<?xml version="1.0" encoding="UTF-8" standalone="no"?><!--
  ~ Copyright (c) 2010-2019 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  --><xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:jaxb="https://jakarta.ee/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" elementFormDefault="qualified" jaxb:extensionBindingPrefixes="xjc" jaxb:version="3.0" targetNamespace="http://midpoint.evolveum.com/xml/ns/public/common/common-3">

    <xsd:annotation>
        <xsd:documentation>
            Security parts of common schema.
        </xsd:documentation>
    </xsd:annotation>

    <!-- Don't provide schemaLocation here, as it causes xjc to really contact the URIs (!) -->
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/annotation-3" schemaLocation="../annotation-3.xsd"/>
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/types-3" schemaLocation="../types-3.xsd"/>
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/query-3" schemaLocation="../query-3.xsd"/>

    <xsd:include schemaLocation="common-core-3.xsd"/>

    <xsd:complexType name="SecurityPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Object that contains definitions of overall security policy.
                It contains configuration of authentication mechanisms, credentials management
                (such as password resets) and so on.
                Please note that this NOT contain authorization and auditing. Authorization is
                defined in roles (see RoleType) and auditing has a separate configuration.
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:registration</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                    <a:comment>Use self-registration flow instead.</a:comment>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="authentication" type="tns:AuthenticationsPolicyType">
                    </xsd:element>
                    <xsd:element minOccurs="0" name="credentials" type="tns:CredentialsPolicyType">
                    </xsd:element>
                    <xsd:element minOccurs="0" name="flow" type="tns:RegistrationsPolicyType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:since>3.8</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="credentialsReset" type="tns:CredentialsResetPolicyType">
                    </xsd:element>
                    <xsd:element minOccurs="0" name="identityRecovery" type="tns:IdentityRecoveryPolicyType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:since>4.8</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="securityPolicy" substitutionGroup="c:object" type="tns:SecurityPolicyType"/>

    <xsd:complexType name="AuthenticationsPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Definition of the use of authentication mechanisms. This part specifies how midPoint
                    uses the credentials to authenticate users. This is also the place where SSO system
                    integrations are specified.
                </p>
                <p>
                    This is in fact practically applicable only in default security policy
                    (the policy that is referenced from system configuration).
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:mailAuthentication</a:element>
                    <a:version>4.6</a:version>
                    <a:operation>removed</a:operation>
                    <a:comment>Use flexible authentication sequence instead.</a:comment>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:smsAuthentication</a:element>
                    <a:version>4.6</a:version>
                    <a:operation>removed</a:operation>
                    <a:comment>Use flexible authentication sequence instead.</a:comment>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="0" name="modules" type="tns:AuthenticationModulesType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="sequence" type="tns:AuthenticationSequenceType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="ignoredLocalPath" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Path without authentication.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AuthenticationModulesType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of authentication modules that midPoint is aware about.
                Each element has a configuration of a particular authentication element instance.
                Each modules specified in the container must have unique name.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="loginForm" type="tns:LoginFormAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="httpBasic" type="tns:HttpBasicAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="httpHeader" type="tns:HttpHeaderAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="saml2" type="tns:Saml2AuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="oidc" type="tns:OidcAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="mailNonce" type="tns:MailNonceAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="smsNonce" type="tns:SmsNonceAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="securityQuestionsForm" type="tns:SecurityQuestionsFormAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="httpSecQ" type="tns:HttpSecQAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="ldap" type="tns:LdapAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="attributeVerification" type="tns:AttributeVerificationAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="focusIdentification" type="tns:FocusIdentificationAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="hint" type="tns:HintAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="other" type="tns:OtherAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="archetypeSelection" type="tns:ArchetypeSelectionModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="correlation" type="tns:CorrelationAuthenticationModuleType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="duo" type="tns:DuoAuthenticationModuleType"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AbstractAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Common supertype for all authentication module definitions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
                <a:naturalKey>tns:identifier</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique name of the authentication module. This name is fact a short identifier.
                        It is supposed to give some idea about nature of the module to system administrator.
                        But it is not supposed to be used as a user-friendly label for the module.
                        Module name must be unique.
                        <p>
                            Deprecated, use identifier instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.7</a:deprecatedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="identifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique module identifier. Can be used to reference the module.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free form description of the module (administrator comment).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="UserType" minOccurs="0" name="focusType" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of logged object that this authentication module applies to. E.g UserType, RoleType, OrgType, ...
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" ref="tns:documentation"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AbstractCredentialAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Common definition for all authentication modules that use password.
                </p>
                <p>
                    This is an authentication module setting. It controls how credentials are used
                    for authentication. It does not control how credentials are set (stored), e.g. it does NOT
                    control password policy. Credential policy setting is supposed to do that.
                    E.g. acceptEmptyPassword setting in this data type controls whether empty password can
                    be used for authentication. It does not control whether empty password can be set or whether
                    existing password can be removed.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="credentialName" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of credential definition that should be used when validating password.
                                This must point to a valid credential definition
                                in the "credential" section of a security policy.
                                If not specified then default password definition is used.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AbstractPasswordAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Common definition for all authentication modules that use password.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element default="false" maxOccurs="1" minOccurs="0" name="acceptEmptyPassword" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If set to true than an empty (all blank) password will be accepted as valid password.
                                Password is still compared with user's password. Therefore for the password to be accepted
                                an empty password must still be set as a credential for a user.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="LoginFormAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of "login form" module. The module is used for interactive log-in of a user by using
                HTML forms.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPasswordAuthenticationModuleType">
                <xsd:sequence>
                    <!-- Nothing to add now. Maybe later. -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="HttpBasicAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of HTTP BASIC authentication module (RFC 7617).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPasswordAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="realm" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Realm which Midpoint use for WWW-Authentication header
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="HttpHeaderAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Pseudo-authentication for pre-authenticated users. Based on HTTP header values.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="usernameHeader" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of HTTP header that contains username.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="logoutUrl" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Url for redirect after logout. Default is '/'.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="OtherAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>

            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element name="factoryClass" type="xsd:string"/>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="parameter" type="tns:OtherAuthenticationModuleParameterType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ArchetypeSelectionModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Module is used for the refining user search based on archetype selection. For example, for "lost my
                username" case the archetypes provide the information about the user who can recover the username
                and this archetype is later used for the search.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="archetypeSelection" type="tns:ArchetypeSelectionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A set of archetypes which provides e.g. rules to be applied during user authentication.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="allowUndefinedArchetype" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Enables the case when no archetype can be selected. If set to true, the user can be
                                authenticated e.g. by the rules from global security policy.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CorrelationAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Module is used for the user authentication using the correlation rules. Rules can be configured in object template
                per archetype or on global level. For example, for "lost my
                username" case the archetypes provide the information about correlation rules to be applied.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="correlator" type="tns:CorrelationModuleConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Correlator configuration.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="options" type="tns:CorrelationModuleOptionsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Options for correlation module. For example, limitation for the number of users which can be found by
                                correlation.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CorrelationModuleConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration for correlation module. E.g. which correlator to use specified by its identifier.
                Ordering if more than one correlator is used, etc. TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="correlatorIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        "name" attribute of the correlator as set in object template.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="order" type="xsd:int"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="DuoAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Module is used for 2FA authentication.
                Module use duo server for authentication via hardware key of mobile, tablet and so on.
                We cant use it as only one authentication module. We need some primary authentication module for example saml.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element minOccurs="1" name="clientId" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                This value is the client id provided by Duo in the admin panel.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="1" name="clientSecret" type="t:ProtectedStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                This value is the client secret provided by Duo in the admin panel.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="1" name="apiHostname" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                This value is the api host provided by Duo in the admin panel.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="CACerts" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                List of CA Certificates to use. You need add your cert when it misses in default certs.

                                Default values:
                                C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Root CA
                                'sha256/I/Lt/z7ekCWanjD0Cvj5EqXls2lOaThEA0H2Bg4BT/o=',
                                C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Global Root CA
                                'sha256/r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=',
                                C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
                                'sha256/WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18=',
                                C=US, O=SecureTrust Corporation, CN=SecureTrust CA
                                'sha256/dykHF2FLJfEpZOvbOLX4PKrcD2w2sHd/iA/G3uHTOcw=',
                                C=US, O=SecureTrust Corporation, CN=Secure Global CA
                                'sha256/JZaQTcTWma4gws703OR/KFk313RkrDcHRvUt6na6DCg=',
                                C=US, O=Amazon, CN=Amazon Root CA 1
                                'sha256/++MBgDH5WGvL9Bcn5Be30cRcL0f5O+NyoXuWtQdX1aI=',
                                C=US, O=Amazon, CN=Amazon Root CA 2
                                'sha256/f0KW/FtqTjs108NpYj42SrGvOB2PpxIVM8nWxjPqJGE=',
                                C=US, O=Amazon, CN=Amazon Root CA 3
                                'sha256/NqvDJlas/GRcYbcWE8S/IceH9cq77kg0jVhZeAPXq8k=',
                                C=US, O=Amazon, CN=Amazon Root CA 4
                                'sha256/9+ze1cZgR9KO1kZrVDxA4HQ6voHRCSVNz4RdTCx4U8U=',
                                C=BM, O=QuoVadis Limited, CN=QuoVadis Root CA 2
                                'sha256/j9ESw8g3DxR9XM06fYZeuN1UB4O6xp/GAIjjdD/zM3g='
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="0" name="pathForDuoUsername" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The path to the user attribute which should be sent to duo server as username of authenticated user.
                                Default path is for name attribute.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="OtherAuthenticationModuleParameterType">
        <xsd:annotation>
            <xsd:documentation>

            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string"/>
            <xsd:element name="value" type="xsd:string"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LdapAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                LDAP authentication module supports authentication via LDAP server.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="1" name="host" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Host of the LDAP server.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="1" name="userDn" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                The user distinguished name.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="1" name="userPassword" type="t:ProtectedStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The password (credentials) to use for getting authenticated contexts.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="0" name="dnPattern" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                The pattern which will be used to supply a DN for the user.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="0" name="search" type="tns:LdapSearchAuthenticationModuleType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AttributeVerificationAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                The module can be used as an additional verification of the already authenticated user.
                Intended for interactive user verification by comparing the specified attribute with the value provided by the user.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="path" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The path to the user attribute which should be verified.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AttributeVerificationAuthenticationModuleType.path</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="HintAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialAuthenticationModuleType">
                <xsd:sequence>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="FocusIdentificationAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="tns:ModuleItemConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The path to the user attribute which should be verified.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AttributeVerificationAuthenticationModuleType.path</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ModuleItemConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="0" name="path" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        The path to the user attribute which should be verified.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ModuleItemConfigurationType.path</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element a:maxOccurs="1" name="matchingRule" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Matching rule which should be used for this item while filtering or comparing
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ModuleItemConfigurationType.matchingRule</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- later maybe we will need priority, mandatory, ... -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LdapSearchAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Search configuration which uses an Ldap filter to locate the user
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="1" name="pattern" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        The filter expression used in the user search. This is an LDAP search filter
                        (as defined in 'RFC 2254') with optional arguments. Example (uid={0})
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="namingAttr" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifying explicit LDAP attribute that is retrieved from user's LDAP
                        account and contains value that matches midPoint's username.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="subtree" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If true then searches the entire subtree as identified by context, if false (the
                        default) then only searches the level identified by the context.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="Saml2AuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 authentication module support authentication via Identity provider with SAML2.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
                <a:schemaMigration>
                    <a:element>tns:network</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="1" name="serviceProvider" type="tns:Saml2ServiceProviderAuthenticationModuleType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="Saml2NetworkAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 authentication module, network configuration.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="0" name="readTimeout" type="xsd:int"/>
            <xsd:element maxOccurs="1" minOccurs="0" name="connectTimeout" type="xsd:int"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="Saml2ServiceProviderAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 authentication module, service provider configuration.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
                <a:schemaMigration>
                    <a:element>tns:defaultDigest</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:wantAssertionsSigned</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:singleLogoutEnabled</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:nameId</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:provider</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>moved</a:operation>
                    <a:replacement>tns:identityProvider</a:replacement>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:metadata</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="1" name="entityId" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique identifier of the service provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="alias" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique alias used to identify the selected local service provider based on used URL.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="aliasForPath" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Alias used for AssertionConsumerServiceURL.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="defaultSigningAlgorithm" type="tns:Saml2SigningAlgorithmAuthenticationModuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default signing algorithm. Default is RSA_SHA256.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" maxOccurs="1" minOccurs="0" name="signRequests" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Flag indicating whether this service signs authentication requests.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="keys" type="tns:Saml2KeyAuthenticationModuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        Key used by service provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="1" name="identityProvider" type="tns:Saml2ProviderAuthenticationModuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        Possible identity providers for this service provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="Saml2SigningAlgorithmAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Possible signing algorithm.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="http://www.w3.org/2000/09/xmldsig#rsa-sha1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RSA_SHA1"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RSA_SHA256"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RSA_SHA512"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="http://www.w3.org/2001/04/xmldsig-more#rsa-ripemd160">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RSA_RIPEMD160"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="Saml2KeyAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 key.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:choice>
                <xsd:element minOccurs="0" name="activeSimpleKey" type="tns:ModuleSaml2SimpleKeyType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Active key.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element minOccurs="0" name="activeKeyStoreKey" type="tns:ModuleSaml2KeyStoreKeyType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Active key.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice> <!--> can use only one of types, but all can be null<-->
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="standBySimpleKey" type="tns:ModuleSaml2SimpleKeyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Stand-by keys.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="standByKeyStoreKey" type="tns:ModuleSaml2KeyStoreKeyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Stand-by keys.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ModuleSaml2KeyStoreKeyType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 key from key store. Supported only JKS type of key store.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractKeyStoreKeyType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="type" type="tns:ModuleSaml2KeyTypeType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AbstractKeyStoreKeyType">
        <xsd:annotation>
            <xsd:documentation>
                Abstract type for key from key store. Supported only JKS type of key store.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="1" name="keyStorePath" type="xsd:string"/>
            <xsd:element maxOccurs="1" minOccurs="1" name="keyStorePassword" type="t:ProtectedStringType"/>
            <xsd:element maxOccurs="1" minOccurs="1" name="keyAlias" type="xsd:string"/>
            <xsd:element maxOccurs="1" minOccurs="0" name="keyPassword" type="t:ProtectedStringType"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AbstractSimpleKeyType">
        <xsd:annotation>
            <xsd:documentation>
                Abstract type for key from string representation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="1" name="privateKey" type="t:ProtectedStringType"/>
            <xsd:element maxOccurs="1" minOccurs="1" name="passphrase" type="t:ProtectedStringType"/>
            <xsd:element maxOccurs="1" minOccurs="1" name="certificate" type="t:ProtectedStringType"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ModuleSaml2SimpleKeyType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 key from string representation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractSimpleKeyType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="type" type="tns:ModuleSaml2KeyTypeType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="ModuleSaml2KeyTypeType">
        <xsd:annotation>
            <xsd:appinfo>
                <xsd:documentation>
                    Possible types of key.
                </xsd:documentation>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="signing">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SIGNING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unspecified">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNSPECIFIED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="encryption">
                <xsd:annotation>
                    <xsd:documentation>
                        REMOVED:
                        <!-- todo reason -->
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENCRYPTION"/>
                        <a:removed>true</a:removed>
                        <a:removedSince>4.8</a:removedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="decryption">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DECRYPTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="Saml2ProviderAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 provider.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
                <a:schemaMigration>
                    <a:element>tns:alias</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:skipSslValidation</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:metadataTrustCheck</a:element>
                    <a:version>4.5</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="1" name="entityId" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique identifier of the identity provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="1" name="metadata" type="tns:Saml2ProviderMetadataAuthenticationModuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        Metadata of Identity provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="linkText" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        User friendly name of provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="authenticationRequestBinding" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        SAML2 binding used for authentication request.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="verificationKeys" type="t:ProtectedStringType"/>
            <xsd:element maxOccurs="1" minOccurs="1" name="nameOfUsernameAttribute" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of attribute in response, which value define name of user in Midpoint. For example 'uid'.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="Saml2ProviderMetadataAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                SAML2 provider metadata.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:choice>
                <xsd:element minOccurs="1" name="metadataUrl" type="xsd:string">
                    <xsd:annotation>
                        <xsd:documentation>
                            URL, which show metadata.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element minOccurs="1" name="xml" type="xsd:base64Binary">
                    <xsd:annotation>
                        <xsd:documentation>
                            Xml of metadata encrypted by base64.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element minOccurs="1" name="pathToFile" type="xsd:string">
                    <xsd:annotation>
                        <xsd:documentation>
                            Path to xml file, which contains metadata.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="OidcAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                OpenId Connect authentication module.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="client" type="tns:OidcClientAuthenticationModuleType"/>
                    <xsd:element maxOccurs="1" minOccurs="0" name="resourceServer" type="tns:OidcResourceServerAuthenticationModuleType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="OidcResourceServerAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                OpenID Connect resource server.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:choice>
                <xsd:element maxOccurs="1" minOccurs="0" name="jwt" type="tns:JwtOidcResourceServerType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Define that resource server expect token in format JWT.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element maxOccurs="1" minOccurs="0" name="opaqueToken" type="tns:OpaqueTokenOidcResourceServerType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Define that resource server expect opaque token, which have to be verified by user info endpoint.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice>
            <xsd:element maxOccurs="1" minOccurs="0" name="realm" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Realm which Midpoint use for WWW-Authentication header
                        <p>
                            Deprecated use attribute in token definition instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                        <a:plannedRemoval>4.9</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="issuerUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Issuer identifier uri for the OpenID Connect provider.
                        <p>
                            Deprecated use attribute in token definition instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                        <a:plannedRemoval>4.9</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="jwkSetUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Uri for the JSON Web Key (JWK) Set endpoint.
                        <p>
                            Deprecated use attribute in token definition instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                        <a:plannedRemoval>4.9</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="nameOfUsernameClaim" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of claim in jwt, which value define name of user in Midpoint.
                        <p>
                            Deprecated use attribute in token definition instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                        <a:plannedRemoval>4.9</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="singleSymmetricKey" type="t:ProtectedStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        Trusting a Single Asymmetric Key.
                        <p>
                            Deprecated use attribute in token definition instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                        <a:plannedRemoval>4.9</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="trustedAlgorithm" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Trusted Algorithms. (RFC7518 section-3.1).
                        <p>
                            Deprecated use attribute in token definition instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                        <a:plannedRemoval>4.9</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:choice>
                <xsd:element minOccurs="0" name="trustingAsymmetricCertificate" type="t:ProtectedStringType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Certificate of trusting a single asymmetric RSA public key.
                            <p>
                                Deprecated use attribute in token definition instead
                            </p>
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:deprecated/>
                            <a:deprecatedSince>4.8</a:deprecatedSince>
                            <a:plannedRemoval>4.9</a:plannedRemoval>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element minOccurs="0" name="keyStoreTrustingAsymmetricKey" type="tns:AbstractKeyStoreKeyType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Key store with trusting a single asymmetric RSA public key.
                            <p>
                                Deprecated use attribute in token definition instead
                            </p>
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:deprecated/>
                            <a:deprecatedSince>4.8</a:deprecatedSince>
                            <a:plannedRemoval>4.9</a:plannedRemoval>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice> <!--> can use only one of types, but all can be null<-->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AbstractTokenOidcResourceServerType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="0" name="realm" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Realm which Midpoint use for WWW-Authentication header
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="issuerUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Issuer identifier uri for the OpenID Connect provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="sub" maxOccurs="1" minOccurs="0" name="nameOfUsernameClaim" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of claim which value define name of user in Midpoint.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="JwtOidcResourceServerType">
        <xsd:annotation>
            <xsd:documentation>
                Define that resource server expect token in format JWT.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractTokenOidcResourceServerType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="jwkSetUri" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Uri for the JSON Web Key (JWK) Set endpoint.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="0" name="singleSymmetricKey" type="t:ProtectedStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Trusting a Single Asymmetric Key.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="0" name="trustedAlgorithm" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Trusted Algorithms. (RFC7518 section-3.1).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:choice>
                        <xsd:element minOccurs="0" name="trustingAsymmetricCertificate" type="t:ProtectedStringType">
                            <xsd:annotation>
                                <xsd:documentation>
                                    Certificate of trusting a single asymmetric RSA public key.
                                </xsd:documentation>
                            </xsd:annotation>
                        </xsd:element>
                        <xsd:element minOccurs="0" name="keyStoreTrustingAsymmetricKey" type="tns:AbstractKeyStoreKeyType">
                            <xsd:annotation>
                                <xsd:documentation>
                                    Key store with trusting a single asymmetric RSA public key.
                                </xsd:documentation>
                            </xsd:annotation>
                        </xsd:element>
                    </xsd:choice> <!--> can use only one of types, but all can be null<-->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="OpaqueTokenOidcResourceServerType">
        <xsd:annotation>
            <xsd:documentation>
                Define that resource server expect opaque token, which have to be verified by user info endpoint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractTokenOidcResourceServerType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="userInfoUri" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                URI for user info endpoint.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="OidcClientAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                OpenID Connect client.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="1" name="registrationId" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique identifier of the client. RegistrationId is used in url path,
                        so it has to contain only correct symbols.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="1" name="clientId" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        OAuth 2.0 Client Identifier valid at the Authorization Server.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="clientSecret" type="t:ProtectedStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        OAuth 2.0 Client Secret valid at the Authorization Server.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="clientAuthenticationMethod" type="tns:OidcClientAuthenticationMethodType">
                <xsd:annotation>
                    <xsd:documentation>
                        Define client authentication method.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="clientSigningAlgorithm" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier of algorithm for digitally sign or create a MAC
                        of the content. (RFC7518 section-3.1)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="idTokenSigningAlgorithm" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        JWA algorithm used for signing ID tokens. (RFC7518 section-3.1)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="scope" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        OpenID Connect Clients use scope values as defined in 3.3 of OAuth 2.0 [RFC6749] to specify what access
                        privileges are being requested for Access Tokens.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="clientName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Human friendly name of client.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="nameOfUsernameAttribute" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of attribute in response, which value define name of user in Midpoint.
                        Default value is 'sub'.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="1" name="openIdProvider" type="tns:OidcOpenIdProviderType"/>
            <xsd:choice>
                <xsd:element minOccurs="0" name="simpleProofKey" type="tns:AbstractSimpleKeyType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Key used for sign with PRIVATE_KEY_JWT.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element minOccurs="0" name="keyStoreProofKey" type="tns:AbstractKeyStoreKeyType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Key used for sign with PRIVATE_KEY_JWT.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice> <!--> can use only one of types, but all can be null<-->
            <xsd:element default="false" minOccurs="0" name="usePkce" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Use Proof Key for Code Exchange for added security. (RFC7636)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="OidcClientAuthenticationMethodType">
        <xsd:annotation>
            <xsd:appinfo>
                <xsd:documentation>
                    Possible client authentication methods.
                </xsd:documentation>
                <jaxb:typesafeEnumClass/>
                <a:since>4.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="clientSecretBasic">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLIENT_SECRET_BASIC"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="clientSecretPost">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLIENT_SECRET_POST"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="clientSecretJwt">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLIENT_SECRET_JWT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="privateKeyJwt">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PRIVATE_KEY_JWT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="OidcOpenIdProviderType">
        <xsd:annotation>
            <xsd:documentation>
                OpenID Provider.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="1" minOccurs="0" name="authorizationUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Uri for the authorization endpoint.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="tokenUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Uri for the token endpoint.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="userInfoUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Uri for user info endpoint.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="jwkSetUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Uri for JSON web key set endpoint.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="1" name="issuerUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Issuer identifier uri for the OpenID Connect provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="endSessionUri" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Uri for logout endpoint.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="MailNonceAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Mail nonce authentication module.
                Module that sends randomly generated nonce in URL in mail message.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPasswordAuthenticationModuleType">
                <xsd:sequence>
                    <!-- Later: emailAddressItem path -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SmsNonceAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                SMS (mobile text message) nonce authentication module.
                Module that sends randomly generated nonce in mobile text message (SMS).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractPasswordAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="mobileTelephoneNumberItemPath" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Path of a user property that will be the source of a mobile telephone number.
                                This number will be the target of SMS message.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AbstractSecurityQuestionsAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Common definition for all authentication modules that use security questions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialAuthenticationModuleType">
                <xsd:sequence>
                    <!-- TODO: Security questions validation policy: how many questions to present, how many need to be answered successfuly, randomize order, etc. -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SecurityQuestionsFormAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of "security questions form" module. The module is used for interactive log-in of a user by
                answering a set of security questions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractSecurityQuestionsAuthenticationModuleType">
                <xsd:sequence>
                    <!-- Nothing to add now. Maybe later. -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="HttpSecQAuthenticationModuleType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of HTTP SecQ module. The module is used for quasi-interative log-in of a user by
                answering a set of security questions. The HTTP SecQ mechanism is similar to HTTP BASIC mechanism,
                but it is using security questions instead of password.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractSecurityQuestionsAuthenticationModuleType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="realm" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Realm which Midpoint use for WWW-Authentication header
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AuthenticationSequenceType">
        <xsd:annotation>
            <xsd:documentation>
                Authentication sequence. It is a sequence of authentication modules. The modules could be invoked
                in order, or they may be invoked in parallel if the specific implementation allows such approach.
                The purpose of the sequence is to guide user through a complete authentication process.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
                <a:naturalKey>tns:identifier</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique name of the authentication sequence. This name is fact a short identifier.
                        It is supposed to give some idea about purpose of the sequence to system administrator.
                        But it is not supposed to be used as a user-friendly label.
                        Sequence name must be unique.
                        <p>
                            Deprecated, use identifier instead
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.7</a:deprecatedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="identifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique sequence identifier. Can be used to reference the sequence.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="displayName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Display name of sequence. This is shown for identifying of authentication sequence in GUI.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free form description of the sequence (administrator comment).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="1" name="channel" type="tns:AuthenticationSequenceChannelType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of channel for authentication sequence.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="requireAssignmentTarget" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Required assignment target(s). This authentication sequence is applicable only to users that
                        have active assignment with this target (and relation). If the sequence is attempted on a user
                        that does not have this assignment then the authentication will fail.

                        All targets must be present. They are checked against effective link values ("roleMembershipRef").
                        OID, type (if present), and relation is matched. If relation is not defined, org:default is assumed.
                        Value of q:any may be used to denote any relation value.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="nodeGroup" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Required node group. This authentication sequence is applicable only to node group that
                        have active assignment with this archetype.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- later: prohibitAssignmentTarget -->
            <!-- later: authenticationContextAttribute -->
            <xsd:element maxOccurs="unbounded" minOccurs="1" name="module" type="tns:AuthenticationSequenceModuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of authentication module in the sequence.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="focusBehaviorUpdate" type="tns:FocusBehaviorUpdateType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:since>4.5</a:since>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Option for updating focus authentication behaviour attributes. We can enable/disable updating of focus
                        behavior during every login, or we can use option for updating behaviour only when login failed and
                        during success login after fails login. Default value is 'everyLogin'.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="FocusBehaviorUpdateType">
        <xsd:annotation>
            <xsd:documentation>
                Option for updating focus authentication behaviour attributes. We can enable/disable updating of focus
                behavior during every login, or we can use option for updating behaviour only when login failed and
                during success login after fails login.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.5</a:since>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="enabled">
                <xsd:annotation>
                    <xsd:documentation>
                        Behaviour attributes will be updated every login.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="disabled">
                <xsd:annotation>
                    <xsd:documentation>
                        Authentication behaviour attributes will not be updated during login.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DISABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="failureOnly">
                <xsd:annotation>
                    <xsd:documentation>
                        Authentication behaviour attributes will be updated when login failed and when login will be success,
                        but previous login was failed and midPoint need update attributes as is number of login fails
                        and lockout state.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FAILURE_ONLY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AuthenticationSequenceChannelType">
        <xsd:annotation>
            <xsd:documentation>
                Channel specification for authentication sequence. It specifies whether this sequence is usable for
                a specific channel (user/GUI, REST, etc.)
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="1" name="channelId" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name (URI) of the channel.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free form description (administrator comment).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="default" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies whether this sequence is the default sequence for a specified channel.
                        The default sequence will be chosen in case that specific sequence was not requested, e.g. by using URL suffix.
                        If this element is not present and only a single sequence is defined for a channel,
                        then such sequence is considered to be the default. If more than one sequence is specified then
                        none of them is considered to be default. In that case this element must be used explicitly.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="1" name="urlSuffix" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        URL suffix that can be used to select this authentication sequence specifically. URL suffix can't contains slash '/'.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- later: URL parameter to select this sequence? -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AuthenticationSequenceModuleType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Specification of authentication module in the sequence.
                </p>
                <p>
                    The authentication modules are evaluated in sequence (or in parallel if possible).
                    At least one authentication module must succeed for authentication to be successful.
                    If there are required or requisite modules in the sequence then all of them must succeed
                    for the sequence to be successful.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
                <a:naturalKey>tns:identifier</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the authentication module name. Value of this element must match name of
                        existing authentication module.
                        <p>
                            Deprecated, use identifier instead.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:deprecatedSince>4.7</a:deprecatedSince>
                        <a:plannedRemoval>4.8</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="identifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique module identifier. Can be used to reference the module.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="display" type="tns:DisplayType"/>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free form description (administrator comment).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" ref="tns:documentation"/>
            <xsd:element default="100" minOccurs="0" name="order" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Ordering number for the module. The modules are sorted according to those numbers.
                        Modules that have the same value of "order" can be evaluated in parallel in case that
                        actual use of authentication mechanism allows that.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="sufficient" minOccurs="0" name="necessity" type="tns:AuthenticationSequenceModuleNecessityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Necessity, i.e. the level of requirement, whether the module is mandatory or optional.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="acceptEmpty" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Some modules might be automatically skipped if the concrete type of credentials is not defined. E.g.
                            if there is no "hint" defined for the user, we can skip evaluation of the hint module. The same can
                            apply for example for security questions.
                        </p>
                        <p>
                            In case the module can be skipped, accept empty must be set to 'true'. After module is set, it is
                            marked as CALLED_OFF in the sequence.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="action" type="tns:GuiActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Action which can be produced from this module's UI form. E.g. redirecting to the documentation page
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- later: requireAuthenticationAttribute, transformAuthenticationAttribute -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="AuthenticationSequenceModuleNecessityType">
        <xsd:annotation>
            <xsd:documentation>
                Necessity, i.e. the level of requirement, whether the module is mandatory or optional.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.1</a:since>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="sufficient">
                <xsd:annotation>
                    <xsd:documentation>
                        The module is sufficient for authentication to succeed. It is NOT required to succeed.
                        If this module succeeds, the evaluation stops. The result is a success. Other modules are NOT evaluated.
                        (Except for the case when "required" module that was evaluated before has failed.)
                        If this module fails, the evaluation continues. Other modules are evaluated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUFFICIENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="required">
                <xsd:annotation>
                    <xsd:documentation>
                        The module is required. The module must succeed for the entire sequence to be successful.
                        If this module succeeds, the evaluation continues. Other modules are evaluated.
                        If this module fails, the evaluation continues. Other modules are evaluated.
                        Final result of authentication sequence is a failure.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REQUIRED"/>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="requisite">
                <xsd:annotation>
                    <xsd:documentation>
                        The module is required. The module must succeed for the entire sequence to be successful.
                        If this module succeeds, the evaluation continues. Other modules are evaluated.
                        If this module fails, the evaluation stops with an error. Other modules are NOT evaluated.
                        Final result of authentication sequence is a failure.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REQUISITE"/>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="optional">
                <xsd:annotation>
                    <xsd:documentation>
                        The module is optional. It is NOT required to succeed.
                        Optional module does not really influence the result of the authentication.
                        But it may be used to add some authentication attributes, it may be used to cross-authenticate
                        is SSO realms and so on.
                        If this module succeeds, the evaluation continues.
                        If this module fails, the evaluation continues.
                        The result of the sequence is a failure only if this is the only module in the sequence and it fails.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OPTIONAL"/>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="CredentialsPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Credentials management policy. It specifies the management details for each supported
                    credentials type. It defines parameters such as credential lifetime. It may define even
                    a very complex schemes for some credential types. E.g. it may define a complete security
                    questions.
                </p>
                <p>
                    This section is a definition of user credentials that midPoint can MANAGE.
                    Which mostly means writing/changing the credentials. This section is not directly concerned
                    with authentication or credential reset - at least not directly.
                    But there may be dependencies. E.g. password reset may use password policy to generate/validate new password.
                    Also, resource-side passwords need to be defined here to be used by authentication modules.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="default" type="tns:CredentialPolicyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Common setting applied to all other credentials type. Any of this
                        setting can be overridden in the individual credentials setting.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="password" type="tns:PasswordCredentialsPolicyType"/>
            <!-- later: resourcePassword ("pass-through" authentication using connector). -->
            <xsd:element minOccurs="0" name="securityQuestions" type="tns:SecurityQuestionsCredentialsPolicyType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="nonce" type="tns:NonceCredentialsPolicyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Nonce settings used to generate one-time random values.
                        Used in self-registration, e-mail-based password reset and possibly also
                        other scenarios.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="attributeVerification" type="tns:AttributeVerificationCredentialsPolicyType"/>
            <!-- More credential types may come here in the future. -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="RegistrationsPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="selfRegistration" type="tns:SelfRegistrationPolicyType">
            </xsd:element>
            <xsd:element minOccurs="0" name="postAuthentication" type="tns:SelfRegistrationPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <!-- More registration types may come here in the future. -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="CredentialsResetPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Credentials reset management policy. It specifies the management details for each supported
                    credentials reset type. It defines parameters such as reset method.
                </p>
                <p>
                    The idea is that all the password reset mechanisms have the same parts:
                    request, authentication, credential source, delivery.
                    This data structure is meant to configure those steps.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:securityQuestionReset</a:element>
                    <a:version>4.6</a:version>
                    <a:operation>removed</a:operation>
                    <a:comment>Use flexible authentication sequence instead.</a:comment>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:mailReset</a:element>
                    <a:version>4.6</a:version>
                    <a:operation>removed</a:operation>
                    <a:comment>Use flexible authentication sequence instead.</a:comment>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:smsReset</a:element>
                    <a:version>4.6</a:version>
                    <a:operation>removed</a:operation>
                    <a:comment>Use flexible authentication sequence instead.</a:comment>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:UserInterfaceFeatureType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="name" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of the password reset scheme. This is a short name that acts both as an
                                identifier of the scheme and also as a short name used for diagnostics.

                                DEPRECATED: use identifier attribute instead of name
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7.1</a:since>
                                <a:deprecated/>
                                <a:deprecatedSince>4.7</a:deprecatedSince>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="authenticationSequenceName" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defines authentication sequence, which will be used for reset credential.
                                Since 4.7: it's better to specify sequence identifier here instead of sequence name
                                as name attribute becomes deprecated in some objects which are used for
                                authentication configuration starting from 4.7 version (e.g. in AuthenticationSequenceType)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.1</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="0" name="newCredentialSource" type="tns:CredentialSourceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Source of a new credential value. This setting specifies whether the new credential
                                value should be provided by the user, randomly generated, derived by a key-exchange
                                protocol and so on.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7.1</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" maxOccurs="1" minOccurs="0" name="forceChange" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If set to true then the new credential will have the forceChange flag set.
                                Which usually means that the user will have to change the credential on next logon.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7.1</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="1" minOccurs="0" name="formRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to form which is displayed for reset
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:FormType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="IdentityRecoveryPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Identity recovery management policy. It defines which authentication sequence should be used for login
                    recovery procedure. For now, a username is considered to be a login name.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.8</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:UserInterfaceFeatureType">
                <xsd:sequence>
                    <xsd:element name="authenticationSequenceIdentifier" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defines authentication sequence, which should be used for identity recovery.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="itemToDisplay" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The path to the user attribute which should be displayed after the user was found. If no attribute is
                                specified, user's name attribute will be displayed.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CredentialSourceType">
        <xsd:annotation>
            <xsd:documentation>
                Source of a new credential value. This setting specifies whether the new credential
                value should be provided by the user, randomly generated, derived by a key-exchange
                protocol and so on.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="userEntry" type="tns:UserEntryCredentialSourceType">
                <xsd:annotation>
                    <xsd:documentation>
                        New credential value is entered by the user.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- Later: generate, key-exchange, PKI, ... -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="UserEntryCredentialSourceType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies the details of a new credential entered manually by a user.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <!--             <xsd:element name="valuePolicyRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1"> -->
            <!--                 <xsd:annotation> -->
            <!--                     <xsd:documentation> -->
            <!--                      TODO: -->
            <!--                     </xsd:documentation> -->
            <!--                     <xsd:appinfo> -->
            <!--                         <a:objectReferenceTargetType>tns:ValuePolicyType</a:objectReferenceTargetType> -->
            <!--                     </xsd:appinfo> -->
            <!--                 </xsd:annotation> -->
            <!--             </xsd:element> -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AbstractRegistrationPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:additionalAuthenticationName</a:element>
                    <a:version>4.6</a:version>
                    <a:operation>removed</a:operation>
                    <a:comment>Use element additionalAuthenticationSequence instead.</a:comment>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:UserInterfaceFeatureType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="name" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Use UserInterfaceFeatureType.identifier instead
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:deprecated/>
                                <a:deprecatedSince>4.8</a:deprecatedSince>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="initialLifecycleState" type="xsd:string">
                    </xsd:element>
                    <xsd:element minOccurs="0" name="requiredLifecycleState" type="xsd:string">
                    </xsd:element>
                    <xsd:element minOccurs="0" name="displayName" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Use UserInterfaceFeatureType.display.label instead
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:deprecated/>
                                <a:deprecatedSince>4.8</a:deprecatedSince>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="additionalAuthenticationSequence" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defined authentication sequence, which will be use for additional authentication.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.5</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="defaultRole" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the default roles which will be assigned to the user automatically after registration
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:AbstractRoleType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- More registration types may come here in the future. -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SelfRegistrationPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Structure that specifies policy for password management. It is in fact only a simple reference
                to a password policy.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractRegistrationPolicyType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="formRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to form which is displayed for registration
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:FormType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CredentialPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Structure that specifies common elements to all the credential policies.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Unique name of the credential. This name is fact a short identifier.
                            It is supposed to give some idea about purpose of the credential to system administrator.
                            It is also used for referencing the credential when needed (e.g. from authentication modules, credential reset specs, etc.)
                            The name may be stored in the user object together with the credential.
                            But it is not supposed to be used as a user-friendly label for credential.
                            Credential name must be unique.
                        </p>
                        <p>
                            Credential name is optional, mostly due to historical/compatibility reasons.
                        </p>
                        <p>
                            This is a credential policy. Which means that it controls how credentials are set (stored).
                            It does not control how credentials are used for authentication. That is controlled by the
                            authentication module setting - and in fact this may even be out of our control completely,
                            e.g. in case that external authentication is used (SSO).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free form description of the credential (administrator comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" ref="tns:documentation"/>
            <!-- later: display (DisplayType) -->
            <!-- later: default: boolean -->
            <xsd:element maxOccurs="1" minOccurs="0" name="storageMethod" type="c:CredentialsStorageMethodType">
                <xsd:annotation>
                    <xsd:documentation>
                        Method used to store the values of this credential (encrypted, hashed, ...)
                        If storage method is not specified it defaults to encryption
                        (due to compatibility and convenience reasons).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="resetMethod" type="c:CredentialsResetMethodType">
                <!-- TODO: deprecated? -->
            </xsd:element>
            <xsd:element default="userChoice" maxOccurs="1" minOccurs="0" name="propagationUserControl" type="c:CredentialsPropagationUserControlType">
                <xsd:annotation>
                    <xsd:documentation>
                        Constraints that define how propagation of the credentials can be controlled by the
                        user. E.g. if user can choose where the password change will be propagated.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="0" minOccurs="0" name="minOccurs" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Minimal number of value occurrences. minOccurs set to zero means that the value
                        is optional.
                        E.g. when applied to passwords the minOccurs=0 means that the policy will
                        accept no password at all. But it will still validate the password using
                        stringPolicy if a password is present.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="maxOccurs" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Maximal number of value occurrences.
                        If not specified then the default schema limitation is imposed.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="maxAge" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        Maximum age of the credential, counted from the last credential value update.
                        The credential must not be used after the age is exceeded (it is expired).
                        Any authentication with such credential must fail.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="minAge" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        Minimum age of the credential, counted from the last credential value update.
                        The credential cannot be changed before its minimal age is reached.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="warningBeforeExpirationDuration" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        The time interval before credential expiration (exceeded maxAge) that the user will be
                        warned that the credential is about to expire.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="lockoutMaxFailedAttempts" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Maximum number of failed authentication attempts that can be tried before the credential
                        is locked-out.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="lockoutFailedAttemptsDuration" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        The duration in which the failed attempts must happen for the credential to be locked-out.
                        The failed attempt counter is re-set after this duration (counted from the last failed attempt).
                        The credential is NOT locked-out during this duration.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="lockoutDuration" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        The duration for which the credential remains locked-out. The credential is automatically
                        unlocked after this duration.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="valuePolicyRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the value policy for the credential.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ValuePolicyType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="0" maxOccurs="1" minOccurs="0" name="historyLength" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        The number of entries to keep in the credential history. Also specifies the
                        number of past credential values that will be checked before accepting a new
                        credential change.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" minOccurs="0" name="historyStorageMethod" type="c:CredentialsStorageMethodType">
                <xsd:annotation>
                    <xsd:documentation>
                        Method used to store historical values of the credential (encrypted, hashed, ...)
                        If storage type is not specified then it defaults to hashing.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" maxOccurs="1" minOccurs="0" name="historyAllowExistingPasswordReuse" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true, then existing focus password (last set password) can be reused and set again to the same value as the new password.
                        However, when maxAge constraint is set, value cannot be reused after existing password has expired.
                        If set to false, user must always provide fresh password when setting the new password.
                        This setting is effective only when historyLength &gt; 0.
                        Default behaviour is that reuse is not allowed (setting is false).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: similarity criteria (history vs new password) -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="CredentialsPropagationUserControlType">
        <xsd:annotation>
            <xsd:documentation>
                Constraints that define how propagation of credentials can be controlled by the
                user. E.g. if user can choose where the password change will be propagated.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="mapping">
                <xsd:annotation>
                    <xsd:documentation>
                        Credentials propagation will be determined by the mappings.
                        User cannot choose where the credentials will be propagated.
                        The credentials propagation dialog will not be shown.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MAPPING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="userChoice">
                <xsd:annotation>
                    <xsd:documentation>
                        The user can choose where the credentials will be propagated.
                        The propagation dialog will be shown.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="USER_CHOICE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="onlyMapping">
                <xsd:annotation>
                    <xsd:documentation>
                        Credentials propagation will be determined by the mappings.
                        User cannot choose where the credentials will be propagated.
                        But the propagation dialog will be shown.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ONLY_MAPPING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="identityManagerMandatory">
                <xsd:annotation>
                    <xsd:documentation>
                        Identity Manager Repository will be propagated always.
                        The user can choose where the other credentials will be propagated.
                        The propagation dialog will be shown.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IDENTITY_MANAGER_MANDATORY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="CredentialsResetMethodType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies the method of resetting the credential. This usually applies to a
                self-service credential reset.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="none" maxOccurs="1" minOccurs="0" name="resetType" type="c:CredentialsResetTypeType">
                <xsd:annotation>
                    <xsd:documentation>
                        The type of credential reset.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="CredentialsResetTypeType">
        <xsd:annotation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        Credential reset is disabled.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="mail">
                <xsd:annotation>
                    <xsd:documentation>
                        Use security questions to reset the credential.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MAIL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="sms">
                <xsd:annotation>
                    <xsd:documentation>
                        Use security questions to reset the credential.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SMS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="securityQuestions">
                <xsd:annotation>
                    <xsd:documentation>
                        Use security questions to reset the credential.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SECURITY_QUESTIONS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="securityQuestionsWithEmail">
                <xsd:annotation>
                    <xsd:documentation>
                        Use security questions to reset the credential.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SECURITY_QUESTIONS_EMAIL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="CredentialsStorageMethodType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies the method of storing the credential in midPoint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="encryption" maxOccurs="1" minOccurs="0" name="storageType" type="c:CredentialsStorageTypeType">
                <xsd:annotation>
                    <xsd:documentation>
                        The type of credential storage.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- Storage parameters (ciphers, digest methods, key lengths, ... -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="CredentialsStorageTypeType">
        <xsd:annotation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="encryption">
                <xsd:annotation>
                    <xsd:documentation>
                        Credential will be stored in an encrypted form.
                        This is a symmetric (reversible) encryption.
                        MidPoint will be able to get a cleartext form of
                        the credential if needed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENCRYPTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="hashing">
                <xsd:annotation>
                    <xsd:documentation>
                        Credential will be stored in a hashed form.
                        One-way (irreversible) cryptographic hash or key derivation function
                        will be used to transform the credential before storage.
                        MidPoint will NOT be able to get a cleartext form of
                        the credential, but it can still compare credential values.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HASHING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        MidPoint will not store the credential at all.
                        MidPoint will only work with credential in the memory
                        while it is needed to complete current operation.
                        The credential will be discarded after the operation.

                        THIS IS ONLY PARTIALLY SUPPORTED

                        MidPoint should be able not to store the credentials when
                        this setting is used. But there may be side effects
                        that are not completely addressed yet.
                        This is not entirely tested and not supported.
                        Use at your own risk.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="PasswordCredentialsPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Structure that specifies policy for password management. It is in fact only a simple reference
                    to a password policy.
                </p>
                <p>
                    This is a credential policy. Which means that it controls how credentials are set (stored).
                    It does not control how credentials are used for authentication. That is controlled by the
                    authentication module setting - and in fact this may even be out of our control completely,
                    e.g. in case that external authentication is used (SSO).
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:passwordPolicyRef</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:passwordHistoryLength</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:CredentialPolicyType">
                <xsd:sequence>
                    <xsd:element default="oldPassword" minOccurs="0" name="passwordChangeSecurity" type="c:PasswordChangeSecurityType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Additional security applied when changing a password.
                                This applies when user is changing his own password. It does NOT apply
                                when administrator changes password of other user.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="alwaysConfigure" minOccurs="0" name="passwordHintConfigurability" type="c:PasswordHintConfigurabilityType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Additional configurability applied when changing or resetting a password.
                                This applies when user is changing or resetting his own password. It does NOT apply
                                when administrator changes password of other user.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.8.1</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="PasswordChangeSecurityType">
        <xsd:annotation>
            <xsd:documentation>
                Additional security applied when changing a password.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        No additional security. Password can be changed by supplying new value.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="oldPassword">
                <xsd:annotation>
                    <xsd:documentation>
                        User must supply old password to change the password.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OLD_PASSWORD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="oldPasswordIfExists">
                <xsd:annotation>
                    <xsd:documentation>
                        User must supply old password, if exists, to change the password.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OLD_PASSWORD_IF_EXISTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="PasswordHintConfigurabilityType">
        <xsd:annotation>
            <xsd:documentation>
                Additional options for configuring the password hint when changing or resetting the password.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="alwaysConfigure">
                <xsd:annotation>
                    <xsd:documentation>
                        Always configurable password hint, during changing and resetting password.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALWAYS_CONFIGURE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="neverConfigure">
                <xsd:annotation>
                    <xsd:documentation>
                        Never configurable password hint, during changing and resetting password.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NEVER_CONFIGURE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="SecurityQuestionsCredentialsPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Structure that specifies policy for security questions. It actually contains text for the
                questions (or rather a reference to localization catalog file). But it also contains a policy
                how the questions can be used, e.g. how many questions to display to a user.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:CredentialPolicyType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="0" name="questionNumber" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                Number of Questions in order to change the passwords
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="question" type="tns:SecurityQuestionDefinitionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The set of all the security questions in this policy.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AttributeVerificationCredentialsPolicyType">
        <xsd:complexContent>
            <xsd:extension base="tns:CredentialPolicyType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SecurityQuestionDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of a single security question.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:naturalKey>tns:identifier</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="identifier" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique identified of a security question. This can be used in the answer to refer to this
                        definition (see SecurityQuestionAnswerType).

                        It is expected that midPoint will come with a pre-configured set of frequently used security
                        questions (such as "what is your mother's maiden name?"). Therefore URI is a good mechanism for
                        this identifier. URI has a natural namespacing. Which means that the identifiers of built-in
                        questions will not clash with identifiers of questions configured by midPoint administrators.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="enabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Simple flag that could be used to disable a use of a specific question without actually
                        deleting it. This may be used to select only some questions, e.g. to disable the low-security
                        built-in questions such as "what is your mother's maiden name?".
                        If not present at all then the question is assumed to be enabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="1" name="questionText" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        The question itself, or the localization identifier to it.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!--
                settings that apply to a specific security question should go here, like this:
                <xsd:element name="something" type="xsd:string" minOccurs="0"/>
                What comes to my mind here is a key to localization file. That definitely should be here.
                What else?
             -->
            <!-- In later versions we may want to add an expression here. The expression could product an expected answer
            to the question. This can work well for questions such as "what is your employee number?". We already store
            employee number in each user therefore there is no need for each user to manually fill-in the expected answer.
            We can use expression instead. Something like "$user/employeeNumber" -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="NonceCredentialsPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Structure that specifies policy for nonce management.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:CredentialPolicyType">
                <xsd:sequence>
                    <!-- Nothing special yet. Maybe in the future. -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AuthorizationEvaluationRequestType">
        <xsd:annotation>
            <xsd:documentation>
                Request to evaluate authorizations for diagnostics purposes.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:experimental>true</a:experimental>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="subjectRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the subject for which the authorizations should be evaluated.
                        May contain the full object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:composite>true</a:composite>
                        <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="additionalAuthorization" type="tns:AuthorizationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Additional authorization(s) that will be added to ones already possessed by the subject.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="actionUrl" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Action URL or URLs to be evaluated. The default is (...)model-3#read.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tracing" type="tns:AuthorizationEvaluationTracingOptionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        How the evaluation should be traced.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AuthorizationEvaluationAccessDecisionRequestType">
        <xsd:annotation>
            <xsd:documentation>
                A request to evaluate authorization-based access decision.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:experimental>true</a:experimental>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AuthorizationEvaluationRequestType">
                <xsd:choice>
                    <xsd:element name="objectRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the object for which the authorizations should be evaluated.
                                May contain the full object.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:composite>true</a:composite>
                                <a:objectReferenceTargetType>tns:ObjectType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="value" type="xsd:anyType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The (presumably sub-object) value for which the authorizations should be evaluated.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:choice>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="authorizationEvaluationAccessDecisionRequest" type="tns:AuthorizationEvaluationAccessDecisionRequestType"/>

    <xsd:complexType name="AuthorizationEvaluationFilterProcessingRequestType">
        <xsd:annotation>
            <xsd:documentation>
                A request to evaluate authorization-based filter processing.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:experimental>true</a:experimental>
                <a:since>4.8</a:since>
                <a:schemaContext>
                    <a:typePath>type</a:typePath>
                </a:schemaContext>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AuthorizationEvaluationRequestType">
                <xsd:sequence>
                    <xsd:element name="type" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                Type for which the provided and resulting filter should be applied.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="filter" type="q:SearchFilterType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object filter (optional).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="authorizationEvaluationFilterProcessingRequest" type="tns:AuthorizationEvaluationFilterProcessingRequestType"/>

    <xsd:complexType name="AuthorizationEvaluationResponseType">
        <xsd:annotation>
            <xsd:documentation>
                Response of diagnostic evaluation of authorizations.

                Preliminary. Most probably it will be changed into a more structured form;
                maybe different for specific requests (access decision, object item filtering, filter pre-processing).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:experimental>true</a:experimental>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="result" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        The result in the textual form.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="computation" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        The computation notes in the textual form.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AdditionalAuthorizationsType">
        <xsd:annotation>
            <xsd:documentation>
                Authorizations to be applied in addition to or instead of the ones of current/selected subject.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:experimental>true</a:experimental>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="authorization" type="tns:AuthorizationType">
                <xsd:annotation>
                    <xsd:documentation>
                        An authorization.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="additionalAuthorizations" type="tns:AdditionalAuthorizationsType"/>

    <xsd:complexType name="AuthorizationEvaluationTracingOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                How the evaluation should be traced.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:experimental>true</a:experimental>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="false" minOccurs="0" name="selectorTracingEnabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Should be the evaluation of selectors traced?
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ArchetypeSelectionType">
        <xsd:annotation>
            <xsd:documentation>
                Defines a set of archetypes.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="archetypeRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="CorrelationModuleOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                Defines some restrictions for the correlation authentication module.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="candidateLimit" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Defines the maximum number of users which can be found by the correlation module.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SecretsProvidersType">
        <xsd:annotation>
            <xsd:documentation>
                Secrets providers configuration container.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="docker" type="tns:DockerSecretsProviderType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="file" type="tns:FileSecretsProviderType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="environmentVariables" type="tns:EnvironmentVariablesSecretsProviderType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="properties" type="tns:PropertiesSecretsProviderType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="custom" type="tns:CustomSecretsProviderType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="SecretsProviderType">
        <xsd:annotation>
            <xsd:documentation>
                Abstract definition of a secrets provider.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="identifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Unique identifier of this secrets provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="display" type="tns:DisplayType">
                <xsd:annotation>
                    <xsd:documentation>
                        Display name, icon and styles for secret provider.
                        This is mostly for UI purposes.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description of the secrets provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="documentation" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description of the secrets provider.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="PT0S" minOccurs="0" name="cache" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        Time-to-live when caching the secrets provided by this provider.
                        The secrets will be refreshed after this time.

                        If not specified or duration is zero then the secrets will not be cached.
                        If duration is negative then the secrets will be cached forever.
                        Otherwise, secrets will be cached for specified duration time.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="allowKeyPrefix" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Allowed prefix for the secret keys resolved by this provider.
                        If not specified, all keys are allowed.

                        E.g. "MYAPP_" - provider will only be able to use environment variables that start with "MYAPP_".
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="CustomSecretsProviderType">
        <xsd:annotation>
            <xsd:documentation>
                Custom secrets provider implementation, that is not known at the compile time. E.g. not bundled with midPoint.

                EXPERIMENTAL:
                This provider implementation is experimental. It may be changed or removed in the future versions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SecretsProviderType">
                <xsd:sequence>
                    <xsd:element name="className" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Class name of the custom secrets provider.
                                Class must be available on classpath.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="configuration" type="tns:CustomSecretsProviderConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Configuration of the custom secrets provider.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CustomSecretsProviderConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the custom secrets provider, that is not known at the compile time.

                EXPERIMENTAL:
                Implementation is experimental. It may be changed or removed in the future versions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any maxOccurs="unbounded" minOccurs="0" namespace="##other" processContents="lax"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="EnvironmentVariablesSecretsProviderType">
        <xsd:annotation>
            <xsd:documentation>
                Environment variables secrets provider.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SecretsProviderType">
                <xsd:sequence>
                    <xsd:element default="false" minOccurs="0" name="useSystemProperties" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If true, the provider will also use system properties as a source of secrets.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="ContainerSecretsProviderType">
        <xsd:annotation>
            <xsd:documentation>
                Abstract container secrets provider.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SecretsProviderType">
                <xsd:sequence>
                    <xsd:element default="utf-8" minOccurs="0" name="charset" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Charset of the files where secrets are stored.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="FileSecretsProviderType">
        <xsd:annotation>
            <xsd:documentation>
                Secrets provider that reads secrets from files.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ContainerSecretsProviderType">
                <xsd:sequence>
                    <xsd:element name="parentDirectoryPath" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Path or parent directory where files with secrets are stored.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="DockerSecretsProviderType">
        <xsd:annotation>
            <xsd:documentation>
                Docker secrets provider.

                Files with secrets are by default located in "/run/secrets/*" directory
                or in "C:\ProgramData\Docker\secrets\*" directory.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ContainerSecretsProviderType">
                <xsd:sequence>
                    <!-- intentionally empty -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="PropertiesSecretsProviderType">
        <xsd:annotation>
            <xsd:documentation>
                Properties secrets provider.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SecretsProviderType">
                <xsd:sequence>
                    <xsd:element default="utf-8" minOccurs="0" name="charset" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Charset of the files for string secrets.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="propertiesFile" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Path to the properties file.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

</xsd:schema>