TBD, for schema, see http://shibboleth.net/schema/idp/shibboleth-security.xsd