<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2017-2019 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<resource xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
          xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
          xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
          xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
          xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
          xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
          xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">
    <name>Medusa Active Directory (LDAP) with Exchange</name>

    <connectorRef type="ConnectorType">
        <filter>
            <q:text>c:connectorType = "com.evolveum.polygon.connector.ldap.ad.AdLdapConnector"</q:text>
        </filter>
    </connectorRef>

    <connectorConfiguration xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3">
        <icfc:configurationProperties xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.ad.AdLdapConnector">
            <icfcldap:host>medusa.lab.evolveum.com</icfcldap:host>
            <icfcldap:port>636</icfcldap:port>
            <icfcldap:baseContext>DC=win,DC=evolveum,DC=com</icfcldap:baseContext>
            <icfcldap:bindDn>CN=midpoint admin1,CN=Users,DC=win,DC=evolveum,DC=com</icfcldap:bindDn>
            <icfcldap:connectionSecurity>ssl</icfcldap:connectionSecurity>
            <icfcldap:bindPassword>
                <t:clearValue>secret</t:clearValue>
            </icfcldap:bindPassword>
            <icfcldap:pagingBlockSize>100</icfcldap:pagingBlockSize>
            <icfcldap:winRmHost>mailserver.lab.evolveum.com</icfcldap:winRmHost> <!-- exchange server or any other domain computer with exchange-extended powershell -->
            <icfcldap:winRmUseHttps>true</icfcldap:winRmUseHttps>
            <icfcldap:winRmUsername>midpoint</icfcldap:winRmUsername>
            <icfcldap:winRmPort>5986</icfcldap:winRmPort>
            <icfcldap:winRmPassword>
                <t:clearValue>secret</t:clearValue>
            </icfcldap:winRmPassword>
            <icfcldap:powershellArgumentStyle>variables</icfcldap:powershellArgumentStyle>
            <icfcldap:operationalAttributes>msExchHomeServerName</icfcldap:operationalAttributes> <!-- workaround to MID-3379 -->
            <icfcldap:operationalAttributes>msExchUserAccountControl</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>msExchWhenMailboxCreated</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>homeMDB</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>mDBUseDefaults</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>mDBStorageQuota</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>mDBOverQuotaLimit</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>mDBOverHardQuotaLimit</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>mailNickname</icfcldap:operationalAttributes>
        </icfc:configurationProperties>
        <icfc:resultsHandlerConfiguration>
            <icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler>
            <icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
            <icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler>
        </icfc:resultsHandlerConfiguration>
    </connectorConfiguration>

    <schema>
        <!-- workaround to MID-2723 -->
        <generationConstraints>
            <generateObjectClass>ri:user</generateObjectClass>
            <generateObjectClass>ri:group</generateObjectClass>
        </generationConstraints>

        <definition>
         <xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                     xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
                     xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
                     xmlns:ra="http://midpoint.evolveum.com/xml/ns/public/resource/annotation-3"
                     elementFormDefault="qualified"
                     targetNamespace="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">
            <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/annotation-3"/>
            <xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/resource/annotation-3"/>
            <xsd:complexType name="user">
               <xsd:annotation>
                  <xsd:appinfo>
                     <ra:resourceObject/>
                     <ra:identifier>ri:objectGUID</ra:identifier>
                     <ra:secondaryIdentifier>ri:sAMAccountName</ra:secondaryIdentifier>
                     <ra:displayNameAttribute>ri:dn</ra:displayNameAttribute>
                     <ra:namingAttribute>ri:dn</ra:namingAttribute>
                     <ra:nativeObjectClass>user</ra:nativeObjectClass>
                  </xsd:appinfo>
               </xsd:annotation>
               <xsd:sequence>
                   <xsd:element maxOccurs="1"
                               minOccurs="0"
                               name="mDBUseDefaults"
                               type="xsd:boolean">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>mDBUseDefaults</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>mDBUseDefaults</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element maxOccurs="1"
                               minOccurs="0"
                               name="mDBStorageQuota"
                               type="xsd:int">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>mDBStorageQuota</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>mDBStorageQuota</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element maxOccurs="1"
                               minOccurs="0"
                               name="mDBOverQuotaLimit"
                               type="xsd:int">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>mDBOverQuotaLimit</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>mDBOverQuotaLimit</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element maxOccurs="1"
                               minOccurs="0"
                               name="mDBOverHardQuotaLimit"
                               type="xsd:int">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>mDBOverHardQuotaLimit</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>mDBOverHardQuotaLimit</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element minOccurs="0" name="mailNickname" type="xsd:string">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>mailNickname</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>mailNickname</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element minOccurs="0" name="msExchUserAccountControl" type="xsd:int">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>msExchUserAccountControl</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>msExchUserAccountControl</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element maxOccurs="1"
                               minOccurs="0"
                               name="msExchHomeServerName"
                               type="xsd:string">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>msExchHomeServerName</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>msExchHomeServerName</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element maxOccurs="1" minOccurs="0" name="homeMDB" type="xsd:string">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <ra:nativeAttributeName>homeMDB</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>homeMDB</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
                  <xsd:element minOccurs="0" name="msExchWhenMailboxCreated" type="xsd:long">
                     <xsd:annotation>
                        <xsd:appinfo>
                           <a:access>read</a:access>
                           <ra:nativeAttributeName>msExchWhenMailboxCreated</ra:nativeAttributeName>
                           <ra:frameworkAttributeName>msExchWhenMailboxCreated</ra:frameworkAttributeName>
                        </xsd:appinfo>
                     </xsd:annotation>
                  </xsd:element>
              </xsd:sequence>
            </xsd:complexType>
        </xsd:schema>
      </definition>
    </schema>

    <schemaHandling>

        <!-- handling of user accounts -->

        <objectType>
            <kind>account</kind>
            <displayName>Default Account</displayName>
            <default>true</default>
            <objectClass>ri:user</objectClass>

            <attribute>
                <ref>ri:dn</ref>
                <displayName>Distinguished Name</displayName>
                <matchingRule>mr:distinguishedName</matchingRule>
                <outbound>
                    <source>
                        <path>$user/fullName</path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                'CN=' + fullName + iterationToken + ',CN=Users,DC=win,DC=evolveum,DC=com'
                            </code>
                        </script>
                    </expression>
                </outbound>
            </attribute>

            <attribute>
                    <ref>ri:sAMAccountName</ref>
                    <displayName>Login name</displayName>
                    <outbound>
                        <source>
                            <path>$user/name</path>
                        </source>
                    </outbound>
            </attribute>

            <attribute>
                <ref>ri:cn</ref>
                <limitations>
                    <minOccurs>0</minOccurs>
                </limitations>
                <outbound>
                    <source>
                        <path>fullName</path>
                    </source>
                </outbound>
            </attribute>

            <attribute>
                <ref>ri:sn</ref>
                <limitations>
                    <minOccurs>0</minOccurs>
                </limitations>
                <outbound>
                    <source>
                        <path>familyName</path>
                    </source>
                </outbound>
            </attribute>

            <attribute>
                <ref>ri:givenName</ref>
                <outbound>
                    <source>
                        <path>givenName</path>
                    </source>
                </outbound>
            </attribute>

            <attribute>
                    <ref>ri:userPrincipalName</ref>
                    <outbound>
                    <source>
                        <path>$user/name</path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                name + iterationToken + '@win.evolveum.com'
                            </code>
                        </script>
                    </expression>
                </outbound>
            </attribute>

            <attribute><!-- Password expired: -1: not expired; 0: expired ("User must change password at next logon") -->
                    <ref>ri:pwdLastSet</ref>
                    <outbound>
                    <expression>
                        <value>-1</value>
                    </expression>
                </outbound>
            </attribute>

            <attribute>
                <ref>ri:createTimeStamp</ref>
                <fetchStrategy>explicit</fetchStrategy>
            </attribute>

            <attribute>
                <ref>ri:nTSecurityDescriptor</ref>
                <!-- This is defined as mandatory in top object class.
                                     But it is not really mandatory. Well done Microsoft. -->
                <limitations>
                    <minOccurs>0</minOccurs>
                </limitations>
            </attribute>

            <attribute>
                <ref>ri:instanceType</ref>
                <!-- This is defined as mandatory in top object class.
                                     But it is not really mandatory. Well done Microsoft. -->
                <limitations>
                    <minOccurs>0</minOccurs>
                </limitations>
            </attribute>

            <attribute>
                <ref>ri:objectCategory</ref>
                <!-- This is defined as mandatory in top object class.
                                     But it is not really mandatory. Well done Microsoft. -->
                                <!-- Be sure to update the suffix/value for your domain !!! -->
                <limitations>
                    <minOccurs>0</minOccurs>
                </limitations>
                <outbound>
                    <expression>
                        <value>CN=Person,CN=Schema,CN=Configuration,DC=win,DC=evolveum,DC=com</value>
                    </expression>
                </outbound>
            </attribute>

<!--
            <attribute>
                <ref>ri:showInAdvancedViewOnly</ref>
                <outbound>
                    <source>
                        <path>extension/showInAdvancedViewOnly</path>
                    </source>
                </outbound>
            </attribute>
-->
            <association>
                <ref>ri:group</ref>
                <displayName>AD Group Membership</displayName>
                <kind>entitlement</kind>
                <intent>group</intent>
                <direction>objectToSubject</direction>
                <associationAttribute>ri:member</associationAttribute>
                <valueAttribute>ri:dn</valueAttribute>
                <shortcutAssociationAttribute>ri:memberOf</shortcutAssociationAttribute>
                <shortcutValueAttribute>ri:dn</shortcutValueAttribute>
                <explicitReferentialIntegrity>false</explicitReferentialIntegrity>
            </association>

        <activation>
            <administrativeStatus>
                <outbound/>
            </administrativeStatus>
        </activation>

            <credentials>
                <password>
                    <outbound/>
                </password>
            </credentials>

        </objectType>

        <objectType>
            <kind>entitlement</kind>
            <intent>group</intent>
            <displayName>AD Group</displayName>
            <default>true</default>
            <objectClass>ri:group</objectClass>
            <attribute>
                <ref>dn</ref>
                <matchingRule>mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <source>
                        <path>$focus/name</path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                'CN=' + name + ',CN=Users,DC=win,DC=evolveum,DC=com'
                            </code>
                        </script>
                    </expression>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:cn</ref>
                <matchingRule>mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <source>
                        <path>$focus/name</path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <path>name</path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:description</ref>
                <outbound>
                    <strength>strong</strength>
                    <source>
                        <path>description</path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <path>description</path>
                    </target>
                </inbound>
            </attribute>
        </objectType>

    </schemaHandling>

    <scripts>
      <script>
         <host>resource</host>
         <language>powershell</language>
         <argument>
            <c:path>$user/name</c:path>
            <name>identity</name>
         </argument>
         <argument>
            <c:path>$resource/connectorConfiguration/configurationProperties/winRmUsername</c:path>
            <name>winrm_user</name>
         </argument>
         <argument>
            <c:path>$resource/connectorConfiguration/configurationProperties/winRmPassword</c:path>
            <name>winrm_password</name>
         </argument>
         <code>winrs -ad -u:$winrm_user -p:$winrm_password powershell.exe -command "add-pssnapin *exchange* -erroraction SilentlyContinue;enable-mailbox -identity $identity"</code>
         <operation>add</operation>
         <order>after</order>
      </script>
   </scripts>

    <synchronization>
        <objectSynchronization>
            <name>Account sync</name>
            <objectClass>ri:user</objectClass>
            <kind>account</kind>
            <intent>default</intent>
            <focusType>UserType</focusType>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:path>c:name</q:path>
                    <expression>
                        <path>$shadow/attributes/sAMAccountName</path>
                    </expression>
                </q:equal>
            </correlation>

            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <action><handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri></action>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <action><handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri></action>
            </reaction>
            <reaction>
                <situation>unmatched</situation>
<!--                    <action><handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri></action>-->
            </reaction>

        </objectSynchronization>

        <objectSynchronization>
            <name>Group sync</name>
            <objectClass>ri:group</objectClass>
            <kind>entitlement</kind>
            <intent>group</intent>
            <focusType>RoleType</focusType>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:path>c:name</q:path>
                    <expression>
                        <path>$shadow/attributes/cn</path>
                    </expression>
                </q:equal>
            </correlation>

            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <action><handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri></action>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <action><handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri></action>
            </reaction>
            <reaction>
                <situation>unmatched</situation>
<!--                    <action><handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri></action>-->
            </reaction>

        </objectSynchronization>
    </synchronization>

</resource>
