plugins/org.apache.geronimo.st.schemas/v30/geronimo-security-2.0.xsd

<?xml version="1.0" encoding="UTF-8"?>
<!--

    Licensed to the Apache Software Foundation (ASF) under one or more
    contributor license agreements.  See the NOTICE file distributed with
    this work for additional information regarding copyright ownership.
    The ASF licenses this file to You under the Apache License, Version 2.0
    (the "License"); you may not use this file except in compliance with
    the License.  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
-->

<!-- $Rev: 741679 $ $Date: 2009-02-06 11:07:17 -0800 (Fri, 06 Feb 2009) $ -->

<xsd:schema
        xmlns:xsd="http://www.w3.org/2001/XMLSchema"
        xmlns:j2ee="http://java.sun.com/xml/ns/j2ee"
        xmlns:geronimo="http://geronimo.apache.org/xml/ns/security-2.0"
        targetNamespace="http://geronimo.apache.org/xml/ns/security-2.0"
        xmlns:app="http://geronimo.apache.org/xml/ns/j2ee/application-2.0"
        xmlns:sys="http://geronimo.apache.org/xml/ns/deployment-1.2"
        elementFormDefault="qualified"
        attributeFormDefault="unqualified"
        version="2.0">

    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" schemaLocation="http://www.w3.org/2001/xml.xsd"/>
    <xsd:import namespace="http://geronimo.apache.org/xml/ns/j2ee/application-2.0" schemaLocation="geronimo-application-2.0.xsd"/>
    <xsd:import namespace="http://geronimo.apache.org/xml/ns/deployment-1.2" schemaLocation="geronimo-module-1.2.xsd"/>

    <xsd:element name="security" type="geronimo:securityType" substitutionGroup="app:security"/>
    <xsd:element name="security-ref" type="geronimo:security-refType" substitutionGroup="app:security"/>
    <xsd:element name="credential-store" type="sys:patternType"/>
    <xsd:element name="default-subject" type="geronimo:subject-infoType"/>

    <xsd:complexType name="securityType">
        <xsd:annotation>
            <xsd:documentation>
                Security entries

                If this element is present, all web and EJB modules MUST make the
                appropriate access checks as outlined in the JACC spec.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="app:abstract-securityType">
                <xsd:sequence>
                    <xsd:element name="description" type="geronimo:descriptionType" minOccurs="0"
                                 maxOccurs="unbounded"/>
                    <xsd:element name="credential-store-ref" type="sys:patternType" minOccurs="0"/>
                    <xsd:element name="default-subject" type="geronimo:subject-infoType" minOccurs="0"/>
                    <xsd:element name="role-mappings" type="geronimo:role-mappingsType" minOccurs="0"/>
                </xsd:sequence>
                <xsd:attribute name="name" type="xsd:string">
                    <xsd:annotation>
                        <xsd:documentation>
                            Name of standalone security configurations. Optional for security elements in ee apps.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:attribute>
                <xsd:attribute name="doas-current-caller" type="xsd:boolean" default="false">
                    <xsd:annotation>
                        <xsd:documentation>
                            Set this attribute to "true" if the work is to be performed
                            as the calling Subject.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:attribute>
                <xsd:attribute name="use-context-handler" type="xsd:boolean" default="false">
                    <xsd:annotation>
                        <xsd:documentation>
                            Set this attribute to "true" if the installed JACC policy
                            contexts will use PolicyContextHandlers.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:attribute>
                <xsd:attribute name="default-role" type="xsd:string">
                    <xsd:annotation>
                        <xsd:documentation>
                            Used by the the Deployer to assign method permissions for
                            all of the unspecified methods, either by assigning them
                            to security roles, or by marking them as unchecked. If
                            the value of default-role is empty, then the unspecified
                            methods are marked unchecked
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:attribute>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="security-refType">
        <xsd:annotation>
            <xsd:documentation>
                Reference to security element in a parent module.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="app:abstract-securityType">
                <xsd:choice>
                    <xsd:element name="name" type="xsd:string"/>
                    <xsd:element name="ref" type="sys:patternType"/>
                </xsd:choice>
             </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="descriptionType">
        <xsd:simpleContent>
            <xsd:extension base="xsd:string">
                <xsd:attribute ref="xml:lang"/>
            </xsd:extension>
        </xsd:simpleContent>
    </xsd:complexType>

    <!--<xsd:complexType name="named-username-password-credentialType">-->
    <!--<xsd:sequence>-->
    <!--<xsd:element name="name" type="xsd:string"/>-->
    <!--<xsd:element name="username" type="xsd:string"/>-->
    <!--<xsd:element name="password" type="xsd:string"/>-->
    <!--</xsd:sequence>-->
    <!--</xsd:complexType>-->

    <xsd:complexType name="role-mappingsType">
        <xsd:sequence>
            <xsd:element name="role" type="geronimo:roleType" minOccurs="1" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="roleType">
        <xsd:sequence>
            <xsd:element name="description" type="geronimo:descriptionType" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="run-as-subject" type="geronimo:subject-infoType" minOccurs="0"/>
            <xsd:element name="realm-principal" type="geronimo:realmPrincipalType" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="login-domain-principal" type="geronimo:loginDomainPrincipalType" minOccurs="0"
                         maxOccurs="unbounded"/>
            <xsd:element name="principal" type="geronimo:principalType" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="distinguished-name" type="geronimo:distinguishedNameType" minOccurs="0"
                         maxOccurs="unbounded"/>
        </xsd:sequence>
        <xsd:attribute name="role-name" type="xsd:string" use="required"/>
    </xsd:complexType>

    <xsd:complexType name="realmPrincipalType">
        <xsd:complexContent>
            <xsd:extension base="geronimo:loginDomainPrincipalType">
                <xsd:attribute name="realm-name" type="xsd:string" use="required"/>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="loginDomainPrincipalType">
        <xsd:complexContent>
            <xsd:extension base="geronimo:principalType">
                <xsd:attribute name="domain-name" type="xsd:string" use="required"/>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="principalType">
        <xsd:sequence>
            <xsd:element name="description" type="geronimo:descriptionType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
        <xsd:attribute name="class" type="xsd:string" use="required"/>
        <xsd:attribute name="name" type="xsd:string" use="required"/>
    </xsd:complexType>

    <xsd:complexType name="distinguishedNameType">
        <xsd:sequence>
            <xsd:element name="description" type="geronimo:descriptionType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
        <xsd:attribute name="name" type="xsd:string" use="required"/>
    </xsd:complexType>

    <xsd:complexType name="subject-infoType">
        <xsd:sequence>
            <xsd:element name="description" type="geronimo:descriptionType" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="realm" type="xsd:string"/>
            <xsd:element name="id" type="xsd:string"/>
        </xsd:sequence>
    </xsd:complexType>

    <!--<xsd:complexType name="credential-storeType">-->
    <!--<xsd:sequence>-->
    <!--<xsd:element name="pattern" type="sys:patternType">-->
    <!--<xsd:annotation>-->
    <!--<xsd:documentation>-->
    <!--The pattern element defines a components of the-->
    <!--abstract name of GBean referred. It (optionally) includes-->
    <!--the groupId, artifactId, version,-->
    <!--module, type, and name of the GBean module.-->
    <!--</xsd:documentation>-->
    <!--</xsd:annotation>-->
    <!--</xsd:element>-->
    <!--</xsd:sequence>-->
    <!--</xsd:complexType>-->

</xsd:schema>