I trying to use and / with element values but I just can't get it to work. If I do it with attrubute values it works like a charm.

Test.xml

<test:config xmlns:test="http://www.example.org/Test"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.example.org/Test Test.xsd ">

    <test:location id="id1" path="/path2">
        <test:roles>
            <test:role>role1</test:role>
            <test:role>role2</test:role>
            <test:role>role2</test:role> <!-- DUPLICATE: FAIL VALIDATION  -->
        </test:roles>
        <test:action name="action1">
            <test:roles>
                <test:role>role1</test:role>
                <test:role>role1</test:role> <!-- DUPLICATE: FAIL VALIDATION -->
                <test:role>role3</test:role> <!-- NOT DEFINED: FAIL VALIDATION -->
            </test:roles>
        </test:action>
    </test:location>

</test:config>

I want ensure that roles are only defined once and that the roles defined under the action element are only those defined at the upper level.

Test.xsd

<xs:element name="config">
    <xs:complexType>
        <xs:sequence>
            <xs:element ref="test:location" maxOccurs="unbounded" />
        </xs:sequence>
    </xs:complexType>       
</xs:element>

<xs:element name="location" type="test:LocationType">
    <xs:key name="keyRole">
        <xs:selector xpath="test:roles" />
        <xs:field xpath="test:role" />
    </xs:key>
    <xs:keyref name="keyrefRole" refer="test:keyRole">
        <xs:selector xpath="test:action/test:roles" />
        <xs:field xpath="test:role" />
    </xs:keyref>
</xs:element>

<xs:complexType name="LocationType">
    <xs:sequence>
        <xs:element ref="test:roles" minOccurs="0" />
        <xs:element name="action" type="test:ActionType" minOccurs="0" maxOccurs="unbounded"/>
    </xs:sequence>
    <xs:attribute name="id" type="xs:string" use="required"/>
    <xs:attribute name="path" type="xs:string" use="required"/>
</xs:complexType>

<xs:element name="roles" type="test:RolesType">
    <xs:unique name="uniqueRole">
        <xs:selector xpath="." />
        <xs:field xpath="test:role" />
    </xs:unique>
</xs:element>

<xs:complexType name="RolesType">
    <xs:sequence>
        <xs:element name="role" type="xs:string" maxOccurs="unbounded"/>
    </xs:sequence>      
</xs:complexType>

<xs:complexType name="ActionType">
    <xs:sequence>
        <xs:element ref="test:roles" />
    </xs:sequence>
    <xs:attribute name="name" type="xs:string" use="required" />
</xs:complexType>

The validation fails with these messages:

Description Resource    Path    Location    Type
cvc-identity-constraint.3: Field "./test:role" of identity constraint "keyrefRole" matches more than one value within the scope of its selector; fields must match unique values.   Test.xml    /filebrowser-ejb/src/test/resources line 15 XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "keyrefRole" matches more than one value within the scope of its selector; fields must match unique values.   Test.xml    /filebrowser-ejb/src/test/resources line 16 XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "keyRole" matches more than one value within the scope of its selector; fields must match unique values.  Test.xml    /filebrowser-ejb/src/test/resources line 9  XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "keyRole" matches more than one value within the scope of its selector; fields must match unique values.  Test.xml    /filebrowser-ejb/src/test/resources line 10 XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "uniqueRole" matches more than one value within the scope of its selector; fields must match unique values.   Test.xml    /filebrowser-ejb/src/test/resources line 9  XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "uniqueRole" matches more than one value within the scope of its selector; fields must match unique values.   Test.xml    /filebrowser-ejb/src/test/resources line 10 XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "uniqueRole" matches more than one value within the scope of its selector; fields must match unique values.   Test.xml    /filebrowser-ejb/src/test/resources line 15 XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "uniqueRole" matches more than one value within the scope of its selector; fields must match unique values.   Test.xml    /filebrowser-ejb/src/test/resources line 16 XML Problem
cvc-identity-constraint.4.1: Duplicate unique value [role1] declared for identity constraint "uniqueRole" of element "roles".   Test.xml    /filebrowser-ejb/src/test/resources line 9  XML Problem
cvc-identity-constraint.4.1: Duplicate unique value [role1] declared for identity constraint "uniqueRole" of element "roles".   Test.xml    /filebrowser-ejb/src/test/resources line 15 XML Problem
cvc-identity-constraint.4.2.2: Duplicate key value [role1] declared for identity constraint "keyRole" of element "location".    Test.xml    /filebrowser-ejb/src/test/resources line 9  XML Problem
cvc-identity-constraint.4.3: Key 'keyrefRole' with value 'role3' not found for identity constraint of element 'location'.   Test.xml    /filebrowser-ejb/src/test/resources line 19 XML Problem

If I comment out the lines that should fail, validation still fails now with these messages:

Description Resource    Path    Location    Type
cvc-identity-constraint.3: Field "./test:role" of identity constraint "keyRole" matches more than one value within the scope of its selector; fields must match unique values.  Test.xml    /filebrowser-ejb/src/test/resources line 10 XML Problem
cvc-identity-constraint.3: Field "./test:role" of identity constraint "uniqueRole" matches more than one value within the scope of its selector; fields must match unique values.   Test.xml    /filebrowser-ejb/src/test/resources line 10 XML Problem

What am I doing wrong?