xep-0227.xml

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE xep SYSTEM 'xep.dtd' [
  <!ENTITY % ents SYSTEM 'xep.ent'>
%ents;
]>
<?xml-stylesheet type='text/xsl' href='xep.xsl'?>
<xep>
  <header>
    <title>Portable Import/Export Format for XMPP-IM Servers</title>
    <abstract>This document specifies a file format for importing and exporting user data to and from XMPP-IM servers.</abstract>
    &LEGALNOTICE;
    <number>0227</number>
    <status>Draft</status>
    <type>Standards Track</type>
    <sig>Standards</sig>
    <approver>Council</approver>
    <dependencies>
      <spec>XMPP IM</spec>
      <spec>XEP-0049</spec>
      <spec>XEP-0054</spec>
    </dependencies>
    <supersedes/>
    <supersededby/>
    <shortname>pie</shortname>
    <schemaloc>
      <url>http://xmpp.org/schemas/pie.xsd</url>
    </schemaloc>
    <author>
      <firstname>Magnus</firstname>
      <surname>Henoch</surname>
      <email>henoch@dtek.chalmers.se</email>
      <jid>legoscia@jabber.cd.chalmers.se</jid>
    </author>
    <author>
      <firstname>Waqas</firstname>
      <surname>Hussain</surname>
      <email>waqas20@gmail.com</email>
      <jid>waqas@jaim.at</jid>
    </author>
    &mwild;
    <revision>
      <version>1.1</version>
      <date>2021-06-02</date>
      <initials>mw</initials>
      <remark><p>Discourage use of 'password', provide a way to include SCRAM credentials, PEP nodes and message archives.</p></remark>
    </revision>
    <revision>
      <version>1.0</version>
      <date>2010-03-12</date>
      <initials>psa</initials>
      <remark><p>Per a vote of the XMPP Council, advanced specification from Experimental to Draft; simultaneously the XMPP Registrar issued a namespace of "urn:xmpp:pie:0".</p></remark>
    </revision>
    <revision>
      <version>0.3</version>
      <date>2009-10-16</date>
      <initials>wh</initials>
      <remark><p>Modified to include feedback received during the initial Last Call. Added sections for privacy lists and incoming subscriptions, as well as text on XInclude security.</p></remark>
    </revision>
    <revision>
      <version>0.2</version>
      <date>2007-12-13</date>
      <initials>mh</initials>
      <remark><p>Use XInclude.</p></remark>
    </revision>
    <revision>
      <version>0.1</version>
      <date>2007-08-08</date>
      <initials>psa</initials>
      <remark><p>Initial published version.</p></remark>
    </revision>
    <revision>
      <version>0.0.1</version>
      <date>2007-07-27</date>
      <initials>mh</initials>
      <remark><p>Initial version.</p></remark>
    </revision>
  </header>

<section1 topic='Introduction' anchor='intro'>
  <p>Different implementations of XMPP-IM servers store user data in various ways, and many implementations have more than one storage format.  This leads to problems when a server administrator wants to switch to another implementation or storage format -- the implementation is as likely as not to have an import mechanism that can read the user data in its current form.  This document attempts to solve that problem by defining a common file format for import and export of user data in XMPP-IM servers.</p>
</section1>

<section1 topic='Requirements' anchor='reqs'>
  <p>The following constraints are imposed on this standard:</p>
  <ul>
    <li>
      <p>The file format is XML-based.</p>
      <p>XMPP-IM servers already have tools to process XML data.  This also allows extension of the format using namespaces.  Furthermore, some of the data that needs to be stored is by definition already in XML form.</p>
    </li>
    <li>
      <p>The data layout is flexible.</p>
      <p>The data is contained in a single XML document; however, it can be split into several files using &w3xinclude;.</p>
    </li>
    <li>
      <p>All user data is stored, but no server configuration data.</p>
      <p>User data has similar form throughout the XMPP world, but server configuration is implementation-specific.  Therefore this specification does not attempt to transfer any aspects of the server configuration from one server to another.</p>
      <p>Furthermore, the contents of MUC, Pubsub and other services are out of scope for this specification.</p>
    </li>
    <li>
      <p>Multiple virtual hosts are supported.</p>
      <p>Many server implementations can serve several hostnames in a single server instance.  Thus this specification allows storing data from several virtual hosts.</p>
    </li>
  </ul>
</section1>

<section1 topic='Glossary' anchor='glossary'>
<dl>
  <di><dt>Exporting server</dt>
  <dd>The XMPP-IM server writing its user data to files, following this specification.</dd>
  </di>
  <di><dt>Importing server</dt>
  <dd>The XMPP-IM server reading data from such files.</dd>
  </di>
</dl>
</section1>

<section1 topic='File format' anchor='fileformat'>
  <p>Data is contained in an XML document, whose root element is &lt;server-data/&gt; qualified by the 'urn:xmpp:pie:0' namespace &NSNOTE;.</p>

<example caption='The root element'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  [ ... ]
</server-data>
]]>
</example>

  <p>At any point in the file, an exporting server may put elements qualified by a namespace not mentioned in this specification.  The exported data SHOULD be meaningful without the extensions.  An importing server that encounters a namespace that it doesn't understand, or otherwise is unable to import all given data, SHOULD ignore the unknown data, SHOULD notify the operator, and MAY offer to terminate the process.</p>

  <p>At any point in the file, an exporting server may put an XInclude &lt;include/&gt; element; see <link url='#xinclude'>Use of XInclude</link>.</p>

  <section2 topic='Hosts' anchor='hosts'>
    <p>The child elements of the &lt;server-data/&gt; elements are &lt;host/&gt; elements.  Each &lt;host/&gt; element describes a virtual host, and has a 'jid' attribute that contains its JID.</p>

    <p>An importing server MAY automatically adjust its list of virtual hosts to fit the ones present in the data being imported.  If it does not, it SHOULD notify the operator about any mismatch.</p>

    <example caption='The host element'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    [ ... ]
  </host>
  <host jid='montague.net'>
    [ ... ]
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='Users' anchor='users'>
    <p>Each user is represented by a &lt;user/&gt; element under the &lt;host/&gt; element.  The &lt;user/&gt; element MUST have a 'name' attribute, which contains the node part of the user's JID.</p>

    <p>If the plaintext password of the user is known, it MAY be included in the 'password' attribute, although this is not recommended from a security perspective. For more information see <link url='#security'>Security Considerations</link>. See also the SCRAM credentials section for an alternative.</p>

    <example caption='The user element'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      [ ... ]
    </user>
  </host>
  <host jid='montague.net'>
    <user name='romeo'>
      [ ... ]
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='SCRAM credentials' anchor='scram-credentials'>
    <p>Authentication secrets may be included that allow for authentication using the SCRAM family of mechanisms, as defined in &rfc5802;.</p>

    <p>Each set of credentials should be encapsulated within a &lt;scram-credentials/&gt; element in the 'urn:xmpp:pie:0#scram' namespace, and contained within the relevant &lt;user/&gt; element. The element should have a 'mechanism' attribute specifying the registered name of the mechanism that the credentials are used for (always without the "-PLUS" suffix), e.g. 'SCRAM-SHA-1'. The element MUST contain a single occurrence of each of the following child elements:</p>

    <ul>
      <li>&lt;iter-count/&gt;: containing the SCRAM iteration count, e.g. '10000'. This must be a positive integer without leading zeros.</li>
      <li>&lt;salt/&gt;: containing the base64-encoded salt.</li>
      <li>&lt;server-key/&gt;: containing the base64-encoded ServerKey defined by SCRAM.</li>
      <li>&lt;stored-key/&gt;: containing the base64-encoded StoredKey defined by SCRAM.</li>
    </ul>

    <p>There may be multiple occurrences of &lt;scram-credentials/&gt; for a single user, however they MUST all have a unique 'mechanism' attribute.</p>

    <example caption='Including a user&apos;s SCRAM credentials'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      <scram-credentials xmlns='urn:xmpp:pie:0#scram' mechanism='SCRAM-SHA-1'>
        <iter-count>100000</iter-count>
        <salt>TmFDbE5hQ2xOYUNsTmFDbE5hQ2xOYUNsTmFDbE5hQ2xOYUNsTmFDbE5hQ2wK</salt>
        <server-key>0pXWGK0GZJ6TR73AIUN3ITYtA1g=</server-key>
        <stored-key>Q6qT/SbybblGCZz8e8eSfCJOQic=</stored-key>
      </scram-credentials>
    </user>
  </host>
</server-data>
]]></example>

    <p>Be aware of the <link url='#security'>Security Considerations</link> when including credentials in a data export. Even though SCRAM credentials are stored in a hashed form, leaking them still allows an attacker to impersonate the user to other servers employing the same SCRAM parameters, and it also allows for offline dictionary or brute-force attacks.</p>

  </section2>

  <section2 topic='Rosters' anchor='rosters'>
    <p>Each &lt;user/&gt; element SHOULD contain the user's roster in the form of a &lt;query/&gt; element qualified by the 'jabber:iq:roster' namespace.  This element contains the user's roster in the same format as when retrieving the roster from the server, as described in section 7.3 of &xmppim;.</p>

    <example caption='The roster'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      <query xmlns='jabber:iq:roster'>
        <item jid='romeo@montague.net'
              name='Romeo'
              subscription='both'>
          <group>Friends</group>
        </item>
      </query>
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='Offline Messages' anchor='offlinemessages'>
    <p>If the exporting server stores messages received while the user was offline, it SHOULD include an &lt;offline-messages/&gt; element as a child of the &lt;user/&gt; element.  This element contains all the stored messages to the user, if any, as &lt;message/&gt; elements qualified by the 'jabber:client' namespace, starting with the oldest.</p>

    <example caption='Offline messages'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      <offline-messages>
        <message xmlns='jabber:client'
	         from='romeo@montague.net/orchard'
	         to='juliet@capulet.com/balcony'
		 type='chat'>
	  <body>Neither, fair saint, if either thee dislike.</body>
	  <delay xmlns='urn:xmpp:delay'
	         from='capulet.com'
		 stamp='1469-07-21T00:32:29Z'>
	    Offline Storage
	  </delay>
	</message>
      </offline-messages>
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='Private XML Storage' anchor='privatexmlstorage'>
    <p>Private data stored by the server as specified in &xep0049; is represented in this format by including a &lt;query/&gt; element qualified by the 'jabber:iq:private' namespace as a child of the &lt;user/&gt; element.  This &lt;query/&gt; element in turn contains all elements saved in private XML storage.</p>

    <example caption='Private XML Storage'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='shakespeare.lit'>
    <user name='hamlet'>
      <query xmlns="jabber:iq:private">
	<exodus xmlns="exodus:prefs">
	  <defaultnick>Hamlet</defaultnick>
	</exodus>
      </query>
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='vCards' anchor='vcards'>
    <p>By &xep0054;, users can store vCards on the server.  In this specification, vCards are child elements of the &lt;user/&gt; element, namely a &lt;vCard/&gt; element qualified by the 'vcard-temp' namespace.</p>

    <example caption='vCards'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      <vCard xmlns='vcard-temp'>
        <FN>Juliet Capulet</FN>
      </vCard>
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='Privacy Lists' anchor='privacy-lists'>
    <p>Privacy lists, as specified in &xep0016;, are represented in this format by including a &lt;query/&gt; element qualified by the 'jabber:iq:privacy' namespace as a child of the &lt;user/&gt; element. This element should contain all privacy lists associated with the user. A default privacy list, if set, is specified by including a &lt;default/&gt; element as a child of the &lt;query/&gt; element.</p>

    <example caption='Privacy lists'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      <query xmlns='jabber:iq:privacy'>
        <default name='public'/>
        <list name='public'>
          <item type='jid'
                value='tybalt@example.com'
                action='deny'
                order='1'/>
          <item action='allow' order='2'/>
        </list>
        <list name='private'>
          <item type='subscription'
                value='both'
                action='allow'
                order='10'/>
          <item action='deny' order='15'/>
        </list>
      </query>
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='Incoming Subscription Requests' anchor='incoming-subscription-requests'>
    <p>Each &lt;user/&gt; element SHOULD contain pending incoming subscription requests associated with the user's account. Incoming subscription requests are represented by including &lt;presence/&gt; elements qualified by the 'jabber:client' namespace with the 'type' attribute set to a value of 'subscribe' as children of the &lt;user/&gt; element.</p>

    <example caption='Incoming subscription requests'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      <presence xmlns='jabber:client'
                type='subscribe'
                id='xk3h1v69'
                from='romeo@montague.net'>
        <nick xmlns="http://jabber.org/protocol/nick">Romeo</nick>
      </presence>
      <presence xmlns='jabber:client'
                type='subscribe'
                from='mercutio@montague.net'/>
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='Personal Eventing Protocol' anchor='pep'>
    <p>A user's PEP data (as defined in &xep0163;) SHOULD be included if known.</p>

    <p>Node configuration and the actual node data are encapsulated separately, as described below. A typical export that contains both node configuration and the actual data contained within the node, will include two &lt;pubsub/&gt; elements (qualified by different namespaces).</p>

    <p>Many server implementations include support for additional pubsub features from &xep0060; beyond those required by XEP-0163. This specification aims to preserve this additional data also, when it is present and supported by both servers.</p>

    <section3 topic='PEP node configuration' anchor='pep-config'>
      <p>Within the &lt;user/&gt; element there should be a single &lt;pubsub/&gt; element qualified by the 'http://jabber.org/protocol/pubsub#owner' namespace (note the '#owner' suffix). Within this element, there MUST be one &lt;configure/&gt; element for each exported node, with the node's name in the 'node' attribute. There MAY be additional elements included, at most one per node of each kind: &lt;subscriptions/&gt; and &lt;affiliations&gt;, following the syntax defined in XEP-0060.</p>

      <p>The format of the &lt;configure/&gt; is a &xep0004; data form, typically containing the fields documented in XEP-0060, encoding the configuration of the named node.</p>

      <p>As a general rule, importers SHOULD ignore node configuration options that the target server implementation doesn't recognise, to allow porting data between different implementations even in the presence of custom extensions. Exceptions to this requirement may be made for imports that are expected to be lossless, for example if the user has specifically requested a lossless import, or if the importer recognises certain configuration fields as critical to protect the node's security or integrity.</p>
    </section3>

    <section3 topic='PEP node items' anchor='pep-items'>
      <p>Within the &lt;user/&gt; element there should be a single &lt;pubsub/&gt; element qualified by the 'http://jabber.org/protocol/pubsub' namespace (note the lack of any suffix). Within this element, there MUST be one &lt;items/&gt; element for each exported node, with the node's name in the 'node' attribute.</p>

      <p>Any node listed in this element MUST have a corresponding configuration included as described in the previous section.</p>

      <p>Each &lt;items&gt; element MUST contain zero or more &lt;item/&gt; elements as defined by XEP-0060.</p>
    </section3>

    <p>This example demonstrates an export for a user who has two nodes: a private bookmarks node with two bookmarks, and a public nickname node containing a single item.</p>

    <example caption='Romeo&apos;s exported PEP data'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='romeo'>
      <pubsub xmlns='http://jabber.org/protocol/pubsub#owner'>
        <configure node='urn:xmpp:bookmarks:1'>
          <x xmlns='jabber:x:data' type='form'>
            <field var='FORM_TYPE' type='hidden'>
              <value>http://jabber.org/protocol/pubsub#node_config</value>
            </field>
            <field var='pubsub#access_model'>
              <value>whitelist</value>
            </field>
          </x>
        </configure>
        <affiliations node='urn:xmpp:bookmarks:1'>
          <affiliation jid='mercutio@example.net' affiliation='member'/>
        </affiliations>
        <subscriptions node='urn:xmpp:bookmarks:1'>
          <subscription jid='mercutio@example.net' subscription='subscribed' subid='123-abc'/>
        </subscriptions>
        <configure node='http://jabber.org/protocol/nick'>
          <x xmlns='jabber:x:data' type='form'>
            <field var='FORM_TYPE' type='hidden'>
              <value>http://jabber.org/protocol/pubsub#node_config</value>
            </field>
            <field var='pubsub#access_model'>
              <value>open</value>
            </field>
          </x>
        </configure>
      </pubsub>
      <pubsub xmlns='http://jabber.org/protocol/pubsub'>
        <items node='urn:xmpp:bookmarks:1'>
          <item id='theplay@conference.shakespeare.lit'>
            <conference xmlns='urn:xmpp:bookmarks:1'
                      name='The Play&apos;s the Thing'
                      autojoin='true'>
              <nick>Romeo</nick>
            </conference>
          </item>
          <item id='orchard@conference.shakespeare.lit'>
            <conference xmlns='urn:xmpp:bookmarks:1'
                      name='The Orchard'
                      autojoin='1'>
              <nick>Romeo</nick>
            </conference>
          </item>
        </items>
        <items node='http://jabber.org/protocol/nick'>
          <item id='current'>
            <nick xmlns='http://jabber.org/protocol/nick'>Romy</nick>
          </item>
        </items>
      </pubsub>
    </user>
  </host>
</server-data>
]]></example>
  </section2>

  <section2 topic='Message Archive' anchor='archive'>
    <p>A user's &xep0313; message archive MAY be included in an export. If included, they MUST be formatted as a series of XEP-0313 &lt;result/&gt; elements within an &lt;archive/&gt; element qualified by the 'urn:xmpp:pie:0#mam' namespace. The result elements MUST be in chronological order (from oldest to newest).</p>

    <example caption='Juliet&apos;s exported message archive'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'>
  <host jid='capulet.com'>
    <user name='juliet'>
      <archive xmlns='urn:xmpp:pie:0#mam'>
        <result xmlns='urn:xmpp:mam:2' id='28482-98726-73623'>
            <forwarded xmlns='urn:xmpp:forward:0'>
              <delay xmlns='urn:xmpp:delay' stamp='2010-07-10T23:08:25Z'/>
              <message xmlns='jabber:client'
                to='juliet@capulet.lit/balcony'
                from='romeo@montague.lit/orchard'
                type='chat'>
                <body>Call me but love, and I'll be new baptized; Henceforth I never will be Romeo.</body>
              </message>
            </forwarded>
          </result>
          <result xmlns='urn:xmpp:mam:2' id='5d398-28273-f7382'>
            <forwarded xmlns='urn:xmpp:forward:0'>
              <delay xmlns='urn:xmpp:delay' stamp='2010-07-10T23:09:32Z'/>
              <message xmlns='jabber:client'
                 to='romeo@montague.lit/orchard'
                 from='juliet@capulet.lit/balcony'
                 type='chat' id='8a54s'>
                <body>What man art thou that thus bescreen'd in night so stumblest on my counsel?</body>
              </message>
            </forwarded>
          </result>
      </archive>
    </user>
  </host>
</server-data>
]]></example>

  </section2>
</section1>

<section1 topic='Use of XInclude' anchor='xinclude'>

  <p>An exporting server may split the data in several files by using the XInclude &lt;include/&gt; element. An importing server MUST support &lt;include/&gt; elements having an 'href' attribute containing a relative URI, having no 'parse' attribute, and having no 'xpointer' attribute; it MAY support other kinds of &lt;include/&gt; elements. An exporting server SHOULD NOT include and an importing server SHOULD NOT process &lt;include/&gt; elements which are descendants, but not children of the &lt;user/&gt; element (since these may be part of user data).</p>

  <section2 topic='File and Directory Layout' anchor='xinclude-layout'>
    <p>If an exporting server chooses to split the data into several files, it SHOULD use the following scheme:</p>

    <p>The main file contains the &lt;server-data/&gt; element, which contains nothing but one &lt;include/&gt; element for each host.  The file included for a certain host is placed in the same directory as the main file, and is named by appending ".xml" to the JID of the host, e.g. "capulet.com.xml".</p>

    <example caption='The main file, which includes host files'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<server-data xmlns='urn:xmpp:pie:0'
             xmlns:xi='http://www.w3.org/2001/XInclude'>
  <xi:include href='capulet.com.xml'/>
  <xi:include href='montague.net.xml'/>
</server-data>
]]></example>

    <p>Each host file contains a &lt;host/&gt; element, which contains nothing but one &lt;include/&gt; element for each user of the host.  The file included for a certain user is placed in a subdirectory whose name is the JID of the host, and is named by appending ".xml" to the node part of the user's JID, e.g. "capulet.com/juliet.xml".</p>

    <example caption='The host file, which includes user files'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<host xmlns='urn:xmpp:pie:0'
      xmlns:xi='http://www.w3.org/2001/XInclude'
      jid='capulet.com'>
  <xi:include href='capulet.com/juliet.xml'/>
  <xi:include href='capulet.com/mercutio.xml'/>
</host>
]]></example>

    <p>Each user file contains a &lt;user/&gt; element, and includes all data relating to that user.</p>

    <example caption='The user file'><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>
<user xmlns='urn:xmpp:pie:0'
      name='juliet'>
  <query xmlns='jabber:iq:roster'>
    <item jid='romeo@montague.net'
	  name='Romeo'
	  subscription='both'>
      <group>Friends</group>
    </item>
  </query>
  <vCard xmlns='vcard-temp'>
    <FN>Juliet Capulet</FN>
  </vCard>
  <offline-messages>
    <message xmlns='jabber:client'
	     from='romeo@montague.net/orchard'
	     to='juliet@capulet.com/balcony'
	     type='chat'>
      <body>Neither, fair saint, if either thee dislike.</body>
      <delay xmlns='urn:xmpp:delay'
	     from='capulet.com'
	     stamp='1469-07-21T00:32:29Z'>
	Offline Storage
      </delay>
    </message>
  </offline-messages>
</user>
]]>
    </example>

    <p>The definition of JIDs ensures that this generates valid file names on traditional Unix-like file systems, except for possible length constraints.  However, various constraints may force an exporting server to alter this scheme.  In any case, the importing server MUST NOT rely on this layout, but MUST do proper XInclude processing.</p>

  </section2>

</section1>

<section1 topic='Security Considerations' anchor='security'>
  <p>Exported data files are to be handled with care, since they contain data that users expect to be protected, in particular passwords. An exporting server SHOULD make sure that the generated file is not accessible to unauthorized persons, e.g. by enforcing strict file permissions. It may also apply suitable encryption before storing or transmitting the data.</p>
  <p>XInclude &lt;include/&gt; elements which are indirect descendants of the &lt;user/&gt; element SHOULD be treated as opaque user data, and SHOULD NOT be processed.</p>
</section1>

<section1 topic='IANA Considerations' anchor='iana'>
  <p>This document requires no interaction with &IANA;.</p>
</section1>

<section1 topic='XMPP Registrar Considerations' anchor='registrar'>
  <section2 topic='Protocol Namespaces' anchor='registrar-ns'>
    <p>This specification defines the following XML namespace:</p>
    <ul>
      <li>urn:xmpp:pie:0</li>
    </ul>
    <p>The &REGISTRAR; includes the foregoing namespace in its registry at &NAMESPACES;, as described in Section 4 of &xep0053;.</p>
  </section2>
  <section2 topic='Protocol Versioning' anchor='registrar-versioning'>
    &NSVER;
  </section2>
</section1>

<section1 topic='XML Schema' anchor='schema'>
  <code><![CDATA[
<?xml version='1.0' encoding='UTF-8'?>

<xs:schema
    xmlns:xs='http://www.w3.org/2001/XMLSchema'
    targetNamespace='urn:xmpp:pie:0'
    xmlns='urn:xmpp:pie:0'
    elementFormDefault='qualified'>

  <xs:annotation>
    <xs:documentation>
      The protocol documented by this schema is defined in
      XEP-0227: http://xmpp.org/extensions/xep-0227.html
    </xs:documentation>
  </xs:annotation>

  <xs:element name='server-data'>
    <xs:complexType>
      <xs:sequence>
        <xs:element ref='host' maxOccurs='unbounded'/>
        <xs:any namespace='##other' minOccurs='0' maxOccurs='unbounded'/>
      </xs:sequence>
    </xs:complexType>
  </xs:element>

  <xs:element name='host'>
    <xs:complexType>
      <xs:sequence>
	<xs:element ref='user' maxOccurs='unbounded'/>
	<xs:any namespace='##other' minOccurs='0' maxOccurs='unbounded'/>
      </xs:sequence>
      <xs:attribute name='jid' type='xs:string' use='required'/>
    </xs:complexType>
  </xs:element>

  <xs:element name='user'>
    <xs:complexType>
      <xs:sequence>
	<xs:element ref='offline-messages' minOccurs='0' maxOccurs='1'/>
	<xs:any namespace='##other' minOccurs='0' maxOccurs='unbounded'/>
      </xs:sequence>
      <xs:attribute name='name' type='xs:string' use='required'/>
      <xs:attribute name='password' type='xs:string' use='optional'/>
    </xs:complexType>
  </xs:element>

  <xs:element name='offline-messages'>
    <xs:complexType>
      <xs:sequence>
	<xs:any namespace='##other' minOccurs='0' maxOccurs='unbounded'/>
      </xs:sequence>
    </xs:complexType>
  </xs:element>

</xs:schema>
]]></code>
</section1>
</xep>