How to restrict SAML 2.0’s Authentication Context XSD

Question

I’m trying to restrict the Authentication Context XML Schema Definition of specification SAML 2.0. The XSD document is available at here.

The part I’m trying to narrow down is one related to this part of the original XSD:

<xs:complexType name="PasswordType">
  <xs:sequence>
    <xs:element ref="Length" minOccurs="0"/>
    <xs:element ref="Alphabet" minOccurs="0"/>
    <xs:element ref="Generation" minOccurs="0"/>
    <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
  </xs:sequence>
  <xs:attribute name="ExternalVerification" type="xs:anyURI" use="optional"/>
</xs:complexType>

<xs:element name="RestrictedPassword" type="RestrictedPasswordType"/>

<xs:complexType name="RestrictedPasswordType">
  <xs:complexContent>
    <xs:restriction base="PasswordType">
      <xs:sequence>
        <xs:element name="Length" type="RestrictedLengthType" minOccurs="1"/>
        <xs:element ref="Generation" minOccurs="0"/>
        <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
      </xs:sequence>
      <xs:attribute name="ExternalVerification" type="xs:anyURI" use="optional"/>
    </xs:restriction>
  </xs:complexContent>
</xs:complexType>

Well, I don’t know how to narrow down the complex type RestrictedPassword. Below is my XSD, which tries to restrict the original XSD.

<?xml version="1.0" encoding="UTF-8"?>

<xs:schema version="2.0"
       targetNamespace="urn:m:SAML:2.0:ac:classes:K"
       xmlns:xs="http://www.w3.org/2001/XMLSchema"
       xmlns="urn:m:SAML:2.0:ac:classes:K"           
       finalDefault="extension"
       blockDefault="substitution">

<xs:redefine schemaLocation="http://docs.oasis-open.org/security/saml/v2.0/saml-schema-authn-context-types-2.0.xsd">    

    <xs:complexType name="RestrictedPasswordType">
        <xs:complexContent>
            <xs:restriction base="RestrictedPasswordType">
                <xs:sequence>
                    <xs:element ref="Length" minOccurs="0"/>
                    <xs:element ref="Generation"/>
                    <xs:element ref="Extension" minOccurs="0" maxOccurs="unbounded"/>
                </xs:sequence>
                <xs:attribute name="ExternalVerification" type="xs:anyURI" use="optional"/>
            </xs:restriction>
        </xs:complexContent>
    </xs:complexType>

</xs:redefine>    
</xs:schema>

When I try to validate this XSD in that tool, it returns me an error, that I do not know what nor how to fix. The error is as follows:

-- Not valid. Error - Line 12, 51: org.xml.sax.SAXParseException; lineNumber: 12; columnNumber: 51; rcase-Recurse.2: There is not a complete functional mapping between the particles. Error - Line 12, 51: org.xml.sax.SAXParseException; lineNumber: 12; columnNumber: 51; derivation-ok-restriction.5.4.2: Error for type 'RestrictedPasswordType'. The particle of the type is not a valid restriction of the particle of the base. –

Answer 1

All instances of the new type must also be valid for the base type. But in your schema it is possible to define a RestrictedPasswordType which does not have an attribute Length attribute (minOccurs="0"), which would be illegal for the base type, which has minOccurs="1". Making an element optional is not a restriction.

Remove minOccurs='0' of Generation is legal because having at least one element is a restriction.

In addition its restriction references the element Length which is not the same as the Length defined in the base type. The element Length is a LengthType according to the basic scheme, and the Length base type is a RestrictedLengthType which is a restriction of LengthType.

I believe that if you change the statement <xs:element> of its redefinition to:

<xs:element name="Length" type="RestrictedLengthType" minOccurs="1"/>

should work unless there are other problems.

EDIT: the other problems:

As a new element Length is being declared in the block <complexType>, it needs to be declared as "qualified" otherwise it will not be part of the targetNamespace and the restriction will fail. To fix this you can:

• Add an attribute form="qualified" at the <xs:element name="Length" ... />, or
• Add an attribute elementFormDefault="qualified" ao elemento`.

More information here:

• On rules for redefinitions: XML Schema Part 1 - 4.2 Layer 2: Schema Documents, Namespaces and Composition
• About qualification and namespaces: XML Schema Primer - 3 Advanced Concepts I: Namespaces, Schemas & Qualification