From 5f20df00d04c14fa4896fb0d88a72b8fbec78f43 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Skj=C3=B8lberg?= Date: Fri, 26 May 2017 21:37:45 +0200 Subject: [PATCH] [KEYCLOAK-4979] Move picketlink schema, fix resolver and some related tests --- .../core/util/IDFedLSInputResolver.java | 76 +- .../core/util/SchemaManagerUtil.java | 4 +- .../oasis-sstc-saml-schema-assertion-1.1.xsd | 225 +++++ .../saml/v1/saml-schema-assertion-1.0.xsd | 227 +++++ .../saml/v1/saml-schema-protocol-1.1.xsd | 153 ++++ ...rol-xacml-2.0-saml-assertion-schema-os.xsd | 54 ++ ...trol-xacml-2.0-saml-protocol-schema-os.xsd | 63 ++ .../saml/v2/saml-schema-assertion-2.0.xsd | 283 ++++++ .../saml/v2/saml-schema-authn-context-2.0.xsd | 23 + ...chema-authn-context-auth-telephony-2.0.xsd | 81 ++ .../v2/saml-schema-authn-context-ip-2.0.xsd | 65 ++ .../saml-schema-authn-context-ippword-2.0.xsd | 66 ++ ...saml-schema-authn-context-kerberos-2.0.xsd | 83 ++ ...-authn-context-mobileonefactor-reg-2.0.xsd | 186 ++++ ...uthn-context-mobileonefactor-unreg-2.0.xsd | 183 ++++ ...-authn-context-mobiletwofactor-reg-2.0.xsd | 202 +++++ ...uthn-context-mobiletwofactor-unreg-2.0.xsd | 200 +++++ ...hema-authn-context-nomad-telephony-2.0.xsd | 81 ++ ...a-authn-context-personal-telephony-2.0.xsd | 80 ++ .../v2/saml-schema-authn-context-pgp-2.0.xsd | 83 ++ .../v2/saml-schema-authn-context-ppt-2.0.xsd | 81 ++ .../saml-schema-authn-context-pword-2.0.xsd | 64 ++ .../saml-schema-authn-context-session-2.0.xsd | 64 ++ ...aml-schema-authn-context-smartcard-2.0.xsd | 64 ++ ...-schema-authn-context-smartcardpki-2.0.xsd | 129 +++ ...l-schema-authn-context-softwarepki-2.0.xsd | 129 +++ .../v2/saml-schema-authn-context-spki-2.0.xsd | 83 ++ .../v2/saml-schema-authn-context-srp-2.0.xsd | 82 ++ .../saml-schema-authn-context-sslcert-2.0.xsd | 97 +++ ...aml-schema-authn-context-telephony-2.0.xsd | 79 ++ ...saml-schema-authn-context-timesync-2.0.xsd | 105 +++ .../saml-schema-authn-context-types-2.0.xsd | 823 ++++++++++++++++++ .../v2/saml-schema-authn-context-x509-2.0.xsd | 83 ++ .../saml-schema-authn-context-xmldsig-2.0.xsd | 83 ++ .../schema/saml/v2/saml-schema-dce-2.0.xsd | 29 + .../schema/saml/v2/saml-schema-ecp-2.0.xsd | 57 ++ .../saml/v2/saml-schema-metadata-2.0.xsd | 337 +++++++ .../saml/v2/saml-schema-protocol-2.0.xsd | 302 +++++++ .../schema/saml/v2/saml-schema-x500-2.0.xsd | 20 + .../schema/saml/v2/saml-schema-xacml-2.0.xsd | 19 + .../w3c/xmldsig/xmldsig-core-schema.xsd | 319 +++++++ .../schema/w3c/xmlenc/xenc-schema.xsd | 154 ++++ .../schema/w3c/xmlschema/XMLSchema.dtd | 402 +++++++++ .../schema/w3c/xmlschema/datatypes.dtd | 203 +++++ .../resources/schema/w3c/xmlschema/xml.xsd | 124 +++ ...oasis-200401-wss-wssecurity-secext-1.0.xsd | 210 +++++ ...asis-200401-wss-wssecurity-utility-1.0.xsd | 109 +++ .../resources/schema/wstrust/v1_3/ws-addr.xsd | 140 +++ .../schema/wstrust/v1_3/ws-policy.xsd | 117 +++ .../schema/wstrust/v1_3/ws-trust-1.3.xsd | 444 ++++++++++ ...ss_control-xacml-2.0-context-schema-os.xsd | 135 +++ ...ess_control-xacml-2.0-policy-schema-os.xsd | 380 ++++++++ .../core/util/IDFedLSInputResolverTest.java | 77 ++ .../testsuite/saml/ValidationTest.java | 97 +-- 54 files changed, 7967 insertions(+), 92 deletions(-) create mode 100644 saml-core/src/main/resources/schema/saml/v1/oasis-sstc-saml-schema-assertion-1.1.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v1/saml-schema-assertion-1.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v1/saml-schema-protocol-1.1.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-assertion-schema-os.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-protocol-schema-os.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-assertion-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-auth-telephony-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ip-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ippword-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-kerberos-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-nomad-telephony-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-personal-telephony-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pgp-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ppt-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pword-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-session-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcard-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcardpki-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-softwarepki-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-spki-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-srp-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-sslcert-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-telephony-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-timesync-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-types-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-x509-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-xmldsig-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-dce-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-ecp-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-metadata-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-protocol-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-x500-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/saml/v2/saml-schema-xacml-2.0.xsd create mode 100644 saml-core/src/main/resources/schema/w3c/xmldsig/xmldsig-core-schema.xsd create mode 100644 saml-core/src/main/resources/schema/w3c/xmlenc/xenc-schema.xsd create mode 100644 saml-core/src/main/resources/schema/w3c/xmlschema/XMLSchema.dtd create mode 100644 saml-core/src/main/resources/schema/w3c/xmlschema/datatypes.dtd create mode 100644 saml-core/src/main/resources/schema/w3c/xmlschema/xml.xsd create mode 100644 saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-secext-1.0.xsd create mode 100644 saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-utility-1.0.xsd create mode 100644 saml-core/src/main/resources/schema/wstrust/v1_3/ws-addr.xsd create mode 100644 saml-core/src/main/resources/schema/wstrust/v1_3/ws-policy.xsd create mode 100644 saml-core/src/main/resources/schema/wstrust/v1_3/ws-trust-1.3.xsd create mode 100644 saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-context-schema-os.xsd create mode 100644 saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-policy-schema-os.xsd create mode 100644 saml-core/src/test/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolverTest.java diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolver.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolver.java index 41a54b0df7..c5c3c95ddf 100755 --- a/saml-core/src/main/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolver.java +++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolver.java @@ -16,21 +16,19 @@ */ package org.keycloak.saml.processing.core.util; -import org.keycloak.saml.common.PicketLinkLogger; -import org.keycloak.saml.common.PicketLinkLoggerFactory; -import org.keycloak.saml.common.util.StringUtil; -import org.w3c.dom.ls.LSInput; -import org.w3c.dom.ls.LSResourceResolver; - import java.io.IOException; import java.io.InputStream; import java.io.Reader; import java.net.URL; import java.util.Collection; -import java.util.HashMap; +import java.util.HashSet; import java.util.LinkedHashMap; import java.util.Map; +import org.jboss.logging.Logger; +import org.w3c.dom.ls.LSInput; +import org.w3c.dom.ls.LSResourceResolver; + /** * An LSResource Resolver for schema validation * @@ -39,22 +37,22 @@ import java.util.Map; */ public class IDFedLSInputResolver implements LSResourceResolver { - private static final PicketLinkLogger logger = PicketLinkLoggerFactory.getLogger(); + protected static final Logger logger = Logger.getLogger(IDFedLSInputResolver.class); - private static Map lsmap = new HashMap(); - - private static Map schemaLocationMap = new LinkedHashMap(); + private static Map schemaLocationMap = new LinkedHashMap(); // thread safe for reading static { // XML Schema/DTD schemaLocationMap.put("datatypes.dtd", "schema/w3c/xmlschema/datatypes.dtd"); schemaLocationMap.put("XMLSchema.dtd", "schema/w3c/xmlschema/XMLSchema.dtd"); + schemaLocationMap.put("http://www.w3.org/2001/XMLSchema.dtd", "schema/w3c/xmlschema/XMLSchema.dtd"); schemaLocationMap.put("http://www.w3.org/2001/xml.xsd", "schema/w3c/xmlschema/xml.xsd"); // XML DSIG schemaLocationMap.put("http://www.w3.org/2000/09/xmldsig#", "schema/w3c/xmldsig/xmldsig-core-schema.xsd"); schemaLocationMap.put("http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd", "schema/w3c/xmldsig/xmldsig-core-schema.xsd"); + schemaLocationMap.put("http://www.w3.org/TR/xmldsig-core/xmldsig-core-schema.xsd", "schema/w3c/xmldsig/xmldsig-core-schema.xsd"); // XML Enc schemaLocationMap.put("http://www.w3.org/2001/04/xmlenc#", "schema/w3c/xmlenc/xenc-schema.xsd"); @@ -63,14 +61,17 @@ public class IDFedLSInputResolver implements LSResourceResolver { // XACML schemaLocationMap.put("access_control-xacml-2.0-context-schema-os.xsd", - "schema/access_control-xacml-2.0-context-schema-os.xsd"); + "schema/xacml/access_control-xacml-2.0-context-schema-os.xsd"); + schemaLocationMap.put("http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-context-schema-os.xsd", + "schema/xacml/access_control-xacml-2.0-context-schema-os.xsd"); schemaLocationMap.put("access_control-xacml-2.0-policy-schema-os.xsd", - "schema/access_control-xacml-2.0-policy-schema-os.xsd"); + "schema/xacml/access_control-xacml-2.0-policy-schema-os.xsd"); // SAML - schemaLocationMap.put("saml-schema-assertion-2.0.xsd", "schema/saml/v2/saml-schema-assertion-2.0.xsd"); + schemaLocationMap.put("http://www.oasis-open.org/committees/download.php/11027/sstc-saml-schema-assertion-2.0.xsd", "schema/saml/v2/saml-schema-assertion-2.0.xsd"); schemaLocationMap.put("saml-schema-protocol-2.0.xsd", "schema/saml/v2/saml-schema-protocol-2.0.xsd"); + schemaLocationMap.put("http://www.oasis-open.org/committees/download.php/11026/sstc-saml-schema-protocol-2.0.xsd", "schema/saml/v2/saml-schema-protocol-2.0.xsd"); schemaLocationMap.put("saml-schema-metadata-2.0.xsd", "schema/saml/v2/saml-schema-metadata-2.0.xsd"); schemaLocationMap.put("saml-schema-x500-2.0.xsd", "schema/saml/v2/saml-schema-x500-2.0.xsd"); schemaLocationMap.put("saml-schema-xacml-2.0.xsd", "schema/saml/v2/saml-schema-xacml-2.0.xsd"); @@ -89,7 +90,8 @@ public class IDFedLSInputResolver implements LSResourceResolver { schemaLocationMap.put("access_control-xacml-2.0-saml-protocol-schema-os.xsd", "schema/saml/v2/access_control-xacml-2.0-saml-protocol-schema-os.xsd"); - + + // WS-T schemaLocationMap.put("http://docs.oasis-open.org/ws-sx/ws-trust/200512", "schema/wstrust/v1_3/ws-trust-1.3.xsd"); schemaLocationMap.put("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd", @@ -97,42 +99,33 @@ public class IDFedLSInputResolver implements LSResourceResolver { schemaLocationMap.put("http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd", "schema/wstrust/v1_3/oasis-200401-wss-wssecurity-utility-1.0.xsd"); schemaLocationMap.put("http://schemas.xmlsoap.org/ws/2004/09/policy", "schema/wstrust/v1_3/ws-policy.xsd"); + schemaLocationMap.put("http://schemas.xmlsoap.org/ws/2004/09/policy/ws-policy.xsd", "schema/wstrust/v1_3/ws-policy.xsd"); schemaLocationMap.put("http://www.w3.org/2005/08/addressing", "schema/wstrust/v1_3/ws-addr.xsd"); + schemaLocationMap.put("http://www.w3.org/2006/03/addressing/ws-addr.xsd", "schema/wstrust/v1_3/ws-addr.xsd"); } public static Collection schemas() { - Collection schemaValues = schemaLocationMap.values(); + Collection schemaValues = new HashSet(schemaLocationMap.values()); schemaValues.remove("schema/w3c/xmlschema/datatypes.dtd"); schemaValues.remove("schema/w3c/xmlschema/XMLSchema.dtd"); logger.info("Considered the schemas:" + schemaValues); return schemaValues; } - public LSInput resolveResource(String type, String namespaceURI, final String publicId, final String systemId, - final String baseURI) { - LSInput lsi = null; - if (systemId == null) - throw logger.nullValueError("systemid"); - if (StringUtil.isNotNull(systemId) && systemId.endsWith("dtd") && StringUtil.isNotNull(baseURI)) { - lsi = lsmap.get(baseURI); + public IDFedLSInput resolveResource(String type, String namespaceURI, final String publicId, final String systemId, final String baseURI) { + if (systemId == null) { + throw new IllegalArgumentException("Expected systemId"); } - if (lsi == null) - lsi = lsmap.get(systemId); - if (lsi == null) { - final String loc = schemaLocationMap.get(systemId); - if (loc == null) - return null; - - lsi = new PicketLinkLSInput(baseURI, loc, publicId, systemId); - - logger.trace("Loaded:" + lsi); - - lsmap.put(systemId, lsi); + + final String loc = schemaLocationMap.get(systemId); + if (loc == null) { + return null; } - return lsi; + + return new IDFedLSInput(baseURI, loc, publicId, systemId); } - public static class PicketLinkLSInput implements LSInput { + public static class IDFedLSInput implements LSInput { private final String baseURI; @@ -142,7 +135,7 @@ public class IDFedLSInputResolver implements LSResourceResolver { private final String systemId; - public PicketLinkLSInput(String baseURI, String loc, String publicID, String systemID) { + public IDFedLSInput(String baseURI, String loc, String publicID, String systemID) { this.baseURI = baseURI; this.loc = loc; this.publicId = publicID; @@ -159,10 +152,11 @@ public class IDFedLSInputResolver implements LSResourceResolver { try { is = url.openStream(); } catch (IOException e) { - throw new RuntimeException(logger.classNotLoadedError(loc)); + throw new RuntimeException(e); + } + if (is == null) { + throw new RuntimeException("inputstream is null for " + loc); } - if (is == null) - throw logger.nullValueError("inputstream is null for " + loc); return is; } diff --git a/saml-core/src/main/java/org/keycloak/saml/processing/core/util/SchemaManagerUtil.java b/saml-core/src/main/java/org/keycloak/saml/processing/core/util/SchemaManagerUtil.java index f1ffbbfcff..d73c85c4ba 100755 --- a/saml-core/src/main/java/org/keycloak/saml/processing/core/util/SchemaManagerUtil.java +++ b/saml-core/src/main/java/org/keycloak/saml/processing/core/util/SchemaManagerUtil.java @@ -51,8 +51,8 @@ public class SchemaManagerUtil { public static List getXACMLSchemas() { List list = new ArrayList(); - list.add("schema/access_control-xacml-2.0-policy-schema-os.xsd"); - list.add("schema/access_control-xacml-2.0-context-schema-os.xsd"); + list.add("schema/xacml/access_control-xacml-2.0-policy-schema-os.xsd"); + list.add("schema/xacml/access_control-xacml-2.0-context-schema-os.xsd"); return list; } diff --git a/saml-core/src/main/resources/schema/saml/v1/oasis-sstc-saml-schema-assertion-1.1.xsd b/saml-core/src/main/resources/schema/saml/v1/oasis-sstc-saml-schema-assertion-1.1.xsd new file mode 100644 index 0000000000..7d7aa166c6 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v1/oasis-sstc-saml-schema-assertion-1.1.xsd @@ -0,0 +1,225 @@ + + + + + + Document identifier: oasis-sstc-saml-schema-assertion-1.1 + Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security + Revision history: + V1.0 (November, 2002): + Initial standard schema. + V1.1 (September, 2003): + * Note that V1.1 of this schema has the same XML namespace as V1.0. + Rebased ID content directly on XML Schema types + Added DoNotCacheCondition element and DoNotCacheConditionType + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v1/saml-schema-assertion-1.0.xsd b/saml-core/src/main/resources/schema/saml/v1/saml-schema-assertion-1.0.xsd new file mode 100644 index 0000000000..435037346d --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v1/saml-schema-assertion-1.0.xsd @@ -0,0 +1,227 @@ + + + + + + Document identifier: oasis-sstc-saml-schema-assertion-1.1 + Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security + Revision history: + V1.0 (November, 2002): + Initial standard schema. + V1.1 (September, 2003): + * Note that V1.1 of this schema has the same XML namespace as V1.0. + Rebased ID content directly on XML Schema types + Added DoNotCacheCondition element and DoNotCacheConditionType + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v1/saml-schema-protocol-1.1.xsd b/saml-core/src/main/resources/schema/saml/v1/saml-schema-protocol-1.1.xsd new file mode 100644 index 0000000000..7884c8aa20 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v1/saml-schema-protocol-1.1.xsd @@ -0,0 +1,153 @@ + + + + + + + Document identifier: oasis-sstc-saml-schema-protocol-1.1 + Location: http://www.oasis-open.org/committees/documents.php?wg_abbrev=security + Revision history: + V1.0 (November, 2002): + Initial standard schema. + V1.1 (September, 2003): + * Note that V1.1 of this schema has the same XML namespace as V1.0. + Rebased ID content directly on XML Schema types + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-assertion-schema-os.xsd b/saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-assertion-schema-os.xsd new file mode 100644 index 0000000000..be86e3f341 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-assertion-schema-os.xsd @@ -0,0 +1,54 @@ + + + + + + + + + Document identifier: access_control-xacml-2.0-saml-assertion-schema-cd-02.xsd + Location: http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-saml-assertion-schema-cd-os.xsd + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-protocol-schema-os.xsd b/saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-protocol-schema-os.xsd new file mode 100644 index 0000000000..88f0b9b157 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/access_control-xacml-2.0-saml-protocol-schema-os.xsd @@ -0,0 +1,63 @@ + + + + + + + + + Document identifier: access_control-xacml-2.0-saml-protocol-schema-os.xsd + Location: http://docs.oasis-open.org/xacml/2.0/access_control-xacml-2.0-saml-protocol-schema-os.xsd + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-assertion-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-assertion-2.0.xsd new file mode 100644 index 0000000000..cdd365d885 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-assertion-2.0.xsd @@ -0,0 +1,283 @@ + + + + + + + Document identifier: saml-schema-assertion-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V1.0 (November, 2002): + Initial Standard Schema. + V1.1 (September, 2003): + Updates within the same V1.0 namespace. + V2.0 (March, 2005): + New assertion schema for SAML V2.0 namespace. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-2.0.xsd new file mode 100644 index 0000000000..7fbc11b41f --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-2.0.xsd @@ -0,0 +1,23 @@ + + + + + + Document identifier: saml-schema-authn-context-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New core authentication context schema for SAML V2.0. + This is just an include of all types from the schema + referred to in the include statement below. + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-auth-telephony-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-auth-telephony-2.0.xsd new file mode 100644 index 0000000000..fa8e44e802 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-auth-telephony-2.0.xsd @@ -0,0 +1,81 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony + Document identifier: saml-schema-authn-context-auth-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ip-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ip-2.0.xsd new file mode 100644 index 0000000000..db44c738e1 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ip-2.0.xsd @@ -0,0 +1,65 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol + Document identifier: saml-schema-authn-context-ip-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ippword-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ippword-2.0.xsd new file mode 100644 index 0000000000..8d436d2b1f --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ippword-2.0.xsd @@ -0,0 +1,66 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword + Document identifier: saml-schema-authn-context-ippword-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-kerberos-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-kerberos-2.0.xsd new file mode 100644 index 0000000000..e0ddd78e31 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-kerberos-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos + Document identifier: saml-schema-authn-context-kerberos-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd new file mode 100644 index 0000000000..f60d04db0d --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-reg-2.0.xsd @@ -0,0 +1,186 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract + Document identifier: saml-schema-authn-context-mobileonefactor-reg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd new file mode 100644 index 0000000000..d061f2d451 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobileonefactor-unreg-2.0.xsd @@ -0,0 +1,183 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered + Document identifier: saml-schema-authn-context-mobileonefactor-unreg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd new file mode 100644 index 0000000000..9d5e3a3656 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-reg-2.0.xsd @@ -0,0 +1,202 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract + Document identifier: saml-schema-authn-context-mobiletwofactor-reg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd new file mode 100644 index 0000000000..e5d0a7f338 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-mobiletwofactor-unreg-2.0.xsd @@ -0,0 +1,200 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered + Document identifier: saml-schema-authn-context-mobiletwofactor-unreg-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-nomad-telephony-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-nomad-telephony-2.0.xsd new file mode 100644 index 0000000000..f492daa668 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-nomad-telephony-2.0.xsd @@ -0,0 +1,81 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony + Document identifier: saml-schema-authn-context-nomad-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-personal-telephony-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-personal-telephony-2.0.xsd new file mode 100644 index 0000000000..5e8a684a2b --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-personal-telephony-2.0.xsd @@ -0,0 +1,80 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalizedTelephony + Document identifier: saml-schema-authn-context-personal-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pgp-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pgp-2.0.xsd new file mode 100644 index 0000000000..be64d8b796 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pgp-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PGP + Document identifier: saml-schema-authn-context-pgp-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ppt-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ppt-2.0.xsd new file mode 100644 index 0000000000..b24a4ebfb8 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-ppt-2.0.xsd @@ -0,0 +1,81 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport + Document identifier: saml-schema-authn-context-ppt-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pword-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pword-2.0.xsd new file mode 100644 index 0000000000..75952d5cdd --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-pword-2.0.xsd @@ -0,0 +1,64 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Password + Document identifier: saml-schema-authn-context-pword-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-session-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-session-2.0.xsd new file mode 100644 index 0000000000..fea86e7fb1 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-session-2.0.xsd @@ -0,0 +1,64 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession + Document identifier: saml-schema-authn-context-session-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcard-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcard-2.0.xsd new file mode 100644 index 0000000000..abda34e822 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcard-2.0.xsd @@ -0,0 +1,64 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard + Document identifier: saml-schema-authn-context-smartcard-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcardpki-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcardpki-2.0.xsd new file mode 100644 index 0000000000..7d9f5a726a --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-smartcardpki-2.0.xsd @@ -0,0 +1,129 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI + Document identifier: saml-schema-authn-context-smartcardpki-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-softwarepki-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-softwarepki-2.0.xsd new file mode 100644 index 0000000000..bd4cfdfa7d --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-softwarepki-2.0.xsd @@ -0,0 +1,129 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI + Document identifier: saml-schema-authn-context-softwarepki-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-spki-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-spki-2.0.xsd new file mode 100644 index 0000000000..3827cc1cbe --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-spki-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI + Document identifier: saml-schema-authn-context-spki-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-srp-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-srp-2.0.xsd new file mode 100644 index 0000000000..9457ea20c2 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-srp-2.0.xsd @@ -0,0 +1,82 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword + Document identifier: saml-schema-authn-context-srp-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-sslcert-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-sslcert-2.0.xsd new file mode 100644 index 0000000000..a9387ecfed --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-sslcert-2.0.xsd @@ -0,0 +1,97 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient + Document identifier: saml-schema-authn-context-sslcert-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-telephony-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-telephony-2.0.xsd new file mode 100644 index 0000000000..4e4b339799 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-telephony-2.0.xsd @@ -0,0 +1,79 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony + Document identifier: saml-schema-authn-context-telephony-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-timesync-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-timesync-2.0.xsd new file mode 100644 index 0000000000..076e21dee3 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-timesync-2.0.xsd @@ -0,0 +1,105 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken + Document identifier: saml-schema-authn-context-timesync-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-types-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-types-2.0.xsd new file mode 100644 index 0000000000..1df3e68e71 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-types-2.0.xsd @@ -0,0 +1,823 @@ + + + + + + Document identifier: saml-schema-authn-context-types-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New core authentication context schema types for SAML V2.0. + + + + + + + A particular assertion on an identity + provider's part with respect to the authentication + context associated with an authentication assertion. + + + + + + + + Refers to those characteristics that describe the + processes and mechanisms + the Authentication Authority uses to initially create + an association between a Principal + and the identity (or name) by which the Principal will + be known + + + + + + + + This element indicates that identification has been + performed in a physical + face-to-face meeting with the principal and not in an + online manner. + + + + + + + + + + + + + + + + + + + + Refers to those characterstics that describe how the + 'secret' (the knowledge or possession + of which allows the Principal to authenticate to the + Authentication Authority) is kept secure + + + + + + + + This element indicates the types and strengths of + facilities + of a UA used to protect a shared secret key from + unauthorized access and/or use. + + + + + + + + This element indicates the types and strengths of + facilities + of a UA used to protect a private key from + unauthorized access and/or use. + + + + + + + The actions that must be performed + before the private key can be used. + + + + + + + Whether or not the private key is shared + with the certificate authority. + + + + + + + + In which medium is the key stored. + memory - the key is stored in memory. + smartcard - the key is stored in a smartcard. + token - the key is stored in a hardware token. + MobileDevice - the key is stored in a mobile device. + MobileAuthCard - the key is stored in a mobile + authentication card. + + + + + + + + + + + This element indicates that a password (or passphrase) + has been used to + authenticate the Principal to a remote system. + + + + + + + + This element indicates that a Pin (Personal + Identification Number) has been used to authenticate the Principal to + some local system in order to activate a key. + + + + + + + + This element indicates that a hardware or software + token is used + as a method of identifying the Principal. + + + + + + + + This element indicates that a time synchronization + token is used to identify the Principal. hardware - + the time synchonization + token has been implemented in hardware. software - the + time synchronization + token has been implemented in software. SeedLength - + the length, in bits, of the + random seed used in the time synchronization token. + + + + + + + + This element indicates that a smartcard is used to + identity the Principal. + + + + + + + + This element indicates the minimum and/or maximum + ASCII length of the password which is enforced (by the UA or the + IdP). In other words, this is the minimum and/or maximum number of + ASCII characters required to represent a valid password. + min - the minimum number of ASCII characters required + in a valid password, as enforced by the UA or the IdP. + max - the maximum number of ASCII characters required + in a valid password, as enforced by the UA or the IdP. + + + + + + + + This element indicates the length of time for which an + PIN-based authentication is valid. + + + + + + + + Indicates whether the password was chosen by the + Principal or auto-supplied by the Authentication Authority. + principalchosen - the Principal is allowed to choose + the value of the password. This is true even if + the initial password is chosen at random by the UA or + the IdP and the Principal is then free to change + the password. + automatic - the password is chosen by the UA or the + IdP to be cryptographically strong in some sense, + or to satisfy certain password rules, and that the + Principal is not free to change it or to choose a new password. + + + + + + + + + + + + + + + + + + + Refers to those characteristics that define the + mechanisms by which the Principal authenticates to the Authentication + Authority. + + + + + + + + The method that a Principal employs to perform + authentication to local system components. + + + + + + + + The method applied to validate a principal's + authentication across a network + + + + + + + + Supports Authenticators with nested combinations of + additional complexity. + + + + + + + + Indicates that the Principal has been strongly + authenticated in a previous session during which the IdP has set a + cookie in the UA. During the present session the Principal has only + been authenticated by the UA returning the cookie to the IdP. + + + + + + + + Rather like PreviousSession but using stronger + security. A secret that was established in a previous session with + the Authentication Authority has been cached by the local system and + is now re-used (e.g. a Master Secret is used to derive new session + keys in TLS, SSL, WTLS). + + + + + + + + This element indicates that the Principal has been + authenticated by a zero knowledge technique as specified in ISO/IEC + 9798-5. + + + + + + + + + + This element indicates that the Principal has been + authenticated by a challenge-response protocol utilizing shared secret + keys and symmetric cryptography. + + + + + + + + + + + + This element indicates that the Principal has been + authenticated by a mechanism which involves the Principal computing a + digital signature over at least challenge data provided by the IdP. + + + + + + + + The local system has a private key but it is used + in decryption mode, rather than signature mode. For example, the + Authentication Authority generates a secret and encrypts it using the + local system's public key: the local system then proves it has + decrypted the secret. + + + + + + + + The local system has a private key and uses it for + shared secret key agreement with the Authentication Authority (e.g. + via Diffie Helman). + + + + + + + + + + + + + + + This element indicates that the Principal has been + authenticated through connection from a particular IP address. + + + + + + + + The local system and Authentication Authority + share a secret key. The local system uses this to encrypt a + randomised string to pass to the Authentication Authority. + + + + + + + + The protocol across which Authenticator information is + transferred to an Authentication Authority verifier. + + + + + + + + This element indicates that the Authenticator has been + transmitted using bare HTTP utilizing no additional security + protocols. + + + + + + + + This element indicates that the Authenticator has been + transmitted using a transport mechanism protected by an IPSEC session. + + + + + + + + This element indicates that the Authenticator has been + transmitted using a transport mechanism protected by a WTLS session. + + + + + + + + This element indicates that the Authenticator has been + transmitted solely across a mobile network using no additional + security mechanism. + + + + + + + + + + + This element indicates that the Authenticator has been + transmitted using a transport mechnanism protected by an SSL or TLS + session. + + + + + + + + + + + + Refers to those characteristics that describe + procedural security controls employed by the Authentication Authority. + + + + + + + + + + + + Provides a mechanism for linking to external (likely + human readable) documents in which additional business agreements, + (e.g. liability constraints, obligations, etc) can be placed. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + This attribute indicates whether or not the + Identification mechanisms allow the actions of the Principal to be + linked to an actual end user. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + This element indicates that the Key Activation Limit is + defined as a specific duration of time. + + + + + + + + This element indicates that the Key Activation Limit is + defined as a number of usages. + + + + + + + + This element indicates that the Key Activation Limit is + the session. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-x509-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-x509-2.0.xsd new file mode 100644 index 0000000000..112331757f --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-x509-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:X509 + Document identifier: saml-schema-authn-context-x509-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-xmldsig-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-xmldsig-2.0.xsd new file mode 100644 index 0000000000..f4be6abd23 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-authn-context-xmldsig-2.0.xsd @@ -0,0 +1,83 @@ + + + + + + + + + Class identifier: urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig + Document identifier: saml-schema-authn-context-xmldsig-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + New authentication context class schema for SAML V2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-dce-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-dce-2.0.xsd new file mode 100644 index 0000000000..6517ca2e62 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-dce-2.0.xsd @@ -0,0 +1,29 @@ + + + + + Document identifier: saml-schema-dce-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for DCE attribute profile, first published in SAML 2.0. + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-ecp-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-ecp-2.0.xsd new file mode 100644 index 0000000000..37a66dc15b --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-ecp-2.0.xsd @@ -0,0 +1,57 @@ + + + + + + + + Document identifier: saml-schema-ecp-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for ECP profile, first published in SAML 2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-metadata-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-metadata-2.0.xsd new file mode 100644 index 0000000000..5c8d217190 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-metadata-2.0.xsd @@ -0,0 +1,337 @@ + + + + + + + + + Document identifier: saml-schema-metadata-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Schema for SAML metadata, first published in SAML 2.0. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-protocol-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-protocol-2.0.xsd new file mode 100644 index 0000000000..4441fe7dd7 --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-protocol-2.0.xsd @@ -0,0 +1,302 @@ + + + + + + + Document identifier: saml-schema-protocol-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V1.0 (November, 2002): + Initial Standard Schema. + V1.1 (September, 2003): + Updates within the same V1.0 namespace. + V2.0 (March, 2005): + New protocol schema based in a SAML V2.0 namespace. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-x500-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-x500-2.0.xsd new file mode 100644 index 0000000000..8de37c116a --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-x500-2.0.xsd @@ -0,0 +1,20 @@ + + + + + Document identifier: saml-schema-x500-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for X.500 attribute profile, first published in SAML 2.0. + + + + + diff --git a/saml-core/src/main/resources/schema/saml/v2/saml-schema-xacml-2.0.xsd b/saml-core/src/main/resources/schema/saml/v2/saml-schema-xacml-2.0.xsd new file mode 100644 index 0000000000..206fe7fcdc --- /dev/null +++ b/saml-core/src/main/resources/schema/saml/v2/saml-schema-xacml-2.0.xsd @@ -0,0 +1,19 @@ + + + + + Document identifier: saml-schema-xacml-2.0 + Location: http://docs.oasis-open.org/security/saml/v2.0/ + Revision history: + V2.0 (March, 2005): + Custom schema for XACML attribute profile, first published in SAML 2.0. + + + + diff --git a/saml-core/src/main/resources/schema/w3c/xmldsig/xmldsig-core-schema.xsd b/saml-core/src/main/resources/schema/w3c/xmldsig/xmldsig-core-schema.xsd new file mode 100644 index 0000000000..2a8633f653 --- /dev/null +++ b/saml-core/src/main/resources/schema/w3c/xmldsig/xmldsig-core-schema.xsd @@ -0,0 +1,319 @@ + + + + + + ]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/w3c/xmlenc/xenc-schema.xsd b/saml-core/src/main/resources/schema/w3c/xmlenc/xenc-schema.xsd new file mode 100644 index 0000000000..ea16a71b32 --- /dev/null +++ b/saml-core/src/main/resources/schema/w3c/xmlenc/xenc-schema.xsd @@ -0,0 +1,154 @@ + + + + + + ]> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/w3c/xmlschema/XMLSchema.dtd b/saml-core/src/main/resources/schema/w3c/xmlschema/XMLSchema.dtd new file mode 100644 index 0000000000..3803ed6ce8 --- /dev/null +++ b/saml-core/src/main/resources/schema/w3c/xmlschema/XMLSchema.dtd @@ -0,0 +1,402 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + %xs-datatypes; + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/w3c/xmlschema/datatypes.dtd b/saml-core/src/main/resources/schema/w3c/xmlschema/datatypes.dtd new file mode 100644 index 0000000000..facfaad05f --- /dev/null +++ b/saml-core/src/main/resources/schema/w3c/xmlschema/datatypes.dtd @@ -0,0 +1,203 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/w3c/xmlschema/xml.xsd b/saml-core/src/main/resources/schema/w3c/xmlschema/xml.xsd new file mode 100644 index 0000000000..bb46b0e63e --- /dev/null +++ b/saml-core/src/main/resources/schema/w3c/xmlschema/xml.xsd @@ -0,0 +1,124 @@ + + + + + + + See http://www.w3.org/XML/1998/namespace.html and + http://www.w3.org/TR/REC-xml for information about this namespace. + + This schema document describes the XML namespace, in a form + suitable for import by other schema documents. + + Note that local names in this namespace are intended to be defined + only by the World Wide Web Consortium or its subgroups. The + following names are currently defined in this namespace and should + not be used with conflicting semantics by any Working Group, + specification, or document instance: + + base (as an attribute name): denotes an attribute whose value + provides a URI to be used as the base for interpreting any + relative URIs in the scope of the element on which it + appears; its value is inherited. This name is reserved + by virtue of its definition in the XML Base specification. + + lang (as an attribute name): denotes an attribute whose value + is a language code for the natural language of the content of + any element; its value is inherited. This name is reserved + by virtue of its definition in the XML specification. + + space (as an attribute name): denotes an attribute whose + value is a keyword indicating what whitespace processing + discipline is intended for the content of the element; its + value is inherited. This name is reserved by virtue of its + definition in the XML specification. + + Father (in any context at all): denotes Jon Bosak, the chair of + the original XML Working Group. This name is reserved by + the following decision of the W3C XML Plenary and + XML Coordination groups: + + In appreciation for his vision, leadership and dedication + the W3C XML Plenary on this 10th day of February, 2000 + reserves for Jon Bosak in perpetuity the XML name + xml:Father + + + + + This schema defines attributes and an attribute group + suitable for use by + schemas wishing to allow xml:base, xml:lang or xml:space attributes + on elements they define. + + To enable this, such a schema must import this schema + for the XML namespace, e.g. as follows: + <schema . . .> + . . . + <import namespace="http://www.w3.org/XML/1998/namespace" + schemaLocation="http://www.w3.org/2001/03/xml.xsd"/> + + Subsequently, qualified reference to any of the attributes + or the group defined below will have the desired effect, e.g. + + <type . . .> + . . . + <attributeGroup ref="xml:specialAttrs"/> + + will define a type which will schema-validate an instance + element with any of those attributes + + + + + + In keeping with the XML Schema WG's standard versioning + policy, this schema document will persist at + http://www.w3.org/2001/03/xml.xsd. + At the date of issue it can also be found at + http://www.w3.org/2001/xml.xsd. + The schema document at that URI may however change in the future, + in order to remain compatible with the latest version of XML Schema + itself. In other words, if the XML Schema namespace changes, the version + of this document at + http://www.w3.org/2001/xml.xsd will change + accordingly; the version at + http://www.w3.org/2001/03/xml.xsd will not change. + + + + + + In due course, we should install the relevant ISO 2- and 3-letter + codes as the enumerated possible values . . . + + + + + + + + + + + + + + + + + + See http://www.w3.org/TR/xmlbase/ for + information about this attribute. + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-secext-1.0.xsd b/saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-secext-1.0.xsd new file mode 100644 index 0000000000..491430b2bf --- /dev/null +++ b/saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-secext-1.0.xsd @@ -0,0 +1,210 @@ + + + + + + + + + This type represents an element with arbitrary attributes. + + + + + + + + + + + This type is used for password elements per Section 4.1. + + + + + + + + + + This type is used for elements containing stringified binary data. + + + + + + + + + + This type represents a username token per Section 4.1 + + + + + + + + + + + A security token that is encoded in binary + + + + + + + + + + A security token key identifier + + + + + + + + + + Typedef to allow a list of usages (as URIs). + + + + + + This global attribute is used to indicate the usage of a referenced or indicated token within + the containing context + + + + + + This type represents a reference to an external security token. + + + + + + + + This type represents a reference to an embedded security token. + + + + + + + + + + This type is used reference a security token. + + + + + + + + + + + This complexType defines header block to use for security-relevant data directed at a specific + SOAP actor. + + + + + + The use of "any" is to allow extensibility and different forms of security data. + + + + + + + + + This complexType defines a container for elements to be specified from any namespace as + properties/parameters of a DSIG transformation. + + + + + + The use of "any" is to allow extensibility from any namespace. + + + + + + + + This element defines the wsse:UsernameToken element per Section 4.1. + + + + + This element defines the wsse:BinarySecurityToken element per Section 4.2. + + + + + This element defines a security token reference + + + + + This element defines a security token embedded reference + + + + + This element defines a key identifier reference + + + + + This element defines the wsse:SecurityTokenReference per Section 4.3. + + + + + This element defines the wsse:Security SOAP header element per Section 4. + + + + + This element contains properties for transformations from any namespace, including DSIG. + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-utility-1.0.xsd b/saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-utility-1.0.xsd new file mode 100644 index 0000000000..31a68bccc5 --- /dev/null +++ b/saml-core/src/main/resources/schema/wstrust/v1_3/oasis-200401-wss-wssecurity-utility-1.0.xsd @@ -0,0 +1,109 @@ + + + + + + + + This type defines the fault code value for Timestamp message expiration. + + + + + + + + + + + This global attribute supports annotating arbitrary elements with an ID. + + + + + + + Convenience attribute group used to simplify this schema. + + + + + + + + + + This type is for elements whose [children] is a psuedo-dateTime and can have arbitrary attributes. + + + + + + + + + + + + This type is for elements whose [children] is an anyURI and can have arbitrary attributes. + + + + + + + + + + + + + This complex type ties together the timestamp related elements into a composite type. + + + + + + + + + + + + + + + This element allows Timestamps to be applied anywhere element wildcards are present, + including as a SOAP header. + + + + + + + + This element allows an expiration time to be applied anywhere element wildcards are present. + + + + + + + This element allows a creation time to be applied anywhere element wildcards are present. + + + + diff --git a/saml-core/src/main/resources/schema/wstrust/v1_3/ws-addr.xsd b/saml-core/src/main/resources/schema/wstrust/v1_3/ws-addr.xsd new file mode 100644 index 0000000000..58ddcf0044 --- /dev/null +++ b/saml-core/src/main/resources/schema/wstrust/v1_3/ws-addr.xsd @@ -0,0 +1,140 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/wstrust/v1_3/ws-policy.xsd b/saml-core/src/main/resources/schema/wstrust/v1_3/ws-policy.xsd new file mode 100644 index 0000000000..7223b59e74 --- /dev/null +++ b/saml-core/src/main/resources/schema/wstrust/v1_3/ws-policy.xsd @@ -0,0 +1,117 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/saml-core/src/main/resources/schema/wstrust/v1_3/ws-trust-1.3.xsd b/saml-core/src/main/resources/schema/wstrust/v1_3/ws-trust-1.3.xsd new file mode 100644 index 0000000000..be28c3d0d2 --- /dev/null +++ b/saml-core/src/main/resources/schema/wstrust/v1_3/ws-trust-1.3.xsd @@ -0,0 +1,444 @@ + + + + + + + + + + + + + + + Actual content model is non-deterministic, hence wildcard. The following shows intended content model: + + <xs:element ref='wst:TokenType' minOccurs='0' /> + <xs:element ref='wst:RequestType' /> + <xs:element ref='wsp:AppliesTo' minOccurs='0' /> + <xs:element ref='wst:Claims' minOccurs='0' /> + <xs:element ref='wst:Entropy' minOccurs='0' /> + <xs:element ref='wst:Lifetime' minOccurs='0' /> + <xs:element ref='wst:AllowPostdating' minOccurs='0' /> + <xs:element ref='wst:Renewing' minOccurs='0' /> + <xs:element ref='wst:OnBehalfOf' minOccurs='0' /> + <xs:element ref='wst:Issuer' minOccurs='0' /> + <xs:element ref='wst:AuthenticationType' minOccurs='0' /> + <xs:element ref='wst:KeyType' minOccurs='0' /> + <xs:element ref='wst:KeySize' minOccurs='0' /> + <xs:element ref='wst:SignatureAlgorithm' minOccurs='0' /> + <xs:element ref='wst:Encryption' minOccurs='0' /> + <xs:element ref='wst:EncryptionAlgorithm' minOccurs='0' /> + <xs:element ref='wst:CanonicalizationAlgorithm' minOccurs='0' /> + <xs:element ref='wst:ProofEncryption' minOccurs='0' /> + <xs:element ref='wst:UseKey' minOccurs='0' /> + <xs:element ref='wst:SignWith' minOccurs='0' /> + <xs:element ref='wst:EncryptWith' minOccurs='0' /> + <xs:element ref='wst:DelegateTo' minOccurs='0' /> + <xs:element ref='wst:Forwardable' minOccurs='0' /> + <xs:element ref='wst:Delegatable' minOccurs='0' /> + <xs:element ref='wsp:Policy' minOccurs='0' /> + <xs:element ref='wsp:PolicyReference' minOccurs='0' /> + <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' /> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + Actual content model is non-deterministic, hence wildcard. The following shows intended content model: + + <xs:element ref='wst:TokenType' minOccurs='0' /> + <xs:element ref='wst:RequestType' /> + <xs:element ref='wst:RequestedSecurityToken' minOccurs='0' /> + <xs:element ref='wsp:AppliesTo' minOccurs='0' /> + <xs:element ref='wst:RequestedAttachedReference' minOccurs='0' /> + <xs:element ref='wst:RequestedUnattachedReference' minOccurs='0' /> + <xs:element ref='wst:RequestedProofToken' minOccurs='0' /> + <xs:element ref='wst:Entropy' minOccurs='0' /> + <xs:element ref='wst:Lifetime' minOccurs='0' /> + <xs:element ref='wst:Status' minOccurs='0' /> + <xs:element ref='wst:AllowPostdating' minOccurs='0' /> + <xs:element ref='wst:Renewing' minOccurs='0' /> + <xs:element ref='wst:OnBehalfOf' minOccurs='0' /> + <xs:element ref='wst:Issuer' minOccurs='0' /> + <xs:element ref='wst:AuthenticationType' minOccurs='0' /> + <xs:element ref='wst:Authenticator' minOccurs='0' /> + <xs:element ref='wst:KeyType' minOccurs='0' /> + <xs:element ref='wst:KeySize' minOccurs='0' /> + <xs:element ref='wst:SignatureAlgorithm' minOccurs='0' /> + <xs:element ref='wst:Encryption' minOccurs='0' /> + <xs:element ref='wst:EncryptionAlgorithm' minOccurs='0' /> + <xs:element ref='wst:CanonicalizationAlgorithm' minOccurs='0' /> + <xs:element ref='wst:ProofEncryption' minOccurs='0' /> + <xs:element ref='wst:UseKey' minOccurs='0' /> + <xs:element ref='wst:SignWith' minOccurs='0' /> + <xs:element ref='wst:EncryptWith' minOccurs='0' /> + <xs:element ref='wst:DelegateTo' minOccurs='0' /> + <xs:element ref='wst:Forwardable' minOccurs='0' /> + <xs:element ref='wst:Delegatable' minOccurs='0' /> + <xs:element ref='wsp:Policy' minOccurs='0' /> + <xs:element ref='wsp:PolicyReference' minOccurs='0' /> + <xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' /> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + The RequestSecurityTokenCollection (RSTC) element is used to provide multiple RST requests. + One or more RSTR elements in an RSTRC element are returned in the response to the + RequestSecurityTokenCollection. + + + + + + + + + + + + The <wst:RequestSecurityTokenResponseCollection> element (RSTRC) MUST be used to return a security token or + response to a security token request on the final response. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-context-schema-os.xsd b/saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-context-schema-os.xsd new file mode 100644 index 0000000000..51311667aa --- /dev/null +++ b/saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-context-schema-os.xsd @@ -0,0 +1,135 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-policy-schema-os.xsd b/saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-policy-schema-os.xsd new file mode 100644 index 0000000000..51b6dbb65a --- /dev/null +++ b/saml-core/src/main/resources/schema/xacml/access_control-xacml-2.0-policy-schema-os.xsd @@ -0,0 +1,380 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/saml-core/src/test/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolverTest.java b/saml-core/src/test/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolverTest.java new file mode 100644 index 0000000000..48d6a0e68e --- /dev/null +++ b/saml-core/src/test/java/org/keycloak/saml/processing/core/util/IDFedLSInputResolverTest.java @@ -0,0 +1,77 @@ +/* + * Copyright 2017 Red Hat, Inc. and/or its affiliates + * and other contributors as indicated by the @author tags. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.keycloak.saml.processing.core.util; + +import java.io.IOException; +import java.io.InputStream; +import java.net.URL; + +import javax.xml.XMLConstants; +import javax.xml.validation.SchemaFactory; + +import org.junit.Test; +import org.w3c.dom.ls.LSInput; +import org.w3c.dom.ls.LSResourceResolver; + +public class IDFedLSInputResolverTest { + + @Test + public void testSchemaConstruction() throws Exception { + + // make sure there is no outgoing call to get schema online; + // all resources must have a result for our resolver + SchemaFactory schemaFactory = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); + + final IDFedLSInputResolver idFedLSInputResolver = new IDFedLSInputResolver(); + + schemaFactory.setResourceResolver(new LSResourceResolver() { + + @Override + public LSInput resolveResource(String type, String namespaceURI, String publicId, String systemId, String baseURI) { + LSInput input = idFedLSInputResolver.resolveResource(type, namespaceURI, publicId, systemId, baseURI); + + if(input == null) { + throw new IllegalArgumentException("Unable to resolve " + systemId); + } + + InputStream is = input.getByteStream(); + if(is == null) { + throw new IllegalArgumentException("Unable to resolve stream for " + systemId); + } + try { + is.close(); + } catch (IOException e) { + throw new RuntimeException(e); + } + + return input; + } + }); + + // check that all schema can be resolved + for(String schema : SchemaManagerUtil.getSchemas()) { + if(schema.contains("saml")) { + URL schemaFile = SecurityActions.loadResource(getClass(), schema); + schemaFactory.newSchema(schemaFile); + } + } + + JAXPValidationUtil.validator(); + + } + +} \ No newline at end of file diff --git a/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/saml/ValidationTest.java b/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/saml/ValidationTest.java index de905bfe5d..bc1e3aa0d2 100644 --- a/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/saml/ValidationTest.java +++ b/testsuite/integration-deprecated/src/test/java/org/keycloak/testsuite/saml/ValidationTest.java @@ -16,15 +16,11 @@ */ package org.keycloak.testsuite.saml; -import org.junit.Assert; -import org.junit.Ignore; -import org.junit.Test; -import org.keycloak.common.util.StreamUtil; -import org.keycloak.models.utils.KeycloakModelUtils; -import org.keycloak.protocol.saml.SamlProtocol; -import org.keycloak.protocol.saml.SamlService; -import org.keycloak.saml.SPMetadataDescriptor; -import org.xml.sax.SAXException; +import java.io.ByteArrayInputStream; +import java.io.IOException; +import java.io.InputStream; +import java.net.URL; +import java.nio.charset.StandardCharsets; import javax.xml.XMLConstants; import javax.xml.transform.Source; @@ -32,10 +28,19 @@ import javax.xml.transform.stream.StreamSource; import javax.xml.validation.Schema; import javax.xml.validation.SchemaFactory; import javax.xml.validation.Validator; -import java.io.ByteArrayInputStream; -import java.io.IOException; -import java.io.InputStream; -import java.net.URL; + +import org.junit.Before; +import org.junit.Test; +import org.keycloak.common.util.StreamUtil; +import org.keycloak.dom.saml.v2.metadata.KeyTypes; +import org.keycloak.protocol.saml.SamlProtocol; +import org.keycloak.protocol.saml.SamlService; +import org.keycloak.saml.SPMetadataDescriptor; +import org.keycloak.saml.processing.core.util.IDFedLSInputResolver; +import org.keycloak.saml.processing.core.util.JAXPValidationUtil; +import org.w3c.dom.ls.LSInput; +import org.w3c.dom.ls.LSResourceResolver; +import org.xml.sax.SAXException; /** * @author Bill Burke @@ -43,6 +48,13 @@ import java.net.URL; */ public class ValidationTest { + private static final String PRIVATE_KEY = "MIICWwIBAAKBgQDVG8a7xGN6ZIkDbeecySygcDfsypjUMNPE4QJjis8B316CvsZQ0hcTTLUyiRpHlHZys2k3xEhHBHymFC1AONcvzZzpb40tAhLHO1qtAnut00khjAdjR3muLVdGkM/zMC7G5s9iIwBVhwOQhy+VsGnCH91EzkjZ4SVEr55KJoyQJQIDAQABAoGADaTtoG/+foOZUiLjRWKL/OmyavK9vjgyFtThNkZY4qHOh0h3og0RdSbgIxAsIpEa1FUwU2W5yvI6mNeJ3ibFgCgcxqPk6GkAC7DWfQfdQ8cS+dCuaFTs8ObIQEvU50YzeNPiiFxRA+MnauCUXaKm/PnDfjd4tPgru7XZvlGh0wECQQDsBbN2cKkBKpr/b5oJiBcBaSZtWiMNuYBDn9x8uORj+Gy/49BUIMHF2EWyxOWz6ocP5YiynNRkPe21Zus7PEr1AkEA5yWQOkxUTIg43s4pxNSeHtL+Ebqcg54lY2xOQK0yufxUVZI8ODctAKmVBMiCKpU3mZQquOaQicuGtocpgxlScQI/YM31zZ5nsxLGf/5GL6KhzPJT0IYn2nk7IoFu7bjn9BjwgcPurpLA52TNMYWQsTqAKwT6DEhG1NaRqNWNpb4VAkBehObAYBwMm5udyHIeEc+CzUalm0iLLa0eRdiN7AUVNpCJ2V2Uo0NcxPux1AgeP5xXydXafDXYkwhINWcNO9qRAkEA58ckAC5loUGwU5dLaugsGH/a2Q8Ac8bmPglwfCstYDpl8Gp/eimb1eKyvDEELOhyImAv4/uZV9wN85V0xZXWsw=="; + + /** + * The public certificate that corresponds to {@link #PRIVATE_KEY}. + */ + private static final String PUBLIC_CERT = "MIIDdzCCAl+gAwIBAgIEbySuqTANBgkqhkiG9w0BAQsFADBsMRAwDgYDVQQGEwdVbmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRAwDgYDVQQKEwdVbmtub3duMRAwDgYDVQQLEwdVbmtub3duMRAwDgYDVQQDEwdVbmtub3duMB4XDTE1MDEyODIyMTYyMFoXDTE3MTAyNDIyMTYyMFowbDEQMA4GA1UEBhMHVW5rbm93bjEQMA4GA1UECBMHVW5rbm93bjEQMA4GA1UEBxMHVW5rbm93bjEQMA4GA1UEChMHVW5rbm93bjEQMA4GA1UECxMHVW5rbm93bjEQMA4GA1UEAxMHVW5rbm93bjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAII/K9NNvXi9IySl7+l2zY/kKrGTtuR4WdCI0xLW/Jn4dLY7v1/HOnV4CC4ecFOzhdNFPtJkmEhP/q62CpmOYOKApXk3tfmm2rwEz9bWprVxgFGKnbrWlz61Z/cjLAlhD3IUj2ZRBquYgSXQPsYfXo1JmSWF5pZ9uh1FVqu9f4wvRqY20ZhUN+39F+1iaBsoqsrbXypCn1HgZkW1/9D9GZug1c3vB4wg1TwZZWRNGtxwoEhdK6dPrNcZ+6PdanVilWrbQFbBjY4wz8/7IMBzssoQ7Usmo8F1Piv0FGfaVeJqBrcAvbiBMpk8pT+27u6p8VyIX6LhGvnxIwM07NByeSUCAwEAAaMhMB8wHQYDVR0OBBYEFFlcNuTYwI9W0tQ224K1gFJlMam0MA0GCSqGSIb3DQEBCwUAA4IBAQB5snl1KWOJALtAjLqD0mLPg1iElmZP82Lq1htLBt3XagwzU9CaeVeCQ7lTp+DXWzPa9nCLhsC3QyrV3/+oqNli8C6NpeqI8FqN2yQW/QMWN1m5jWDbmrWwtQzRUn/rh5KEb5m3zPB+tOC6e/2bV3QeQebxeW7lVMD0tSCviUg1MQf1l2gzuXQo60411YwqrXwk6GMkDOhFDQKDlMchO3oRbQkGbcP8UeiKAXjMeHfzbiBr+cWz8NYZEtxUEDYDjTpKrYCSMJBXpmgVJCZ00BswbksxJwaGqGMPpUKmCV671pf3m8nq3xyiHMDGuGwtbU+GE8kVx85menmp8+964nin"; + public static String getIDPMetadataDescriptor() throws IOException { InputStream is = SamlService.class.getResourceAsStream("/idp-metadata-template.xml"); String template = StreamUtil.readString(is); @@ -50,47 +62,34 @@ public class ValidationTest { template = template.replace("${idp.sso.HTTP-POST}", "http://keycloak.org/auth/realms/test/saml"); template = template.replace("${idp.sso.HTTP-Redirect}", "http://keycloak.org/auth/realms/test/saml"); template = template.replace("${idp.sls.HTTP-POST}", "http://keycloak.org/auth/realms/test/saml"); - template = template.replace("${idp.signing.certificate}", KeycloakModelUtils.generateKeyPairCertificate("test").getCertificate()); + template = template.replace("${idp.signing.certificates}", ""); return template; } - - + + private Validator validator; + + @Before + public void init() throws Exception { + validator = JAXPValidationUtil.validator(); + } + + private void validate(String xml) throws SAXException, IOException { + validator.validate(new StreamSource(new ByteArrayInputStream(xml.getBytes(StandardCharsets.UTF_8)))); + } + @Test - @Ignore // ignore because it goes out to web public void testIDPDescriptor() throws Exception { - URL schemaFile = getClass().getResource("/schema/saml/v2/saml-schema-metadata-2.0.xsd"); - Source xmlFile = new StreamSource(new ByteArrayInputStream(getIDPMetadataDescriptor().getBytes()), "IDPSSODescriptor"); - SchemaFactory schemaFactory = SchemaFactory - .newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); - Schema schema = schemaFactory.newSchema(schemaFile); - Validator validator = schema.newValidator(); - try { - validator.validate(xmlFile); - System.out.println(xmlFile.getSystemId() + " is valid"); - } catch (SAXException e) { - System.out.println(xmlFile.getSystemId() + " is NOT valid"); - System.out.println("Reason: " + e.getLocalizedMessage()); - Assert.fail(); - } + validate(getIDPMetadataDescriptor()); } + @Test - @Ignore // ignore because it goes out to web public void testBrokerExportDescriptor() throws Exception { - URL schemaFile = getClass().getResource("/schema/saml/v2/saml-schema-metadata-2.0.xsd"); - Source xmlFile = new StreamSource(new ByteArrayInputStream(SPMetadataDescriptor.getSPDescriptor( - "POST", "http://realm/assertion", "http://realm/logout", true, false, false, "test", SamlProtocol.SAML_DEFAULT_NAMEID_FORMAT, KeycloakModelUtils.generateKeyPairCertificate("test").getCertificate(), "" - ).getBytes()), "SP Descriptor"); - SchemaFactory schemaFactory = SchemaFactory - .newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); - Schema schema = schemaFactory.newSchema(schemaFile); - Validator validator = schema.newValidator(); - try { - validator.validate(xmlFile); - System.out.println(xmlFile.getSystemId() + " is valid"); - } catch (SAXException e) { - System.out.println(xmlFile.getSystemId() + " is NOT valid"); - System.out.println("Reason: " + e.getLocalizedMessage()); - Assert.fail(); - } + String spCertificate = SPMetadataDescriptor.xmlKeyInfo(" ", null, PUBLIC_CERT, KeyTypes.SIGNING.value(), true); + + String str = SPMetadataDescriptor.getSPDescriptor( + "POST", "http://realm/assertion", "http://realm/logout", true, true, false, "test", SamlProtocol.SAML_DEFAULT_NAMEID_FORMAT, spCertificate, null + ); + validate(str); } -} + +} \ No newline at end of file