bcfg2-server 1.3.3-1ubuntu3 / usr / share / bcfg2 / schemas / authorizedkeys.xsd

<xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xml:lang="en">
  <xsd:annotation>
    <xsd:documentation>
      Schema for :ref:`server-plugins-generators-cfg-sshkeys`
      ``authorizedkeys.xml``
    </xsd:documentation>
  </xsd:annotation>

  <xsd:complexType name="AuthorizedKeysGroupType">
    <xsd:annotation>
      <xsd:documentation>
        An **AuthorizedKeysGroupType** is a tag used to provide logic.
        Child entries of an AuthorizedKeysGroupType tag only apply to
        machines that match the condition specified -- either
        membership in a group, or a matching client name.
        :xml:attribute:`AuthorizedKeysGroupType:negate` can be set to
        negate the sense of the match.
      </xsd:documentation>
    </xsd:annotation>
    <xsd:choice minOccurs="1" maxOccurs="unbounded">
      <xsd:element name="Allow" type="AllowType"/>
      <xsd:element name="Group" type="AuthorizedKeysGroupType"/>
      <xsd:element name="Client" type="AuthorizedKeysGroupType"/>
    </xsd:choice>
    <xsd:attribute name='name' type='xsd:string'>
      <xsd:annotation>
        <xsd:documentation>
          The name of the client or group to match on.  Child entries
          will only apply to this client or group (unless
          :xml:attribute:`AuthorizedKeysGroupType:negate` is set).
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
    <xsd:attribute name='negate' type='xsd:boolean'>
      <xsd:annotation>
        <xsd:documentation>
          Negate the sense of the match, so that child entries only
          apply to a client if it is not a member of the given group
          or does not have the given name.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
  </xsd:complexType>

  <xsd:complexType name="OptionContainerType">
    <xsd:annotation>
      <xsd:documentation>
        An **OptionContainerType** is a tag used to provide logic.
        Child entries of an OptionContainerType tag only apply to
        machines that match the condition specified -- either
        membership in a group, or a matching client name.
        :xml:attribute:`OptionContainerType:negate` can be set to
        negate the sense of the match.
      </xsd:documentation>
    </xsd:annotation>
    <xsd:choice minOccurs="0" maxOccurs="unbounded">
      <xsd:element name="Group" type="OptionContainerType"/>
      <xsd:element name="Client" type="OptionContainerType"/>
      <xsd:element name="Option" type="AuthorizedKeysOptionType"/>
      <xsd:element name="Params" type="AuthorizedKeysParamsType"/>
    </xsd:choice>
    <xsd:attribute name='name' type='xsd:string'>
      <xsd:annotation>
        <xsd:documentation>
          The name of the client or group to match on.  Child entries
          will only apply to this client or group (unless
          :xml:attribute:`OptionContainerType:negate` is set).
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
    <xsd:attribute name='negate' type='xsd:boolean'>
      <xsd:annotation>
        <xsd:documentation>
          Negate the sense of the match, so that child entries only
          apply to a client if it is not a member of the given group
          or does not have the given name.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
  </xsd:complexType>

  <xsd:complexType name="AllowType" mixed="true">
    <xsd:annotation>
      <xsd:documentation>
        Allow access from a public key, given either as text content,
        or described by the attributes.
      </xsd:documentation>
    </xsd:annotation>
    <xsd:choice minOccurs="0" maxOccurs="unbounded">
      <xsd:element name="Group" type="OptionContainerType"/>
      <xsd:element name="Client" type="OptionContainerType"/>
      <xsd:element name="Option" type="AuthorizedKeysOptionType"/>
      <xsd:element name="Params" type="AuthorizedKeysParamsType"/>
    </xsd:choice>
    <xsd:attribute name="from" type="xsd:string">
      <xsd:annotation>
        <xsd:documentation>
          The path of the public key to allow.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
    <xsd:attribute name="group" type="xsd:string">
      <xsd:annotation>
        <xsd:documentation>
          Use a public key specific to the given group, instead of the
          public key specific to the appropriate category group of the
          current client.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
    <xsd:attribute name="category" type="xsd:string">
      <xsd:annotation>
        <xsd:documentation>
          Use a public key specific to the group in the given
          category, instead of the category specified in
          ``bcfg2.conf``.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
    <xsd:attribute name="host" type="xsd:string">
      <xsd:annotation>
        <xsd:documentation>
          Use a public key specific to the given host.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
  </xsd:complexType>

  <xsd:complexType name="AuthorizedKeysOptionType">
    <xsd:annotation>
      <xsd:documentation>
        Specify options for public key authentication and connection.
        See :manpage:`sshd(8)` for details on allowable options.
      </xsd:documentation>
    </xsd:annotation>
    <xsd:attribute name="name" type="xsd:string" use="required">
      <xsd:annotation>
        <xsd:documentation>
          The name of the sshd option.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
    <xsd:attribute name="value" type="xsd:string">
      <xsd:annotation>
        <xsd:documentation>
          The value of the sshd option.  This can be omitted for
          options that take no value.
        </xsd:documentation>
      </xsd:annotation>
    </xsd:attribute>
  </xsd:complexType>

  <xsd:complexType name="AuthorizedKeysParamsType">
    <xsd:annotation>
      <xsd:documentation>
        **Deprecated** way to specify options for public key
        authentication and connection.  See :manpage:`sshd(8)` for
        details on allowable parameters.
      </xsd:documentation>
    </xsd:annotation>
    <xsd:anyAttribute processContents="lax"/>
  </xsd:complexType>

  <xsd:element name="AuthorizedKeys">
    <xsd:annotation>
      <xsd:documentation>
        Top-level tag for describing a generated SSH key pair.
      </xsd:documentation>
    </xsd:annotation>
    <xsd:complexType>
      <xsd:choice minOccurs="1" maxOccurs="unbounded">
        <xsd:element name="Allow" type="AllowType"/>
        <xsd:element name="Group" type="AuthorizedKeysGroupType"/>
        <xsd:element name="Client" type="AuthorizedKeysGroupType"/>
      </xsd:choice>
    </xsd:complexType>
  </xsd:element>
</xsd:schema>