<?xml version="1.0" encoding="UTF-8"?>
<!--
  _=_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_=
  Repose
  _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  Copyright (C) 2010 - 2015 Rackspace US, Inc.
  _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-
  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
  =_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_=_
  -->

<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
           xmlns:html="http://www.w3.org/1999/xhtml"
           xmlns="http://docs.openrepose.org/repose/samlpolicy/v1.0"
           targetNamespace="http://docs.openrepose.org/repose/samlpolicy/v1.0"
           elementFormDefault="qualified"
           attributeFormDefault="unqualified">

    <!-- Elements -->
    <xs:element name="saml-policy" type="SamlPolicyConfig"/>

    <!-- Types -->
    <xs:complexType name="SamlPolicyConfig">
        <xs:annotation>
            <xs:documentation>
                <html:p>The setting to use for saml policy based translation.</html:p>
            </xs:documentation>
        </xs:annotation>

        <xs:sequence>
            <xs:element name="policy-bypass-issuers" type="PolicyBypassIssuers" minOccurs="0" maxOccurs="1"/>
            <xs:element name="policy-acquisition" type="PolicyAcquisition"/>
            <xs:element name="signature-credentials" type="SignatureCredentials"/>
        </xs:sequence>
    </xs:complexType>

    <xs:complexType name="PolicyBypassIssuers">
        <xs:annotation>
            <xs:documentation>
                <html:p>DEPRECATED - Issuers to not try to locate a policy and do a translation for.</html:p>
            </xs:documentation>
        </xs:annotation>
        <xs:sequence>
            <xs:element name="issuer" type="xs:string" minOccurs="1" maxOccurs="unbounded"/>
        </xs:sequence>
    </xs:complexType>

    <xs:complexType name="PolicyAcquisition">
        <xs:annotation>
            <xs:documentation>
                <html:p>Details for getting and retaining the policy to use for translation.</html:p>
            </xs:documentation>
        </xs:annotation>

        <xs:sequence>
            <xs:element name="keystone-credentials" type="KeystoneCredentials"/>
            <xs:element name="policy-endpoint" type="PolicyEndpoint"/>
            <xs:element name="cache" type="Cache"/>
        </xs:sequence>
    </xs:complexType>

    <xs:complexType name="KeystoneCredentials">
        <xs:annotation>
            <xs:documentation>
                <html:p>Keystone credentials to use if loading the policy is an authenticated call.</html:p>
            </xs:documentation>
        </xs:annotation>

        <xs:attribute name="uri" type="xs:anyURI" use="required">
            <xs:annotation>
                <xs:documentation>
                    <html:p>Rackspace Keystone v2 Identity Endpoint URI</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>

        <xs:attribute name="username" type="xs:string" use="required">
            <xs:annotation>
                <xs:documentation>
                    <html:p>Username to access Keystone V2 identity service.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>
        <xs:attribute name="password" type="xs:string" use="required">
            <xs:annotation>
                <xs:documentation>
                    <html:p>User password to access Keystone V2 identity service.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>

        <xs:attribute name="connection-pool-id" type="xs:string" use="optional">
            <xs:annotation>
                <xs:documentation>
                    <html:p>Http Connection pool ID to use when talking to Keystone V2 Identity</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>
    </xs:complexType>

    <xs:complexType name="PolicyEndpoint">
        <xs:annotation>
            <xs:documentation>
                <html:p>The endpoint to use to acquire the policy.</html:p>
            </xs:documentation>
        </xs:annotation>

        <xs:attribute name="uri" type="xs:anyURI"/>

        <xs:attribute name="connection-pool-id" type="xs:string" use="optional">
            <xs:annotation>
                <xs:documentation>
                    <html:p>Http Connection pool ID to use when acquiring the policy.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>
    </xs:complexType>

    <xs:complexType name="Cache">
        <xs:annotation>
            <xs:documentation>
                <html:p>Cache related settings</html:p>
            </xs:documentation>
        </xs:annotation>

        <xs:attribute name="ttl" type="xs:unsignedInt" use="required">
            <xs:annotation>
                <xs:documentation>
                    <html:p>The amount of time in seconds a retrieved policy should stay in the cache.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>

        <xs:attribute name="atom-feed-id" type="xs:string" use="optional">
            <xs:annotation>
                <xs:documentation>
                    <html:p>The id of the atom feed to use revoke policies from the cache. This must match an id in the atom feed service.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>
    </xs:complexType>

    <xs:complexType name="SignatureCredentials">
        <xs:annotation>
            <xs:documentation>
                <html:p>The keystore details needed to sign the saml response after applying the policy.</html:p>
            </xs:documentation>
        </xs:annotation>

        <xs:attribute name="keystore-filename" type="xs:anyURI">
            <xs:annotation>
                <xs:documentation>
                    <html:p>The location of the keystore to be used.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>

        <xs:attribute name="keystore-password" type="xs:string">
            <xs:annotation>
                <xs:documentation>
                    <html:p>The password for the keystore.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>

        <xs:attribute name="key-name" type="xs:string">
            <xs:annotation>
                <xs:documentation>
                    <html:p>The key to use for signing.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>

        <xs:attribute name="key-password" type="xs:string">
            <xs:annotation>
                <xs:documentation>
                    <html:p>The password for the key to use for signing.</html:p>
                </xs:documentation>
            </xs:annotation>
        </xs:attribute>
    </xs:complexType>
</xs:schema>
