xs:element name="PreviousSession" type="ExtensionOnlyType">
272
+ <xs:annotation>
273
+ <xs:documentation>
274
+ Indicates that the Principal has been strongly
275
+ authenticated in a previous session during which the IdP has set a
276
+ cookie in the UA. During the present session the Principal has only
277
+ been authenticated by the UA returning the cookie to the IdP.
278
+ </xs:documentation>
279
+ </xs:annotation>
280
+ </xs:element>
281
+
282
+ <xs:element name="ResumeSession" type="ExtensionOnlyType">
283
+ <xs:annotation>
284
+ <xs:documentation>
285
+ Rather like PreviousSession but using stronger
286
+ security. A secret that was established in a previous session with
287
+ the Authentication Authority has been cached by the local system and
288
+ is now re-used (e.g. a Master Secret is used to derive new session
289
+ keys in TLS, SSL, WTLS).
290
+ </xs:documentation>
291
+ </xs:annotation>
292
+ </xs:element>
293
+
294
+ <xs:element name="ZeroKnowledge" type="ExtensionOnlyType">
295
+ <xs:annotation>
296
+ <xs:documentation>
297
+ This element indicates that the Principal has been
298
+ authenticated by a zero knowledge technique as specified in ISO/IEC
299
+ 9798-5.
300
+ </xs:documentation>
301
+ </xs:annotation>
302
+ </xs:element>
303
+
304
+ <xs:element name="SharedSecretChallengeResponse" type="SharedSecretChallengeResponseType"/>
305
+
306
+ <xs:complexType name="SharedSecretChallengeResponseType">
307
+ <xs:annotation>
308
+ <xs:documentation>
309
+ This element indicates that the Principal has been
310
+ authenticated by a challenge-response protocol utilizing shared secret
311
+ keys and symmetric cryptography.
312
+ </xs:documentation>
313
+ </xs:annotation>
314
+ <xs:sequence>
315
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
316
+ </xs:sequence>
317
+ <xs:attribute name="method" type="xs:anyURI" use="optional"/>
318
+ </xs:complexType>
319
+
320
+ <xs:element name="DigSig" type="PublicKeyType">
321
+ <xs:annotation>
322
+ <xs:documentation>
323
+ This element indicates that the Principal has been
324
+ authenticated by a mechanism which involves the Principal computing a
325
+ digital signature over at least challenge data provided by the IdP.
326
+ </xs:documentation>
327
+ </xs:annotation>
328
+ </xs:element>
329
+
330
+ <xs:element name="AsymmetricDecryption" type="PublicKeyType">
331
+ <xs:annotation>
332
+ <xs:documentation>
333
+ The local system has a private key but it is used
334
+ in decryption mode, rather than signature mode. For example, the
335
+ Authentication Authority generates a secret and encrypts it using the
336
+ local system's public key: the local system then proves it has
337
+ decrypted the secret.
338
+ </xs:documentation>
339
+ </xs:annotation>
340
+ </xs:element>
341
+
342
+ <xs:element name="AsymmetricKeyAgreement" type="PublicKeyType">
343
+ <xs:annotation>
344
+ <xs:documentation>
345
+ The local system has a private key and uses it for
346
+ shared secret key agreement with the Authentication Authority (e.g.
347
+ via Diffie Helman).
348
+ </xs:documentation>
349
+ </xs:annotation>
350
+ </xs:element>
351
+
352
+ <xs:complexType name="PublicKeyType">
353
+ <xs:sequence>
354
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
355
+ </xs:sequence>
356
+ <xs:attribute name="keyValidation" use="optional"/>
357
+ </xs:complexType>
358
+
359
+ <xs:element name="IPAddress" type="ExtensionOnlyType">
360
+ <xs:annotation>
361
+ <xs:documentation>
362
+ This element indicates that the Principal has been
363
+ authenticated through connection from a particular IP address.
364
+ </xs:documentation>
365
+ </xs:annotation>
366
+ </xs:element>
367
+
368
+ <xs:element name="SharedSecretDynamicPlaintext" type="ExtensionOnlyType">
369
+ <xs:annotation>
370
+ <xs:documentation>
371
+ The local system and Authentication Authority
372
+ share a secret key. The local system uses this to encrypt a
373
+ randomised string to pass to the Authentication Authority.
374
+ </xs:documentation>
375
+ </xs:annotation>
376
+ </xs:element>
377
+
378
+ <xs:element name="AuthenticatorTransportProtocol" type="AuthenticatorTransportProtocolType">
379
+ <xs:annotation>
380
+ <xs:documentation>
381
+ The protocol across which Authenticator information is
382
+ transferred to an Authentication Authority verifier.
383
+ </xs:documentation>
384
+ </xs:annotation>
385
+ </xs:element>
386
+
387
+ <xs:element name="HTTP" type="ExtensionOnlyType">
388
+ <xs:annotation>
389
+ <xs:documentation>
390
+ This element indicates that the Authenticator has been
391
+ transmitted using bare HTTP utilizing no additional security
392
+ protocols.
393
+ </xs:documentation>
394
+ </xs:annotation>
395
+ </xs:element>
396
+
397
+ <xs:element name="IPSec" type="ExtensionOnlyType">
398
+ <xs:annotation>
399
+ <xs:documentation>
400
+ This element indicates that the Authenticator has been
401
+ transmitted using a transport mechanism protected by an IPSEC session.
402
+ </xs:documentation>
403
+ </xs:annotation>
404
+ </xs:element>
405
+
406
+ <xs:element name="WTLS" type="ExtensionOnlyType">
407
+ <xs:annotation>
408
+ <xs:documentation>
409
+ This element indicates that the Authenticator has been
410
+ transmitted using a transport mechanism protected by a WTLS session.
411
+ </xs:documentation>
412
+ </xs:annotation>
413
+ </xs:element>
414
+
415
+ <xs:element name="MobileNetworkNoEncryption" type="ExtensionOnlyType">
416
+ <xs:annotation>
417
+ <xs:documentation>
418
+ This element indicates that the Authenticator has been
419
+ transmitted solely across a mobile network using no additional
420
+ security mechanism.
421
+ </xs:documentation>
422
+ </xs:annotation>
423
+ </xs:element>
424
+
425
+ <xs:element name="MobileNetworkRadioEncryption" type="ExtensionOnlyType"/>
426
+ <xs:element name="MobileNetworkEndToEndEncryption" type="ExtensionOnlyType"/>
427
+
428
+ <xs:element name="SSL" type="ExtensionOnlyType">
429
+ <xs:annotation>
430
+ <xs:documentation>
431
+ This element indicates that the Authenticator has been
432
+ transmitted using a transport mechnanism protected by an SSL or TLS
433
+ session.
434
+ </xs:documentation>
435
+ </xs:annotation>
436
+ </xs:element>
437
+
438
+ <xs:element name="PSTN" type="ExtensionOnlyType"/>
439
+ <xs:element name="ISDN" type="ExtensionOnlyType"/>
440
+ <xs:element name="ADSL" type="ExtensionOnlyType"/>
441
+
442
+ <xs:element name="OperationalProtection" type="OperationalProtectionType">
443
+ <xs:annotation>
444
+ <xs:documentation>
445
+ Refers to those characteristics that describe
446
+ procedural security controls employed by the Authentication Authority.
447
+ </xs:documentation>
448
+ </xs:annotation>
449
+ </xs:element>
450
+
451
+ <xs:element name="SecurityAudit" type="SecurityAuditType"/>
452
+ <xs:element name="SwitchAudit" type="ExtensionOnlyType"/>
453
+ <xs:element name="DeactivationCallCenter" type="ExtensionOnlyType"/>
454
+
455
+ <xs:element name="GoverningAgreements" type="GoverningAgreementsType">
456
+ <xs:annotation>
457
+ <xs:documentation>
458
+ Provides a mechanism for linking to external (likely
459
+ human readable) documents in which additional business agreements,
460
+ (e.g. liability constraints, obligations, etc) can be placed.
461
+ </xs:documentation>
462
+ </xs:annotation>
463
+ </xs:element>
464
+
465
+ <xs:element name="GoverningAgreementRef" type="GoverningAgreementRefType"/>
466
+
467
+ <xs:simpleType name="nymType">
468
+ <xs:restriction base="xs:NMTOKEN">
469
+ <xs:enumeration value="anonymity"/>
470
+ <xs:enumeration value="verinymity"/>
471
+ <xs:enumeration value="pseudonymity"/>
472
+ </xs:restriction>
473
+ </xs:simpleType>
474
+
475
+ <xs:complexType name="AuthnContextDeclarationBaseType">
476
+ <xs:sequence>
477
+ <xs:element ref="Identification" minOccurs="0"/>
478
+ <xs:element ref="TechnicalProtection" minOccurs="0"/>
479
+ <xs:element ref="OperationalProtection" minOccurs="0"/>
480
+ <xs:element ref="AuthnMethod" minOccurs="0"/>
481
+ <xs:element ref="GoverningAgreements" minOccurs="0"/>
482
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
483
+ </xs:sequence>
484
+ <xs:attribute name="ID" type="xs:ID" use="optional"/>
485
+ </xs:complexType>
486
+
487
+ <xs:complexType name="IdentificationType">
488
+ <xs:sequence>
489
+ <xs:element ref="PhysicalVerification" minOccurs="0"/>
490
+ <xs:element ref="WrittenConsent" minOccurs="0"/>
491
+ <xs:element ref="GoverningAgreements" minOccurs="0"/>
492
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
493
+ </xs:sequence>
494
+ <xs:attribute name="nym" type="nymType">
495
+ <xs:annotation>
496
+ <xs:documentation>
497
+ This attribute indicates whether or not the
498
+ Identification mechanisms allow the actions of the Principal to be
499
+ linked to an actual end user.
500
+ </xs:documentation>
501
+ </xs:annotation>
502
+ </xs:attribute>
503
+ </xs:complexType>
504
+
505
+ <xs:complexType name="TechnicalProtectionBaseType">
506
+ <xs:sequence>
507
+ <xs:choice minOccurs="0">
508
+ <xs:element ref="PrivateKeyProtection"/>
509
+ <xs:element ref="SecretKeyProtection"/>
510
+ </xs:choice>
511
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
512
+ </xs:sequence>
513
+ </xs:complexType>
514
+
515
+ <xs:complexType name="OperationalProtectionType">
516
+ <xs:sequence>
517
+ <xs:element ref="SecurityAudit" minOccurs="0"/>
518
+ <xs:element ref="DeactivationCallCenter" minOccurs="0"/>
519
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
520
+ </xs:sequence>
521
+ </xs:complexType>
522
+
523
+ <xs:complexType name="AuthnMethodBaseType">
524
+ <xs:sequence>
525
+ <xs:element ref="PrincipalAuthenticationMechanism" minOccurs="0"/>
526
+ <xs:element ref="Authenticator" minOccurs="0"/>
527
+ <xs:element ref="AuthenticatorTransportProtocol" minOccurs="0"/>
528
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
529
+ </xs:sequence>
530
+ </xs:complexType>
531
+
532
+ <xs:complexType name="GoverningAgreementsType">
533
+ <xs:sequence>
534
+ <xs:element ref="GoverningAgreementRef" maxOccurs="unbounded"/>
535
+ </xs:sequence>
536
+ </xs:complexType>
537
+
538
+ <xs:complexType name="GoverningAgreementRefType">
539
+ <xs:attribute name="governingAgreementRef" type="xs:anyURI" use="required"/>
540
+ </xs:complexType>
541
+
542
+ <xs:complexType name="PrincipalAuthenticationMechanismType">
543
+ <xs:sequence>
544
+ <xs:element ref="Password" minOccurs="0"/>
545
+ <xs:element ref="RestrictedPassword" minOccurs="0"/>
546
+ <xs:element ref="Token" minOccurs="0"/>
547
+ <xs:element ref="Smartcard" minOccurs="0"/>
548
+ <xs:element ref="ActivationPin" minOccurs="0"/>
549
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
550
+ </xs:sequence>
551
+ <xs:attribute name="preauth" type="xs:integer" use="optional"/>
552
+ </xs:complexType>
553
+
554
+ <xs:group name="AuthenticatorChoiceGroup">
555
+ <xs:choice>
556
+ <xs:element ref="PreviousSession"/>
557
+ <xs:element ref="ResumeSession"/>
558
+ <xs:element ref="DigSig"/>
559
+ <xs:element ref="Password"/>
560
+ <xs:element ref="RestrictedPassword"/>
561
+ <xs:element ref="ZeroKnowledge"/>
562
+ <xs:element ref="SharedSecretChallengeResponse"/>
563
+ <xs:element ref="SharedSecretDynamicPlaintext"/>
564
+ <xs:element ref="IPAddress"/>
565
+ <xs:element ref="AsymmetricDecryption"/>
566
+ <xs:element ref="AsymmetricKeyAgreement"/>
567
+ <xs:element ref="SubscriberLineNumber"/>
568
+ <xs:element ref="UserSuffix"/>
569
+ <xs:element ref="ComplexAuthenticator"/>
570
+ </xs:choice>
571
+ </xs:group>
572
+
573
+ <xs:group name="AuthenticatorSequenceGroup">
574
+ <xs:sequence>
575
+ <xs:element ref="PreviousSession" minOccurs="0"/>
576
+ <xs:element ref="ResumeSession" minOccurs="0"/>
577
+ <xs:element ref="DigSig" minOccurs="0"/>
578
+ <xs:element ref="Password" minOccurs="0"/>
579
+ <xs:element ref="RestrictedPassword" minOccurs="0"/>
580
+ <xs:element ref="ZeroKnowledge" minOccurs="0"/>
581
+ <xs:element ref="SharedSecretChallengeResponse" minOccurs="0"/>
582
+ <xs:element ref="SharedSecretDynamicPlaintext" minOccurs="0"/>
583
+ <xs:element ref="IPAddress" minOccurs="0"/>
584
+ <xs:element ref="AsymmetricDecryption" minOccurs="0"/>
585
+ <xs:element ref="AsymmetricKeyAgreement" minOccurs="0"/>
586
+ <xs:element ref="SubscriberLineNumber" minOccurs="0"/>
587
+ <xs:element ref="UserSuffix" minOccurs="0"/>
588
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
589
+ </xs:sequence>
590
+ </xs:group>
591
+
592
+ <xs:complexType name="AuthenticatorBaseType">
593
+ <xs:sequence>
594
+ <xs:group ref="AuthenticatorChoiceGroup"/>
595
+ <xs:group ref="AuthenticatorSequenceGroup"/>
596
+ </xs:sequence>
597
+ </xs:complexType>
598
+
599
+ <xs:complexType name="ComplexAuthenticatorType">
600
+ <xs:sequence>
601
+ <xs:group ref="AuthenticatorChoiceGroup"/>
602
+ <xs:group ref="AuthenticatorSequenceGroup"/>
603
+ </xs:sequence>
604
+ </xs:complexType>
605
+
606
+ <xs:complexType name="AuthenticatorTransportProtocolType">
607
+ <xs:sequence>
608
+ <xs:choice minOccurs="0">
609
+ <xs:element ref="HTTP"/>
610
+ <xs:element ref="SSL"/>
611
+ <xs:element ref="MobileNetworkNoEncryption"/>
612
+ <xs:element ref="MobileNetworkRadioEncryption"/>
613
+ <xs:element ref="MobileNetworkEndToEndEncryption"/>
614
+ <xs:element ref="WTLS"/>
615
+ <xs:element ref="IPSec"/>
616
+ <xs:element ref="PSTN"/>
617
+ <xs:element ref="ISDN"/>
618
+ <xs:element ref="ADSL"/>
619
+ </xs:choice>
620
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
621
+ </xs:sequence>
622
+ </xs:complexType>
623
+
624
+ <xs:complexType name="KeyActivationType">
625
+ <xs:sequence>
626
+ <xs:element ref="ActivationPin" minOccurs="0"/>
627
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
628
+ </xs:sequence>
629
+ </xs:complexType>
630
+
631
+ <xs:complexType name="KeySharingType">
632
+ <xs:attribute name="sharing" type="xs:boolean" use="required"/>
633
+ </xs:complexType>
634
+
635
+ <xs:complexType name="PrivateKeyProtectionType">
636
+ <xs:sequence>
637
+ <xs:element ref="KeyActivation" minOccurs="0"/>
638
+ <xs:element ref="KeyStorage" minOccurs="0"/>
639
+ <xs:element ref="KeySharing" minOccurs="0"/>
640
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
641
+ </xs:sequence>
642
+ </xs:complexType>
643
+
644
+ <xs:complexType name="PasswordType">
645
+ <xs:sequence>
646
+ <xs:element ref="Length" minOccurs="0"/>
647
+ <xs:element ref="Alphabet" minOccurs="0"/>
648
+ <xs:element ref="Generation" minOccurs="0"/>
649
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
650
+ </xs:sequence>
651
+ <xs:attribute name="ExternalVerification" type="xs:anyURI" use="optional"/>
652
+ </xs:complexType>
653
+
654
+ <xs:element name="RestrictedPassword" type="RestrictedPasswordType"/>
655
+
656
+ <xs:complexType name="RestrictedPasswordType">
657
+ <xs:complexContent>
658
+ <xs:restriction base="PasswordType">
659
+ <xs:sequence>
660
+ <xs:element name="Length" type="RestrictedLengthType" minOccurs="1"/>
661
+ <xs:element ref="Generation" minOccurs="0"/>
662
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
663
+ </xs:sequence>
664
+ <xs:attribute name="ExternalVerification" type="xs:anyURI" use="optional"/>
665
+ </xs:restriction>
666
+ </xs:complexContent>
667
+ </xs:complexType>
668
+
669
+ <xs:complexType name="RestrictedLengthType">
670
+ <xs:complexContent>
671
+ <xs:restriction base="LengthType">
672
+ <xs:attribute name="min" use="required">
673
+ <xs:simpleType>
674
+ <xs:restriction base="xs:integer">
675
+ <xs:minInclusive value="3"/>
676
+ </xs:restriction>
677
+ </xs:simpleType>
678
+ </xs:attribute>
679
+ <xs:attribute name="max" type="xs:integer" use="optional"/>
680
+ </xs:restriction>
681
+ </xs:complexContent>
682
+ </xs:complexType>
683
+
684
+ <xs:complexType name="ActivationPinType">
685
+ <xs:sequence>
686
+ <xs:element ref="Length" minOccurs="0"/>
687
+ <xs:element ref="Alphabet" minOccurs="0"/>
688
+ <xs:element ref="Generation" minOccurs="0"/>
689
+ <xs:element ref="ActivationLimit" minOccurs="0"/>
690
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
691
+ </xs:sequence>
692
+ </xs:complexType>
693
+
694
+ <xs:element name="Alphabet" type="AlphabetType"/>
695
+ <xs:complexType name="AlphabetType">
696
+ <xs:attribute name="requiredChars" type="xs:string" use="required"/>
697
+ <xs:attribute name="excludedChars" type="xs:string" use="optional"/>
698
+ <xs:attribute name="case" type="xs:string" use="optional"/>
699
+ </xs:complexType>
700
+
701
+ <xs:complexType name="TokenType">
702
+ <xs:sequence>
703
+ <xs:element ref="TimeSyncToken"/>
704
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
705
+ </xs:sequence>
706
+ </xs:complexType>
707
+
708
+ <xs:simpleType name="DeviceTypeType">
709
+ <xs:restriction base="xs:NMTOKEN">
710
+ <xs:enumeration value="hardware"/>
711
+ <xs:enumeration value="software"/>
712
+ </xs:restriction>
713
+ </xs:simpleType>
714
+
715
+ <xs:simpleType name="booleanType">
716
+ <xs:restriction base="xs:NMTOKEN">
717
+ <xs:enumeration value="true"/>
718
+ <xs:enumeration value="false"/>
719
+ </xs:restriction>
720
+ </xs:simpleType>
721
+
722
+ <xs:complexType name="TimeSyncTokenType">
723
+ <xs:attribute name="DeviceType" type="DeviceTypeType" use="required"/>
724
+ <xs:attribute name="SeedLength" type="xs:integer" use="required"/>
725
+ <xs:attribute name="DeviceInHand" type="booleanType" use="required"/>
726
+ </xs:complexType>
727
+
728
+ <xs:complexType name="ActivationLimitType">
729
+ <xs:choice>
730
+ <xs:element ref="ActivationLimitDuration"/>
731
+ <xs:element ref="ActivationLimitUsages"/>
732
+ <xs:element ref="ActivationLimitSession"/>
733
+ </xs:choice>
734
+ </xs:complexType>
735
+
736
+ <xs:element name="ActivationLimitDuration" type="ActivationLimitDurationType">
737
+ <xs:annotation>
738
+ <xs:documentation>
739
+ This element indicates that the Key Activation Limit is
740
+ defined as a specific duration of time.
741
+ </xs:documentation>
742
+ </xs:annotation>
743
+ </xs:element>
744
+
745
+ <xs:element name="ActivationLimitUsages" type="ActivationLimitUsagesType">
746
+ <xs:annotation>
747
+ <xs:documentation>
748
+ This element indicates that the Key Activation Limit is
749
+ defined as a number of usages.
750
+ </xs:documentation>
751
+ </xs:annotation>
752
+ </xs:element>
753
+
754
+ <xs:element name="ActivationLimitSession" type="ActivationLimitSessionType">
755
+ <xs:annotation>
756
+ <xs:documentation>
757
+ This element indicates that the Key Activation Limit is
758
+ the session.
759
+ </xs:documentation>
760
+ </xs:annotation>
761
+ </xs:element>
762
+
763
+ <xs:complexType name="ActivationLimitDurationType">
764
+ <xs:attribute name="duration" type="xs:duration" use="required"/>
765
+ </xs:complexType>
766
+
767
+ <xs:complexType name="ActivationLimitUsagesType">
768
+ <xs:attribute name="number" type="xs:integer" use="required"/>
769
+ </xs:complexType>
770
+
771
+ <xs:complexType name="ActivationLimitSessionType"/>
772
+
773
+ <xs:complexType name="LengthType">
774
+ <xs:attribute name="min" type="xs:integer" use="required"/>
775
+ <xs:attribute name="max" type="xs:integer" use="optional"/>
776
+ </xs:complexType>
777
+
778
+ <xs:simpleType name="mediumType">
779
+ <xs:restriction base="xs:NMTOKEN">
780
+ <xs:enumeration value="memory"/>
781
+ <xs:enumeration value="smartcard"/>
782
+ <xs:enumeration value="token"/>
783
+ <xs:enumeration value="MobileDevice"/>
784
+ <xs:enumeration value="MobileAuthCard"/>
785
+ </xs:restriction>
786
+ </xs:simpleType>
787
+
788
+ <xs:complexType name="KeyStorageType">
789
+ <xs:attribute name="medium" type="mediumType" use="required"/>
790
+ </xs:complexType>
791
+
792
+ <xs:complexType name="SecretKeyProtectionType">
793
+ <xs:sequence>
794
+ <xs:element ref="KeyActivation" minOccurs="0"/>
795
+ <xs:element ref="KeyStorage" minOccurs="0"/>
796
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
797
+ </xs:sequence>
798
+ </xs:complexType>
799
+
800
+ <xs:complexType name="SecurityAuditType">
801
+ <xs:sequence>
802
+ <xs:element ref="SwitchAudit" minOccurs="0"/>
803
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
804
+ </xs:sequence>
805
+ </xs:complexType>
806
+
807
+ <xs:complexType name="ExtensionOnlyType">
808
+ <xs:sequence>
809
+ <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
810
+ </xs:sequence>
811
+ </xs:complexType>
812
+
813
+ <xs:element name="Extension" type="ExtensionType"/>
814
+
815
+ <xs:complexType name="ExtensionType">
816
+ <xs:sequence>
817
+ <xs:any namespace="##other" processContents="lax" maxOccurs="unbounded"/>
818
+ </xs:sequence>
819
+ </xs:complexType>
820
+
821
+ </xs:schema>