<?xml version="1.0" encoding="UTF-8"?>

<xs:schema targetNamespace="urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword"
  xmlns:ac="urn:oasis:names:tc:SAML:2.0:ac" 
  xmlns:xs="http://www.w3.org/2001/XMLSchema" 
  xmlns="urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword"
  finalDefault="extension">

  <xs:import namespace="urn:oasis:names:tc:SAML:2.0:ac" schemaLocation="sstc-saml-schema-authn-context-1.0.xsd"/>

  <xs:annotation>
    <xs:documentation> 
      urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword
    </xs:documentation>
  </xs:annotation>

  <xs:complexType name="AuthnContextDeclaration">
    <xs:complexContent>
      <xs:restriction base="ac:AuthnContextDeclarationBaseType">
        <xs:sequence>
          <xs:element ref="ac:Identification" minOccurs="0"/>
          <xs:element ref="ac:TechnicalProtection" minOccurs="0"/>
          <xs:element ref="ac:OperationalProtection" minOccurs="0"/>
          <xs:element ref="AuthnMethod"/>
          <xs:element ref="ac:GoverningAgreements" minOccurs="0"/>
          <xs:element ref="ac:AuthenticatingAuthority" minOccurs="0"
            maxOccurs="unbounded"/>
          <xs:element ref="ac:Extension" minOccurs="0"
            maxOccurs="unbounded"/>
        </xs:sequence>
        <xs:attribute name="ID" type="xs:ID"/>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="AuthnMethod" type="AuthnMethodType"/>

  <xs:complexType name="AuthnMethodType">
    <xs:complexContent>
      <xs:restriction base="ac:AuthnMethodBaseType">
        <xs:sequence>
          <xs:element ref="PrincipalAuthenticationMechanism"/>
          <xs:element ref="Authenticator"/>
          <xs:element ref="ac:AuthenticatorTransportProtocol" minOccurs="0"/>
          <xs:element ref="ac:Extension" minOccurs="0"
            maxOccurs="unbounded"/>
        </xs:sequence>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="PrincipalAuthenticationMechanism" type="PasswordAuthnMechanismType"/>

  <xs:complexType name="PasswordAuthnMechanismType">
    <xs:complexContent>
      <xs:restriction base="ac:PrincipalAuthenticationMechanismType">
        <xs:sequence>
          <xs:choice>
            <xs:element ref="ac:RestrictedPassword"/>
          </xs:choice>
        </xs:sequence>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>
 
  <xs:element name="Authenticator" type="SharedSecretType"/>

  <xs:complexType name="SharedSecretType">
    <xs:complexContent>
      <xs:restriction base="ac:AuthenticatorBaseType">
        <xs:choice>
          <xs:element ref="SharedSecretChallengeResponse"/>
        </xs:choice>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

  <xs:element name="SharedSecretChallengeResponse" type="ChallengeResponseType"/>

  <xs:complexType name="ChallengeResponseType">
    <xs:complexContent>
      <xs:restriction base="ac:SharedSecretChallengeResponseType">
        <xs:attribute name="method" fixed="urn:ietf:rfc:2945"/>
      </xs:restriction>
    </xs:complexContent>
  </xs:complexType>

</xs:schema>
