The TimeSyncToken schema defines the AuthnMethodBaseType to be a restriction of AuthnMethodBaseType where PrincipalAuthenticationMethod is optional and Authenticator is required.

However, the Token element is in the PrincipalAuthenticationMechanismType, not in the AuthenticatorSequenceGroup and thus it can't be part of the Authenticator element.

Reported here: https://lists.oasis-open.org/archives/security-services/201306/msg00003.html