<?xml version="1.0" encoding="US-ASCII"?>
<schema xmlns="http://www.w3.org/2001/XMLSchema" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" xmlns:ext="http://www.rsa.com/names/2009/12/std-ext/SAML2.0" xmlns:prof="http://www.rsa.com/names/2010/04/std-prof/SAML2.0" xmlns:ns1="urn:oasis:names:tc:SAML:2.0:conditions:delegation" targetNamespace="urn:oasis:names:tc:SAML:2.0:assertion" elementFormDefault="unqualified" attributeFormDefault="unqualified" blockDefault="substitution" version="2.0">
	<import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/>
	<import namespace="http://www.rsa.com/names/2009/12/std-ext/SAML2.0" schemaLocation="profiled-saml-schema-assertion-2.0-extensions.xsd"/>
	<import namespace="http://www.rsa.com/names/2010/04/std-prof/SAML2.0" schemaLocation="profiled-saml-schema-assertion-2.0-types.xsd"/>
	<import namespace="urn:oasis:names:tc:SAML:2.0:conditions:delegation" schemaLocation="profiled-sstc-saml-delegation.xsd"/>
	<annotation>
		<documentation>
      Profile of the standard SAML 2.0 schema that conforms to the
      profile used by the RSA Identity and Access Tookit V1.0

      TODO: The requirements on the signature given in section 3.3 are
      currently not included
    </documentation>
	</annotation>
	<element name="NameID" type="saml:NameIDType"/>
	<complexType name="NameIDType">
		<annotation>
			<documentation>
        Section 3.1: A NameID can only contain the Format attribute
        and that attribute can only have the values listed in table 1.
        The NameQualifier attribute should only be present if the format
        is unspecified.
      </documentation>
		</annotation>
		<simpleContent>
			<extension base="string">
				<attribute name="NameQualifier" type="string" use="optional"/>
				<attribute name="Format" type="prof:NameIDFormats" use="required"/>
			</extension>
		</simpleContent>
	</complexType>
	<element name="Issuer" type="saml:NameIDType"/>
	<element name="Assertion" type="saml:AssertionType"/>
	<complexType name="AssertionType">
		<annotation>
			<documentation>
        Section 3.2: The Version Attribute MUST be present and MUST
        contain the value "2.0", the ID attribute MUST be preent and
        MUST contain a UUID with a "_" prefix and the IssueInstant
        MUST be in UTC time.

        An assertion MUST contain an AuthnStatement but
        cannot contain an AuthZDecisionStatement or a Statement.

        TODO: The current schema is not quite correct since it
        requires the AuthnStatement to be before the
        AttributeStatement.
      </documentation>
		</annotation>
		<sequence>
			<element ref="saml:Issuer"/>
			<element ref="ds:Signature"/>
			<element ref="saml:Subject"/>
			<element ref="saml:Conditions"/>
			<element ref="saml:Advice" minOccurs="0"/>
			<element ref="saml:AuthnStatement"/>
			<element ref="saml:AttributeStatement" minOccurs="0"/>
		</sequence>
		<attribute name="Version" type="string" use="required" fixed="2.0"/>
		<attribute name="ID" type="prof:UUID" use="required"/>
		<attribute name="IssueInstant" type="prof:UTCTime" use="required"/>
	</complexType>
	<element name="Subject" type="saml:SubjectType"/>
	<complexType name="SubjectType">
		<annotation>
			<documentation>
        Section 3.4: The Subject element SHALL contain a NameID and a
        SubjectConfirmation but SHALL NOT contain an EncryptedID.
      </documentation>
		</annotation>
		<sequence>
			<element ref="saml:NameID"/>
			<element ref="saml:SubjectConfirmation"/>
		</sequence>
	</complexType>
	<element name="SubjectConfirmation" type="saml:SubjectConfirmationType"/>
	<complexType name="SubjectConfirmationType">
		<annotation>
			<documentation>
        Section 3.4.1: The SubjectConfirmationType is restricted to
        only contain a NameID and not a BaseID or EncryptedID.  It
        must also contain the SubjectConfirmationData element

        Note: The NameID element is present if the token is delegated
        in which case it contains the identity of the delegate.
      </documentation>
		</annotation>
		<sequence>
			<element ref="saml:NameID" minOccurs="0"/>
			<element ref="saml:SubjectConfirmationData"/>
		</sequence>
		<attribute name="Method" type="prof:SubjectConfirmationMethods" use="required"/>
	</complexType>
	<element name="SubjectConfirmationData" type="saml:SubjectConfirmationDataType"/>
	<complexType name="SubjectConfirmationDataType" mixed="true">
		<annotation>
			<documentation>
        Section 3.4.2: The SubjectConfirmationDataType SHALL NOT
        contain the NotBefore, Recipient, InResponseTo or Address
        attributes. The NotOnOrAfter attribute SHALL be present if the
        confirmation type is bearer and MUST be UTC time.

        If the value of the Method attribute is
        urn:oasis:names:tc:SAML:2.0:cm:bearer then this attribute
        SHALL be present and SHALL contain a time that is not later
        than the NotOnOrAfter attribute of the Conditions element

        This element SHALL be present in all SubjectConfirmation
        elements but if the value of the Method attribute of the
        SubjectConfirmation is
        urn:oasis:names:tc:SAML:2.0:cm:holder-of-key then this element
        SHALL be of type saml:KeyInfoConfirmationDataType.  In this
        case, the element SHALL contain a single KeyInfo element with
        an X509Data element containing a certificate within an
        X509Certificate element.

        Note: This profile does not enforce the fact that the
        NotOnOrAfter attribute must be present if the method is
        bearer.
      </documentation>
		</annotation>
		<complexContent mixed="true">
			<restriction base="anyType">
				<sequence>
					<any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/>
				</sequence>
				<attribute name="NotOnOrAfter" type="prof:UTCTime" use="optional"/>
			</restriction>
		</complexContent>
	</complexType>
	<complexType name="KeyInfoConfirmationDataType" mixed="false">
		<complexContent mixed="false">
			<restriction base="saml:SubjectConfirmationDataType">
				<sequence>
					<element ref="ds:KeyInfo" maxOccurs="unbounded"/>
				</sequence>
			</restriction>
		</complexContent>
	</complexType>
	<element name="Conditions" type="saml:ConditionsType"/>
	<complexType name="ConditionsType">
		<annotation>
			<documentation>
        Section 3.5: The NotBefore and NotOnOrAfter attributes MUST be
        present and MUST be in UTC time.
        
        An instance of the Condition element SHALL be present if the
        assertion has been delegated.  and an instance SHALL be
        included if the assertion is renewable.  (Allowing zero,one or
        two instances.)

        A single instance of the AudienceRestriction element SHALL be
        included in the Conditions element if and only if the
        assertion has been issued aimed at specific Responders.
        
        A single instance of the ProxyRestriction element MAY be
        included in the saml:Conditions element if and only if the
        assertion is delegable.  If this element is not included, then
        no proxy conditions are stated and SHOULD NOT be assumed by
        the client.

        NOTE: The schema does not enforce when the various conditions
        are included, only their type.

        TODO: The current schema does not include the condition that
        there can be at most two Condition elements, one
        AudienceRestriction and one ProxyRestriction.

      </documentation>
		</annotation>
		<choice minOccurs="0" maxOccurs="unbounded">
			<element ref="saml:Condition"/>
			<element ref="saml:AudienceRestriction"/>
			<element ref="saml:ProxyRestriction"/>
		</choice>
		<attribute name="NotBefore" type="prof:UTCTime" use="required"/>
		<attribute name="NotOnOrAfter" type="prof:UTCTime" use="required"/>
	</complexType>
	<annotation>
		<documentation>
      Sections 3.5.1 and 3.5.4: If the Conditions element is present
      then it MUST be of type DelegationRestrictionType or
      RenewRestrictionType.  
      
      NOTE: it does not appear to be possible to specify this in a
      schema.
    </documentation>
	</annotation>
	<element name="Condition" type="saml:ConditionAbstractType"/>
	<complexType name="ConditionAbstractType" abstract="true"/>
	<element name="AudienceRestriction" type="saml:AudienceRestrictionType"/>
	<complexType name="AudienceRestrictionType">
		<annotation>
			<documentation>
        Section 3.5.2: There are no restrictions on this element.
      </documentation>
		</annotation>
		<complexContent>
			<extension base="saml:ConditionAbstractType">
				<sequence>
					<element ref="saml:Audience" maxOccurs="unbounded"/>
				</sequence>
			</extension>
		</complexContent>
	</complexType>
	<element name="Audience" type="anyURI"/>
	<element name="ProxyRestriction" type="saml:ProxyRestrictionType"/>
	<complexType name="ProxyRestrictionType">
		<annotation>
			<documentation>
        Section 3.5.3: The ProxyRestriction is restricted to only
        contain the Count attribute; Audience elements are currently
        not supported.
      </documentation>
		</annotation>
		<complexContent>
			<extension base="saml:ConditionAbstractType">
				<attribute name="Count" type="nonNegativeInteger" use="optional"/>
			</extension>
		</complexContent>
	</complexType>
	<element name="Advice" type="saml:AdviceType"/>
	<complexType name="AdviceType">
		<annotation>
			<documentation>
        Section 3.6: The Advice element is restricted to only contain
        an RSAAdvice element.  The AssertionIDRef, AssersionURIRef,
        Assertion and EncryptedAssertion elements are not supported.
      </documentation>
		</annotation>
		<sequence maxOccurs="unbounded">
			<element ref="ext:RSAAdvice"/>
		</sequence>
	</complexType>
	<complexType name="StatementAbstractType" abstract="true"/>
	<element name="AuthnStatement" type="saml:AuthnStatementType"/>
	<complexType name="AuthnStatementType">
		<annotation>
			<documentation>
        Section 3.7: The AuthnStatement element is restricted to not
        contain the SessionIndex and SessionNotOnOrAfter attributes
        and to not contain the SubjectLocality element.  It MUST
        contain an AuthnInstant in UTC time.
      </documentation>
		</annotation>
		<complexContent>
			<extension base="saml:StatementAbstractType">
				<sequence>
					<element ref="saml:AuthnContext"/>
				</sequence>
				<attribute name="AuthnInstant" type="prof:UTCTime" use="required"/>
			</extension>
		</complexContent>
	</complexType>
	<element name="AuthnContext" type="saml:AuthnContextType"/>
	<complexType name="AuthnContextType">
		<annotation>
			<documentation>
        Section 3.7: The AuthnContext is restricted such that the
        AuthnContextClassRef element can only contain the values given
        in Table 3.
      </documentation>
		</annotation>
		<sequence>
			<element ref="saml:AuthnContextClassRef"/>
		</sequence>
	</complexType>
	<element name="AuthnContextClassRef" type="prof:AuthnContextClassRefs"/>
	<element name="AttributeStatement" type="saml:AttributeStatementType"/>
	<complexType name="AttributeStatementType">
		<annotation>
			<documentation>
        Section 3.8: The AttributeStatement is restricted to only
        contain Attribute elements; EncrytpedAttribute elements are
        not supported.
      </documentation>
		</annotation>
		<complexContent>
			<extension base="saml:StatementAbstractType">
				<choice maxOccurs="unbounded">
					<element ref="saml:Attribute"/>
				</choice>
			</extension>
		</complexContent>
	</complexType>
	<element name="Attribute" type="saml:AttributeType"/>
	<complexType name="AttributeType">
		<annotation>
			<documentation>
        Section 3.8: The Attribute element is restricted in the
        following ways:
        
        1) It may only contain AttributeValue elements;
        EncrytpedAttributeValue elements are not supported.

        2) It may not contain any attributes from other namespaces.

        3) The value of the NameFormat attribute MUST be
        urn:oasis:names:tc:SAML:2.0:attrname-format:uri

        4) The value of the type attribute of the AttributeValue
        element MUST be xsd:string

        5) Nil attribute values are not supported

        NOTE: This schema does not check that the values of
        FriendlyName are correct.  

        NOTE: When used in an attribute statement, the value of the
        Name attribute is restricted to be one of the values from
        Table 4 but there are no restrictions on the name when it is
        used in advice.  The profiled schema therefore imposes no
        restrictions on the name values.
      </documentation>
		</annotation>
		<sequence>
			<element ref="saml:AttributeValue" minOccurs="0" maxOccurs="unbounded"/>
		</sequence>
		<attribute name="Name" type="string" use="required"/>
		<attribute name="NameFormat" type="anyURI" use="optional"/>
		<attribute name="FriendlyName" type="string" use="optional"/>
		<!-- <attribute name="Name" type="prof:AttributeNames" use="required"/> -->
	</complexType>
	<element name="AttributeValue" type="anyType"/>
</schema>
