Version: 1.1.4 Schema location URL: https://docs.swedenconnect.se/schemas/csig/1.1/EidCentralSigDssExt-1.1.4.xsd Holds information about sign tasks that are requested in a Sign Request and returned in a Sign Response. The bytes to be hashed and signed when generating the requested signature. For an XML signature this must be the canonicalized octets of a dss:SignedInfo element. For a PDF signature this must be the octets of the DER-encoded SignedAttrs value (signed attributes). In some cases the signature process alters this data, for example by changing a signing time attribute in PDF SignedAttrs. If this data was altered, the altered data must be returned in the sign response using this element. Holds data to support generation of a signature according to any of the ETSI Advanced Electronic Signature (AdES) standard formats. The output signature value of the signature creation process associated with this sign task. Provides extensibility for input or output data elements associated with the sign task. An identifier of the signature task that is represented by this element. If the request contains multiple instances of SignTaskData representing separate sign tasks, each instance of the element must have a SignTaskId attribute value that is unique among all sign tasks in the Sign Request. When this attribute is present, the same attribute value must be returned in the corresponding SignTaskData element in the response that holds corresponding signature result data. Enumerated identifier of the type of signature format the canonicalized signed information octets in the ToBeSignedBytes element are associated with. Specifies the type of AdES signature. "BES" means that the signing certificate hash must be covered by the signature. "EPES" means that the signing certificate hash and a signature policy identifier must be covered by the signature. A URI identifying one or more processing rules that the Signature Service MUST apply when processing and using the provided signed information octets. The Signature Service must not process and complete the signature request if this attribute contains a URI that is not recognized by the Signature Service. When this attribute is present in the Sign Response, it represents a statement by the Signature Service that the identified processing rule was successfully executed. Element for extending the sign task data. Representation of the bytes to be hashed and signed when generating a signature. Holds data to support generation of a signature according to any of the ETSI Advanced Electronic Signature (AdES) standard formats. An optional identifier of the signature. When the requested signature is an XAdES signature, this is the value of the Id attribute of the ds:Signature element of the resulting signature, which is used to construct the Target attribute of the xades:QualifyingProperties element. A Base64-encoded object that is referenced from the signature and whose content has to be modified as part of the certificate and signature generation process. The type of data in the Base64-encoded bytes and the rules for handling this data in the signature generation process are determined through the ProcessingRules, SigType, and AdESType attributes of the parent SignatureInputObjects element. When the signature type is XAdES, these are the bytes of the ds:Object element that holds the xades:QualifyingProperties element of the signature where the hash of the signature certificate will be placed. When this element is present in the request, it forms a base for construction of this object in the signature process. An extension point for additional input data related to the AdES signature generation process. Representation of a signature value. The Type attribute, if present, shall contain a URI indicating the signature algorithm that was used to generate the signature value. The URI indicating the signature algorithm that was used to generate the signature value. Extension to an OASIS DSS SignRequest, providing additional information about a Sign Request. This element extends the dss:OptionalInputs element of a dss:SignRequest element. The time when the request was created. This element MUST include the element saml:AudienceRestriction which in turn MUST contain one saml:Audience element, specifying the return URL for any resulting Sign Response message. The identity of the signer expressed using authentication attributes. For backwards compatibility a SAML identity may be expressed using the Signer element as in versions prior to 1.1.4 of this schema. Represents the signer attributes when the signer was authenticated using SAML. For 1.1.4 or later versions of this schema, this representation is preferred over Signer (see above). Represents the signer attributes when the signer was authenticated using OpenID Connect. Supported in schema version 1.1.4 and higher. Represents the signer attributes when the signer was authenticated using mechanisms that is not SAML or OIDC. Supported in schema version 1.1.4 and higher. The identifier for the Identity Provider that MUST be used to authenticate the Signer before signing. This identifier may be an entityID of a SAML Identity Provider, an Issuer URI of an OpenID Connect Provider, or possibly another type of service. The value is specified using the saml:NameIDType complex type. If the element represents a SAML Identity Provider, it MUST include a Format attribute with the value urn:oasis:names:tc:SAML:2.0:nameid-format:entity. If the element represents any other type of identity provider (such as an OpenID Connect Provider), the Format attribute SHOULD be omitted. An opaque string that can be used to inform the Signature Service about specific requirements regarding the user authentication at the given Identity Provider. The identifier for the service that sends this request to the Signature Service. Typically, this is a SAML entityID or an OpenID Connect identifier. The value is specified using the saml:NameIDType complex type. If the element represents a SAML entity, it MUST include a Format attribute with the value urn:oasis:names:tc:SAML:2.0:nameid-format:entity. Otherwise, the Format attribute SHOULD be omitted. The identifier for the service to which this Sign Request is sent, i.e., the Signature Service. This is typically a SAML entityID or an OpenID Connect client identifier. The value is specified using the saml:NameIDType complex type. If the element represents a SAML entity, it MUST include a Format attribute with the value urn:oasis:names:tc:SAML:2.0:nameid-format:entity. Otherwise, the Format attribute SHOULD be omitted. An identifier of the signature algorithm the requesting service prefers when generating the requested signature. The requested properties of the signature certificate being issued by the Signature Service. The version of the DSS extensions specification. If absent, the version value defaults to "1.1". Represents a set of SAML attributes from an authentication. Supported for versions 1.1.4 and later of this schema. Represents a set of OpenID Connect claims from an authentication. Supported for versions 1.1.4 and later of this schema. Represents generic authentication attributes (other than SAML attributes or OIDC claims). Provided for extensibility so that future identity representations can be carried without a schema change. Accepts a single element from any namespace. Represents the identity of an Identity Provider. For representing an authentication profile. Represents the identity of the signature requester. Represents the identity of the Signature Service. Represents the Object Identifier for a requested signature algorithm. The requested properties of the signature certificate being issued by the signature service. Identifier(s) (URIs) identifying the requested authentication context class reference (level of assurance) that authentication of the signature certificate subject MUST comply with in order to complete signing and certificate issuance. An optional set of requested attributes that the requesting service prefers or requires to be present in the generated signing certificate. An enumeration of certificate types where "PKC" is the default. The supported values are "PKC", "QC", and "QC/SSCD". "QC" means that the certificate is requested to be a Qualified Certificate according to legal definitions in national law governing the issuer. "QC/SSCD" means a Qualified Certificate where the private key is declared to be residing within a Secure Signature Creation Device according to national law. "PKC" (Public Key Certificate) means a certificate that is not a Qualified Certificate. An optional set of requested attributes that the requesting service prefers or requires to be present in the generated signing certificate. The element provides mappings between identity attributes from the user identity token and certificate entries. Element holding an identity of an attribute provider that MAY be used to obtain an attribute value for the requested attribute. Identifies an attribute name received during authentication. The AttributeName choice (protocol independent) should be used when the target SignService supports 1.1.4 or later of this schema. The SamlAttributeName choice is for backwards-compatibility and is used for SignService deployments not supporting this version of the schema. A reference to the certificate attribute or name type where the requester wants to store this attribute value. The information in this attribute depends on the selected CertNameType attribute value. If the CertNameType is "rdn" or "sda", then this attribute MUST contain a string representation of an object identifier (OID). If the CertNameType is "san" (Subject Alternative Name) and the target name is a GeneralName, then this attribute MUST hold a string representation of the tag value of the target GeneralName type, e.g. "1" for rfc822Name (e-mail) or "2" for dNSName. If the "CertNameType" is "san" and the target name form is an OtherName, then this attribute value MUST include a string representation of the object identifier of the target OtherName form. An enumeration of the target name form for storing the associated attribute value in the certificate. The available values are: "rdn" for storing the attribute value as an attribute in a Relative Distinguished Name in the subject field of the certificate, "san" for storing the attribute value in a Subject Alternative Name extension, and "sda" for storing the attribute value in a Subject Directory Attribute extension. An optional friendly name of the subject attribute, e.g. "givenName". An optional default value for the requested attribute. This value MAY be used by the Signature Service if no authoritative value for the attribute can be obtained when the Signature Service authenticates the user. If this attribute is set to true, the Signature Service MUST ensure that either an authoritative value for the attribute can be obtained from the user authentication, or that an acceptable default value exists, or else the Signature Service MUST NOT generate the requested certificate. Deprecated in schema version 1.1.4. Instead, use PreferredAttributeNameType. Represents an attribute name (SAML attribute, OpenID Connect claim, or any other type of attribute). An integer specifying the order of preference regarding this attribute. If more than one attribute is listed, the attribute that is present in the authentication token (e.g., a SAML assertion or an OIDC ID Token) and has the lowest Order value SHALL be used. Attributes with an absent Order attribute SHALL be treated as having an Order value of 0. Multiple attributes with identical Order values SHALL be treated as having equal priority. Tells which type of attribute is represented: "saml", "oidc", or a custom value. Sign message included as a choice of a Base64-encoded string or an encrypted sign message. When this attribute is set to true, the requested signature MUST NOT be created unless this message has been displayed and accepted by the Signer. The identifier of the entity responsible for displaying the Sign Message to the Signer. When the Sign Message is encrypted, this entity is also the holder of the private decryption key necessary to decrypt the Sign Message. The MIME type defining the message format. This is an enumeration of the valid attribute values "text" (plain text), "text/html" (html) or "text/markdown" (markdown). Any additional inputs to the request extension. Extension to an OASIS DSS SignResponse, providing additional information about a Sign Response. This element extends the dss:OptionalOutput element of a dss:SignResponse. The time when the Sign Response was created. A Base64-encoded signed dss:SignRequest element that contains the request related to this Sign Response. This element MAY be present if signing was successful. An element of type SignerAssertionInfoType holding information about how the Signer was authenticated by the Signature Service, as well as the subject attribute values from the token authenticating the Signer that were incorporated into the signer certificate. This element MUST be present if signing was successful. Holds the signer certificate as well as other certificates that may be used to validate the signature. This element MUST be present if signing was successful and MUST contain all certificates that are necessary to compile a complete and functional signed document. The certificates MUST be provided in sequence, with the signer certificate first, followed by any CA certificates that can be used to verify the previous certificate in the sequence, ending with a root CA certificate. The version of the DSS specification. If absent, the version value defaults to "1.1". Holds information about how the Signer was authenticated by the Signature Service. Holds information about how Signer was authenticated, including subject attribute values from the token authenticating the Signer. Holds information about the authentication context related to Signer authentication through an authentication token (SAML assertion or OpenID Connect ID Token). The contents of this element must correspond to the AuthnProtocol attribute. Contains subject attributes obtained from the authentication of the Signer. Depending on the authentication protocol used to authenticate the Signer (see AuthnProtocol), the corresponding element below must be set. Element holding SAML attributes when the authentication protocol is SAML ("saml"). Element holding OpenID Connect claims when the authentication protocol is OpenID Connect ("oidc"). If the authentication protocol is not SAML or OIDC, this element holds authentication attributes from the Signer authentication process. Any number of relevant assertions that were used for authenticating the Signer and the Signer's identity attributes at the Signature Service. Deployments according to 1.1.4 and higher of this schema should use the Assertions choice that supports any type of assertion (depending on the authentication protocol). The SamlAssertions choice is for backwards compatibility (schema support prior to 1.1.4). The authentication protocol used to authenticate the Signer. For backwards compatibility, the default is "saml". If any other authentication protocol was used, this attribute must be explicitly assigned. The identifier of the Identity Provider that authenticated the Signer to the Signature Service. If the element represents a SAML Identity Provider, it MUST include a Format attribute with the value urn:oasis:names:tc:SAML:2.0:nameid-format:entity. If the element represents any other type of identity provider (such as an OpenID Connect Provider), the Format attribute SHOULD be omitted. The time when the Signature Service authenticated the Signer. A URI reference to the authentication context class under which the authentication was made. An arbitrary identifier for the instance of the Signature Service that authenticated the Signer. An arbitrary identifier of the service used by the Signature Service to authenticate the Signer. A reference to the assertion/token used to identify the Signer. Depending on the authentication protocol used, this reference may be the ID attribute of a SAML assertion or a 'jti' claim of an OpenID Connect ID Token, but it may also be any other reference that can be used to locate and identify the authentication assertion/token. Holds a certificate chain, where the subject certificate is placed first, followed by intermediate CA certificates, and ending with a root CA certificate. Holds a collection of assertions or tokens that were used to authenticate the Signer. Each entry is one of: a SAML assertion (SamlAssertion), an OpenID Connect ID Token (OidcIdToken), an OpenID Connect UserInfo response (OidcUserInfoResponse), or any other assertion or token represented by an element from a foreign namespace. A SAML assertion, Base64-encoded. An OpenID Connect ID Token in its encoded (compact JWS serialization) form. An OpenID Connect UserInfo response in its encoded (compact JWS serialization) form. Any other assertion or token representation, carried as an element from a namespace other than this schema's target namespace. Optional sign response elements of type AnyType. Defines a string identifying an authentication protocol, where "saml" and "oidc" are defined, but other values are also allowed. A type for representing an encoded JWT. Complex type holding a collection of OpenID Connect claims. Each claim is represented by an OidcClaimType element (name-value pair). Represents a single OIDC claim. Represents a single OpenID Connect claim as a name-value pair. The Name attribute holds the claim name and the child element holds the claim value. The value is one of the following types: string, number (represented as either an integer or a decimal), boolean, null, a Base64-encoded JSON object, or a Base64-encoded JSON array. A JSON number is represented as a choice between IntValue (xs:integer) and DecimalValue (xs:decimal); use IntValue when the value has no fractional part and DecimalValue otherwise. Complex claim values that are JSON objects or JSON arrays MUST be Base64-encoded and represented using the JsonObjectValue or JsonArrayValue elements respectively. A JSON null value is represented using the empty NullValue element. A claim value of type string. A claim value that is a JSON number with no fractional part. A claim value that is a JSON number with a fractional part. A claim value of type boolean. A claim value that is a JSON object, Base64-encoded. A claim value that is a JSON array, Base64-encoded. A claim value that is JSON null. This is an empty element. The name of the OIDC claim.