<?xml version="1.0" encoding="UTF-8"?>
<!--

Copyright Notice

(c) 2001-2004 BEA Systems, Inc., Computer Associates International,
Inc., International Business Machines Corporation, Layer 7
Technologies, Microsoft Corporation, Netegrity, Inc., Oblix Inc.,
OpenNetwork Technologies Inc., Ping Identity Corporation, Reactivity Inc.,
RSA Security Inc., VeriSign Inc., and Westbridge Technology, Inc. 
All rights reserved. 

BEA, Computer Associates, IBM, Layer 7, Microsoft, Netegrity, Oblix,
OpenNetwork, Ping Identity, Reactivity, RSA Security, VeriSign, and Westbridge
(collectively, the "Authors") hereby grant you permission to copy and
display the WS-Trust Schema Document, in any medium without fee or
royalty, provided that you include the following on ALL copies of the
WS-Trust Schema Document that you make: 

1.      A link or URL to the Specification at this location. 

2.      The copyright notice as shown in the WS-Trust Specification.

BEA, Computer Associates, IBM, Layer7, Microsoft, Netegrity, Oblix,
OpenNetwork, Ping Identity, Reactivity, RSA Security, VeriSign, and Westbridge
(collectively, the "Authors") each agree to grant you a license, under
royalty-free and otherwise reasonable, non-discriminatory terms and
conditions, to their respective essential patent claims that they deem
necessary to implement the WS-Trust Schema Document. 

THE WS-Trust SCHEMA DOCUMENT IS PROVIDED "AS IS," AND THE AUTHORS MAKE
NO REPRESENTATIONS OR WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT
NOT LIMITED TO, WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE, NON-INFRINGEMENT, OR TITLE; THAT THE CONTENTS OF
THE WS-Trust SCHEMA DOCUMENT ARE SUITABLE FOR ANY PURPOSE; NOR THAT THE
IMPLEMENTATION OF SUCH CONTENTS WILL NOT INFRINGE ANY THIRD PARTY
PATENTS, COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS. 

THE AUTHORS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL,
INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO ANY
USE OR DISTRIBUTION OF THE WS-Trust SPECIFICATION. 

The WS-Trust Schema Document may change before final release and you are
cautioned against relying on the content of this specification. 

The name and trademarks of the Authors may NOT be used in any manner,
including advertising or publicity pertaining to the Specification or
its contents without specific, written prior permission. Title to
copyright in the WS-Trust Schema Document will at all times remain with
the Authors. 

No other rights are granted by implication, estoppel or otherwise.

-->
<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'
           xmlns:wsse='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd'
		   xmlns:wsu='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd'
		   xmlns:wsp='http://schemas.xmlsoap.org/ws/2002/12/policy' 
		   xmlns:wsa='http://schemas.xmlsoap.org/ws/2004/03/addressing'
		   xmlns:wst='http://schemas.xmlsoap.org/ws/2004/04/trust'
		   targetNamespace='http://schemas.xmlsoap.org/ws/2004/04/trust' 
		   elementFormDefault='qualified' >

  <xs:import namespace='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd' 
			 schemaLocation='../security/oasis-200401-wss-wssecurity-secext-1.0.xsd' />
  <xs:import namespace='http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd' 
			 schemaLocation='../security/oasis-200401-wss-wssecurity-utility-1.0.xsd' />
  <xs:import namespace='http://schemas.xmlsoap.org/ws/2002/12/policy' 
			 schemaLocation='../policy/policy.xsd' />
  <xs:import namespace='http://schemas.xmlsoap.org/ws/2004/03/addressing' 
			 schemaLocation='../addressing/WS-Addressing.xsd' />

  <!-- WS-Trust Section 5.1 -->
  <xs:element name='RequestSecurityToken' type='wst:RequestSecurityTokenType' />
  <xs:complexType name='RequestSecurityTokenType' >
	<xs:annotation>
	  <xs:documentation>
		Actual content model is non-deterministic, hence wildcard. The following shows intended content model:

		<xs:element ref='wst:TokenType' minOccurs='0' />
		<xs:element ref='wst:RequestType' />
		<xs:element ref='wst:Base' minOccurs='0' />
		<xs:element ref='wst:Supporting' minOccurs='0' />
		<xs:element ref='wsp:AppliesTo' minOccurs='0' />
		<xs:element ref='wst:Claims' minOccurs='0' />
		<xs:element ref='wst:Entropy' minOccurs='0' />
		<xs:element ref='wst:Lifetime' minOccurs='0' />
		<xs:element ref='wst:AllowPostdating' minOccurs='0' />
		<xs:element ref='wst:Renewing' minOccurs='0' />
		<xs:element ref='wst:OnBehalfOf' minOccurs='0' />
		<xs:element ref='wst:Issuer' minOccurs='0' />
		<xs:element ref='wst:AuthenticationType' minOccurs='0' />
		<xs:element ref='wst:KeyType' minOccurs='0' />
		<xs:element ref='wst:KeySize' minOccurs='0' />
		<xs:element ref='wst:SignatureAlgorithm' minOccurs='0' />
		<xs:element ref='wst:Encryption' minOccurs='0' />
		<xs:element ref='wst:EncryptionAlgorithm' minOccurs='0' />
		<xs:element ref='wst:CanonicalizationAlgorithm' minOccurs='0' />
		<xs:element ref='wst:ProofEncryption' minOccurs='0' />
		<xs:element ref='wst:UseKey' minOccurs='0' />
		<xs:element ref='wst:SignWith' minOccurs='0' />
		<xs:element ref='wst:EncryptWith' minOccurs='0' />
		<xs:element ref='wst:DelegateTo' minOccurs='0' />
		<xs:element ref='wst:Forwardable' minOccurs='0' />
		<xs:element ref='wst:Delegatable' minOccurs='0' />
		<xs:element ref='wsp:Policy' minOccurs='0' />
		<xs:element ref='wsp:PolicyReference' minOccurs='0' />
		<xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />

	  </xs:documentation>
	</xs:annotation>
	<xs:sequence>
	  <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
	</xs:sequence>
	<xs:attribute name='Context' type='xs:anyURI' use='optional' />
	<xs:anyAttribute namespace='##other' processContents='lax' />
  </xs:complexType>

  <xs:element name='TokenType' type='xs:anyURI' />

  <xs:element name='RequestType' type='wst:RequestTypeOpenEnum' />

  <xs:simpleType name='RequestTypeOpenEnum' >
	<xs:union memberTypes='wst:RequestTypeEnum xs:anyURI' />
  </xs:simpleType>

  <xs:simpleType name='RequestTypeEnum' >
	<xs:restriction base='xs:anyURI' >
	  <xs:enumeration value='http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue' />
	  <xs:enumeration value='http://schemas.xmlsoap.org/ws/2004/04/security/trust/Renew' />
	  <xs:enumeration value='http://schemas.xmlsoap.org/ws/2004/04/security/trust/Validate' />
	</xs:restriction>
  </xs:simpleType>

  <xs:element name='Base' type='wst:BaseTokenType' />
  <xs:complexType name='BaseTokenType' >
	<xs:sequence>
	  <xs:any namespace='##any' processContents='lax' />
	</xs:sequence>
  </xs:complexType>	

  <xs:element name='Supporting' type='wst:SupportingTokensType' />
  <xs:complexType name='SupportingTokensType' >
	<xs:sequence>
	  <xs:any namespace='##any' processContents='lax' minOccurs='1' maxOccurs='unbounded' />
	</xs:sequence>
  </xs:complexType>

  <!-- WS-Trust Section 5.2 -->
  <xs:element name='RequestSecurityTokenResponse' type='wst:RequestSecurityTokenResponseType' />
  <xs:complexType name='RequestSecurityTokenResponseType' >
	<xs:annotation>
	  <xs:documentation>
		Actual content model is non-deterministic, hence wildcard. The following shows intended content model:

		<xs:element ref='wst:TokenType' minOccurs='0' />
		<xs:element ref='wst:RequestType' />
		<xs:element ref='wst:Base' minOccurs='0' />
		<xs:element ref='wst:Supporting' minOccurs='0' />
		<xs:element ref='wst:RequestedSecurityToken'  minOccurs='0' />
		<xs:element ref='wsp:AppliesTo' minOccurs='0' /> 
		<xs:element ref='wst:Claims' minOccurs='0' />
		<xs:element ref='wst:RequestedTokenReference' minOccurs='0' />
		<xs:element ref='wst:RequestedProofToken' minOccurs='0' />
		<xs:element ref='wst:Entropy' minOccurs='0' />
		<xs:element ref='wst:Lifetime' minOccurs='0' />
		<xs:element ref='wst:Status' minOccurs='0' />
		<xs:element ref='wst:AllowPostdating' minOccurs='0' />
		<xs:element ref='wst:Renewing' minOccurs='0' />
		<xs:element ref='wst:OnBehalfOf' minOccurs='0' />
		<xs:element ref='wst:Issuer' minOccurs='0' />
		<xs:element ref='wst:AuthenticationType' minOccurs='0' />
		<xs:element ref='wst:Authenticator' minOccurs='0' />
		<xs:element ref='wst:KeyType' minOccurs='0' />
		<xs:element ref='wst:KeySize' minOccurs='0' />
		<xs:element ref='wst:SignatureAlgorithm' minOccurs='0' />
		<xs:element ref='wst:Encryption' minOccurs='0' />
		<xs:element ref='wst:EncryptionAlgorithm' minOccurs='0' />
		<xs:element ref='wst:CanonicalizationAlgorithm' minOccurs='0' />
		<xs:element ref='wst:ProofEncryption' minOccurs='0' />
		<xs:element ref='wst:UseKey' minOccurs='0' />
		<xs:element ref='wst:SignWith' minOccurs='0' />
		<xs:element ref='wst:EncryptWith' minOccurs='0' />
		<xs:element ref='wst:DelegateTo' minOccurs='0' />
		<xs:element ref='wst:Forwardable' minOccurs='0' />
		<xs:element ref='wst:Delegatable' minOccurs='0' />
		<xs:element ref='wsp:Policy' minOccurs='0' />
		<xs:element ref='wsp:PolicyReference' minOccurs='0' />
		<xs:any namespace='##other' processContents='lax' minOccurs='0' maxOccurs='unbounded' />

	  </xs:documentation>
	</xs:annotation>
	<xs:sequence>
	  <xs:any namespace='##any' processContents='lax' minOccurs='0' maxOccurs='unbounded' />
	</xs:sequence>
	<xs:attribute name='Context' type='xs:anyURI' use='optional' />
	<xs:anyAttribute namespace='##other' processContents='lax' />
  </xs:complexType>

  <xs:element name='RequestedSecurityToken' type='wst:RequestedSecurityTokenType' />
  <xs:complexType name='RequestedSecurityTokenType' >
	<xs:sequence>
	  <xs:any namespace='##any' processContents='lax' />
	</xs:sequence>
  </xs:complexType>

  <!-- WS-Trust Section 5.3 -->
  <xs:element name='BinarySecret' type='wst:BinarySecretType' />
  <xs:complexType name='BinarySecretType' >
	<xs:simpleContent>
	  <xs:extension base='xs:base64Binary' >
		<xs:attribute name='Type' type='wst:BinarySecretTypeOpenEnum' use='optional' />
		<xs:anyAttribute namespace='##other' processContents='lax' />
	  </xs:extension>
	</xs:simpleContent>
  </xs:complexType>

  <xs:simpleType name='BinarySecretTypeEnum' >
	<xs:restriction base='xs:anyURI' >
	  <xs:enumeration value='http://schemas.xmlsoap.org/ws/2004/04/security/trust/AsymmetricKey' />
	  <xs:enumeration value='http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey' />
	  <xs:enumeration value='http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce' />
	</xs:restriction>
  </xs:simpleType>

  <xs:simpleType name='BinarySecretTypeOpenEnum' >
	<xs:union memberTypes='wst:BinarySecretTypeEnum xs:anyURI' />
  </xs:simpleType>