<?xml version="1.0" encoding="UTF-8"?>

<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered"
  xmlns:ac="urn:oasis:names:tc:SAML:2.0:ac" 
  xmlns:xs="http://www.w3.org/2001/XMLSchema" 
  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered"
  finalDefault="extension">

  <xs:import namespace="urn:oasis:names:tc:SAML:2.0:ac" schemaLocation="sstc-saml-schema-authn-context-1.0.xsd"/>

  <xs:annotation>
    <xs:documentation> 
      urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered
    </xs:documentation>
  </xs:annotation>

  <xs:complexType name="AuthnContextDeclaration">
    <xs:complexContent>
      <xs:restriction base="ac:AuthnContextDeclarationBaseType">
        <xs:sequence>
          <xs:element ref="Identification" minOccurs="0"/>
          <xs:element ref="TechnicalProtection" minOccurs="0"/>
          <xs:element ref="OperationalProtection" minOccurs="0"/>
          <xs:element ref="AuthnMethod"/>
          <xs:element ref="ac:GoverningAgreements" minOccurs="0"/>
          <xs:element ref="ac:AuthenticatingAuthority" minOccurs="0"
            maxOccurs="unbounded"/>
          <xs:element ref="ac:Extension" minOccurs="0"
            maxOccurs="unbounded"/>
        </xs:sequence>
        <xs:attribute name="ID" type="xs:ID"/>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="AuthnMethod" type="AuthnMethodType"/>

  <xs:complexType name="AuthnMethodType">
    <xs:complexContent>
      <xs:restriction base="ac:AuthnMethodBaseType">
        <xs:sequence>
          <xs:element ref="ac:PrincipalAuthenticationMechanism" minOccurs="0"/>
          <xs:element ref="Authenticator"/>
          <xs:element ref="AuthenticatorTransportProtocol"
            minOccurs="0"/>
          <xs:element ref="ac:Extension" minOccurs="0"
            maxOccurs="unbounded"/>
        </xs:sequence>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>    
    
  <xs:element name="Authenticator" type="AuthenticatorType"/>

  <xs:complexType name="AuthenticatorType">
    <xs:complexContent>
      <xs:restriction base="ac:AuthenticatorBaseType">
        <xs:choice>
          <xs:element ref="ac:DigSig"/>
          <xs:element ref="ac:ZeroKnowledge"/>
          <xs:element ref="ac:SharedSecretChallengeResponse"/>
          <xs:element ref="ac:SharedSecretDynamicPlaintext"/>
          <xs:element ref="ac:AsymmetricDecryption"/>
          <xs:element ref="ac:AsymmetricKeyAgreement"/>
        </xs:choice>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="AuthenticatorTransportProtocol" type="SecureTransportType"/>

  <xs:complexType name="SecureTransportType">
    <xs:complexContent>
      <xs:restriction base="ac:AuthenticatorTransportProtocolType">
        <xs:choice>
          <xs:element ref="ac:SSL"/>
          <xs:element ref="ac:MobileNetworkRadioEncryption"/>
          <xs:element ref="ac:MobileNetworkEndToEndEncryption"/>
          <xs:element ref="ac:WTLS"/>
        </xs:choice>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="OperationalProtection" type="OperationalProtectionType"/>

  <xs:complexType name="OperationalProtectionType">
    <xs:complexContent>
      <xs:restriction base="OperationalProtectionType">
        <xs:sequence>
          <xs:element ref="ac:SecurityAudit"/>
          <xs:element ref="ac:DeactivationCallCenter"/>
          <xs:element ref="ac:Extension" minOccurs="0" maxOccurs="unbounded"/>
        </xs:sequence>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="TechnicalProtection" type="TechnicalProtectionType"/>

  <xs:complexType name="TechnicalProtectionType">
    <xs:complexContent>
      <xs:restriction base="ac:TechnicalProtectionBaseType">
        <xs:choice>
          <xs:element ref="PrivateKeyProtection"/>
          <xs:element ref="SecretKeyProtection"/>
        </xs:choice>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="PrivateKeyProtection" type="PrivateKeyProtectionType"/>

  <xs:complexType name="PrivateKeyProtectionType">
    <xs:complexContent>
      <xs:restriction base="ac:PrivateKeyProtectionType">
        <xs:sequence>
          <xs:element ref="KeyStorage"/>
          <xs:element ref="ac:Extension" minOccurs="0" maxOccurs="unbounded"/>
        </xs:sequence>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="SecretKeyProtection" type="SecretKeyProtectionType"/>

  <xs:complexType name="SecretKeyProtectionType">
    <xs:complexContent>
      <xs:restriction base="ac:SecretKeyProtectionType">
        <xs:sequence>
          <xs:element ref="KeyStorage"/>
          <xs:element ref="ac:Extension" minOccurs="0" maxOccurs="unbounded"/>
        </xs:sequence>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="KeyStorage" type="KeyStorageType"/>

  <xs:complexType name="KeyStorageType">
    <xs:complexContent>
      <xs:restriction base="ac:KeyStorageType">
        <xs:attribute name="medium" use="required">
          <xs:simpleType>
            <xs:restriction base="xs:NMTOKEN">
              <xs:enumeration value="MobileDevice"/>
              <xs:enumeration value="MobileAuthCard"/>
              <xs:enumeration value="smartcard"/>
            </xs:restriction>
          </xs:simpleType>
        </xs:attribute>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>
  
  <xs:element name="SecurityAudit" type="SecurityAuditType"/>

  <xs:complexType name="SecurityAuditType">
    <xs:complexContent>
      <xs:restriction base="ac:SecurityAuditType">
        <xs:sequence>
          <xs:element ref="ac:SwitchAudit"/>
          <xs:element ref="ac:Extension" minOccurs="0" maxOccurs="unbounded"/>
        </xs:sequence>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>
  
  <xs:element name="Identification" type="IdentificationType"/>

  <xs:complexType name="IdentificationType">
    <xs:complexContent>
      <xs:restriction base="ac:IdentificationType">
        <xs:attribute name="nym">
          <xs:simpleType>
            <xs:restriction base="xs:NMTOKEN">
              <xs:enumeration value="anonymity"/>
              <xs:enumeration value="pseudonymity"/>
            </xs:restriction>
          </xs:simpleType>
        </xs:attribute>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

</xs:schema>