<?xml version="1.0" encoding="UTF-8"?>
<!-- $Id: security-config_4_1.xsd 44282 2006-04-27 00:11:58Z asaldhana $ -->

<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
   elementFormDefault="qualified"
   xmlns:jaas="urn:jboss:security-config:4.1"
   xmlns:jbxb="http://www.jboss.org/xml/ns/jbxb"
   targetNamespace="urn:jboss:security-config:4.1">

   <xsd:annotation>
      <xsd:documentation><![CDATA[
         The login-config.xml schema with jbossxb annotations that map conforming
         documents to the org.jboss.security.auth.login.PolicyConfig.
     $Id: security-config_4_1.xsd 44282 2006-04-27 00:11:58Z asaldhana $
    This is the XML Schema for the jboss 4.1 security configuration descriptor.
    The default version of the descriptor is found in conf/login-config.xml
     and this version of the schema is indicated using:

        <policy xmlns="urn:jboss:security-config:4.1"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          version="4.1">
          ...
        </policy>

     The outline of a policy/application-policy is:
     <policy>
      <application-policy name="security-domain-name">
       <authentication>
         <login-module code="login.module1.class.name" flag="control_flag">
           <module-option name = "option1-name">option1-value</module-option>
           <module-option name = "option2-name">option2-value</module-option>
           ...
         </login-module>
   
         <login-module code="login.module2.class.name" flag="control_flag">
           ...
         </login-module>
         ...
       </authentication>
      </application-policy>
     </policy>
    ]]></xsd:documentation>
      <xsd:appinfo>
         <jbxb:schemaBindings>
            <jbxb:package name="org.jboss.security.auth.login"/>
            <jbxb:ignoreUnresolvedFieldOrClass>false</jbxb:ignoreUnresolvedFieldOrClass>
         </jbxb:schemaBindings>
      </xsd:appinfo>
   </xsd:annotation>

  <xsd:element name="policy">
    <xsd:complexType>
       <xsd:annotation>
         <xsd:documentation>The policy element is the root of the security
            configuration descriptor.</xsd:documentation>
          <xsd:appinfo>
             <jbxb:class impl="org.jboss.security.auth.login.PolicyConfig"/>
          </xsd:appinfo>
       </xsd:annotation>

      <xsd:sequence>
        <xsd:element maxOccurs="unbounded" ref="jaas:application-policy"/>
      </xsd:sequence>
    </xsd:complexType>
  </xsd:element>

  <xsd:element name="application-policy">
    <xsd:complexType>
       <xsd:annotation>
      <xsd:documentation>The application-policy lists configuration for a
         named policy. This currently only consists of the authentication
         configuration. </xsd:documentation>
         <xsd:appinfo>
           <jbxb:class impl="org.jboss.security.auth.login.AuthenticationInfoContainer"/>
           <jbxb:addMethod name="add" valueType="child"/>
         </xsd:appinfo>
       </xsd:annotation>

      <xsd:sequence>
        <xsd:element ref="jaas:authentication"/>
      </xsd:sequence>
      <xsd:attribute name="name" use="required" type="xsd:string"/>
    </xsd:complexType>
  </xsd:element>

  <xsd:element name="authentication">
    <xsd:annotation>
      <xsd:documentation>The authentication element contains the login module
         stack configuration. Each login module configuration is specified
         using a login-module element.</xsd:documentation>
       <xsd:appinfo>
          <jbxb:skip/>
       </xsd:appinfo>
    </xsd:annotation>
    <xsd:complexType>
      <xsd:sequence>
        <xsd:element maxOccurs="unbounded" ref="jaas:login-module"/>
      </xsd:sequence>
    </xsd:complexType>
  </xsd:element>
  <xsd:element name="login-module">
    <xsd:complexType>
       <xsd:annotation>
         <xsd:documentation>The login-module element defines a JAAS login module
            configuration entry. Each entry must have a code and flag attribute
            along with zero or more login module options specified via the
            module-option element. </xsd:documentation>
          <xsd:appinfo>
             <jbxb:class impl="org.jboss.security.auth.login.AppConfigurationEntryHolder"/>
          </xsd:appinfo>
       </xsd:annotation>
      <xsd:sequence>
        <xsd:element minOccurs="0" maxOccurs="unbounded" ref="jaas:module-option"/>
      </xsd:sequence>
      <xsd:attribute name="code" use="required" type="xsd:string"/>
      <xsd:attribute name="flag" use="required">
        <xsd:annotation>
           <xsd:documentation>The flag attribute controls how a login module
              participates in the overall authentication proceedure.
              Required - The LoginModule is required to succeed. If it
              succeeds or fails, authentication still continues to proceed
              down the LoginModule list.

              Requisite - The LoginModule is required to succeed. If it succeeds,
              authentication continues down the LoginModule list. If it fails,
              control immediately returns to the application (authentication does not proceed
              down the LoginModule list).

              Sufficient - The LoginModule is  not required to succeed. If it does
              succeed, control immediately returns to the application (authentication
              does not proceed down the LoginModule list). If it fails,
              authentication continues down the LoginModule list.
                  
              Optional - The LoginModule is not required to succeed. If it succeeds or
              fails, authentication still continues to proceed down the
              LoginModule list.
                  
              The overall authentication succeeds only if
              all required and requisite LoginModules succeed. If a
              sufficient LoginModule is configured and succeeds, then only
              the required and requisite LoginModules prior to that
              sufficient LoginModule need to have succeeded for the overall
              authentication to succeed. If no required or requisite
              LoginModules are configured for an application, then at least
              one sufficient or optional LoginModule must succeed.
           </xsd:documentation>
        </xsd:annotation>
        <xsd:simpleType>
          <xsd:restriction base="xsd:string">
            <xsd:enumeration value="required" />
            <xsd:enumeration value="requisite" />
            <xsd:enumeration value="sufficient" />
            <xsd:enumeration value="optional" />
          </xsd:restriction>
        </xsd:simpleType>
      </xsd:attribute>
    </xsd:complexType>
  </xsd:element>
  <xsd:element name="module-option">
    <xsd:complexType mixed="true">
       <xsd:annotation>
            <xsd:documentation>A module option defines a name, value pair that are
            passed to a LoginModule when it is initialized during the login proceedure.
            The name attribute defines the option name while the element value is the
            option value. The type of the value can be anything from a string obtained
            from the module-option body, to arbitary objects unmarshalled based on
            the namespace associated with the module-option child element
            </xsd:documentation>
          <xsd:appinfo>
             <!-- ModuleOption declares a constructor that takes name as a parameter
                  while the value should be set with the setter.
                  This use-case is not supported out-of-the-box. So, we use this container. -->
             <jbxb:class impl="org.jboss.security.auth.login.ModuleOptionContainer"/>
          </xsd:appinfo>
       </xsd:annotation>
      <xsd:sequence>
        <xsd:any minOccurs="0" maxOccurs="1" namespace="##other" />
      </xsd:sequence>
      <xsd:attribute name="name" use="required" type="xsd:string"/>
    </xsd:complexType>
  </xsd:element>
</xsd:schema>
