<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2018 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<objects xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
         xmlns:org='http://midpoint.evolveum.com/xml/ns/public/common/org-3'
         xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
         xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">

    <org oid="00000000-8888-6666-a000-000000000000">
        <name>0000</name>
        <description>Root of the multitenant structure</description>
        <subtype>root</subtype>
        <displayName>Multitenant root</displayName>
        <identifier>000</identifier>
    </org>

    <role oid="00000000-8888-6666-a000-100000000001">
        <name>Tenant End User Role</name>
        <!-- No tenant assignment here -->

        <!-- Tenant authorizations -->
        <authorization>
            <name>tenant enduser autz get</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#get</action>
            <object>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                    <includeTenantOrg>true</includeTenantOrg>
                </tenant>
            </object>
        </authorization>
        <authorization>
            <name>assign-requestable-roles</name>
            <description>
                Allow to assign requestable roles. This allows to request roles in a request-and-approve process.
                The requestable roles will be displayed in the role request dialog by default.
                Please note that the roles also need an approved definition to go through the approval process.
                Otherwise they will be assigned automatically wihout any approval.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
            <phase>request</phase>
            <object>
                <special>self</special>
            </object>
            <target>
                <type>RoleType</type>
                <filter>
                    <q:text>requestable = true</q:text>
                </filter>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                </tenant>
            </target>
        </authorization>
        <authorization>
            <name>assignment-target-read-case</name>
            <description>
                Authorization that allows to read workflow status of tasks. This is used to display requests
                to the end users, especially in the "My Requests" box in user dashboard.
                This authorization is a temporary solution. It will be replaced by a finer-grained
                permissions in the future.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>CaseType</type>
            </object>
            <item>approvalContext</item>
        </authorization>

        <!-- Common end user authorizations -->
        <authorization>
            <name>gui-self-service-access</name>
            <description>
                Allow access to all self-service operations in GUI.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll</action>
        </authorization>
        <authorization>
            <name>self-read</name>
            <description>
                Allow to read all the properties of "self" object. I.e. every logged-in user can read
                object that represent his own identity.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <special>self</special>
            </object>
        </authorization>
        <authorization>
            <name>self-shadow-read</name>
            <description>
                Allow to read all the properties of all the shadows that belong to "self" object.
                I.e. every logged-in user can read all his accounts.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>ShadowType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <name>self-credentials-request</name>
            <description>
                Allow to modify user's own credentials.
                Note that this is a request phase authorization. It also requires corresponding execution-phase authorization.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
            <phase>request</phase>
            <object>
                <special>self</special>
            </object>
            <item>credentials</item>
        </authorization>
        <authorization>
            <name>self-shadow-credentials-request</name>
            <description>
                Allow to modify credentials of all users accounts.
                Note that this is a request phase authorization. It also requires corresponding execution-phase authorization.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
            <phase>request</phase>
            <object>
                <type>ShadowType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
            <item>credentials</item>
        </authorization>
        <authorization>
            <name>self-execution-modify</name>
            <description>
                Authorization that allows to self-modification of some properties, but only in execution phase.
                The limitation real limitation of these operations is done in the request phase.
                E.g. the modification of assignments is controlled in the request phase by using the #assign
                authorization.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <phase>execution</phase>
            <object>
                <special>self</special>
            </object>
            <item>credentials</item>
            <item>assignment</item>
        </authorization>
        <authorization>
            <name>self-shadow-execution-add-modify-delete</name>
            <description>
                Authorization that allows to self-modification of user's accounts, but only in execution phase.
                The real limitation of these operations is done in the request phase.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
            <phase>execution</phase>
            <object>
                <type>ShadowType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <name>self-owned-task-read</name>
            <description>
                Authorization that allows to see all tasks owned by a currently logged-in user.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>TaskType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <name>self-owned-task-add-execute-changes</name>
            <description>
                Authorization to create a new 'execute changes' task owned by a currently logged-in user.
                This is needed to execute asynchronous operations from the GUI.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <object>
                <type>TaskType</type>
                <filter>
                    <q:text>handlerUri = "http://midpoint.evolveum.com/xml/ns/public/model/synchronization/task/execute/handler-3"</q:text>
                </filter>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
    </role>

    <role oid="00000000-8888-6666-a000-100000000000">
        <name>Tenant Admin Role</name>
        <!-- No tenant assignment here -->
        <inducement>
            <targetRef oid="00000000-8888-6666-a000-100000000001" type="RoleType"/> <!-- Tenant end user -->
        </inducement>

        <!-- Tenant-related authorizations -->
        <authorization>
            <name>tenant admin autz read</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                    <includeTenantOrg>true</includeTenantOrg>
                </tenant>
            </object>
        </authorization>
        <authorization>
            <name>tenant admin autz read root</name>
            <description>Read permission for org root. Otherwise we couldn't browse our own tenant</description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>OrgType</type>
                <filter>
                    <q:text>subtype = "root"</q:text>
                </filter>
            </object>
        </authorization>
        <authorization>
            <name>tenant admin autz write req</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <phase>request</phase>
            <object>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                    <includeTenantOrg>false</includeTenantOrg>
                </tenant>
            </object>
            <exceptItem>tenant</exceptItem>
            <exceptItem>tenantRef</exceptItem>
            <!-- We do not want tenant admins to create roles with explicit authorizations. That may circumvent tenant isolation.
                 E.g. tenant admin could create role that can allow access to all objects.
                 Therefore all roles that require authorizations need to be create on top level (no tenant).
                 And then tenants will only create inducements to them. -->
            <exceptItem>authorization</exceptItem>
            <!-- We do not want tenants to create any assignment/inducement to any role. Otherwise the tenant admin
                 can create inducement to Superuser role and that may circumvent tenant isolation. -->
            <exceptItem>assignment</exceptItem>
            <exceptItem>inducement</exceptItem>
            <exceptItem>policyException</exceptItem>
            <!-- WARNING: Using exceptItem here may be dangerous! Do not use in real scenarios!
                          It would be much better idea to enumerate individual items that admin can modify
                          (use "item" instead of "exceptItem") -->
        </authorization>
        <authorization>
            <name>tenant admin autz write exec</name>
            <description>
                Assging and unassign authorizations apply only in request phase. We need to allow all assignments here.
                But we do not worry here. The assignments were already checked in request phase.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <phase>execution</phase>
            <object>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                    <includeTenantOrg>false</includeTenantOrg>
                </tenant>
            </object>
        </authorization>
        <authorization>
            <name>tenant admin autz delete</name>
            <description>
                Separate delete authorization without an exception for assignment/inducement.
                We want to be able to delete objects with assignments. All focal objects in tenant have at least one
                assignment. If we do not do this we won't be able to delete them.
                But we do not want to allow delete of the tenant org itself.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
            <object>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                    <includeTenantOrg>false</includeTenantOrg>
                </tenant>
            </object>
        </authorization>
        <authorization>
            <name>tenant admin assign local roles</name>
            <description>Assign only roles/orgs/services that are local to the tenant.</description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
            <object>
                <type>FocusType</type>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                    <includeTenantOrg>false</includeTenantOrg>
                </tenant>
            </object>
            <target>
                <type>AbstractRoleType</type>
                <tenant>
                    <sameAsSubject>true</sameAsSubject>
                    <includeTenantOrg>true</includeTenantOrg>
                </tenant>
            </target>
            <orderConstraints>
                <orderMin>0</orderMin> <!-- order=0 means assignment -->
                <orderMax>unbounded</orderMax> <!-- order=1,2,3... means inducements -->
            </orderConstraints>
        </authorization>

        <!-- Common admin authorizations -->
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#users</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#user</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#userDetails</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#findUsers</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgStruct</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgTree</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgUnit</action>
       </authorization>
    </role>

    <!-- ===[ Spacing Guild ]=== -->

    <org oid="00000000-8888-6666-a001-000000000000">
        <name>Spacing Guild</name>
        <description>Organizational structure, but not a tenant</description>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a000-000000000000" type="OrgType"/> <!-- root -->
        </assignment>
        <displayName>Spacing Guild</displayName>
        <identifier>001</identifier>
    </org>

    <role oid="00000000-8888-6666-a001-100000000001">
        <name>Broken Spacing Guild Admin</name>
        <description>Spacing guild administrator that does not really work.</description>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a001-000000000000" type="OrgType"/> <!-- Spacing Guild -->
        </assignment>
        <inducement>
            <!-- This does not really makes sense - by purpose. Spacing guild is not a tenant.
                 We want to make sure that the tenant admin role won't give any authorizations. -->
            <targetRef oid="00000000-8888-6666-a000-100000000000" type="RoleType"/> <!-- Tenant admin role -->
        </inducement>
    </role>

    <user oid="00000000-8888-6666-a001-200000000000">
        <name>edric</name>
        <givenName>Edric</givenName>
        <fullName>Navigator Edric</fullName>
        <honorificPrefix>Navigator</honorificPrefix>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a001-000000000000" type="OrgType"/> <!-- Spacing Guild -->
        </assignment>
        <assignment id="2">
            <targetRef oid="00000000-8888-6666-a001-100000000001" type="RoleType"/> <!-- Broken Spacing Guild Admin -->
        </assignment>
    </user>


    <!-- ===[ House Corrino ]=== -->

    <org oid="00000000-8888-6666-a100-000000000000">
        <name>Corrino</name>
        <subtype>tenancy</subtype>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a000-000000000000" type="OrgType"/> <!-- root -->
        </assignment>
        <displayName>House Corrino</displayName>
        <identifier>100</identifier>
        <locality>Kaitain</locality>
        <tenant>true</tenant>
    </org>

    <role oid="00000000-8888-6666-a100-100000000000">
        <name>Corrino Admin</name>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a100-000000000000" type="OrgType"/> <!-- House Corrino -->
        </assignment>
        <inducement>
            <targetRef oid="00000000-8888-6666-a000-100000000000" type="RoleType"/> <!-- Tenant admin role -->
        </inducement>
    </role>

    <user oid="00000000-8888-6666-a100-200000000000">
        <name>shaddam</name>
        <givenName>Shaddam</givenName>
        <familyName>Corrino</familyName>
        <fullName>Padishah Emperor Shaddam IV</fullName>
        <honorificPrefix>Padishah Emperor</honorificPrefix>
        <honorificSuffix>IV</honorificSuffix>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a100-000000000000" type="OrgType"/> <!-- House Corrino -->
        </assignment>
        <assignment id="2">
            <targetRef oid="00000000-8888-6666-a100-100000000000" type="RoleType"/> <!-- Corrino Admin -->
        </assignment>
    </user>


    <!-- ===[ House Atreides ]=== -->

    <org oid="00000000-8888-6666-a200-000000000000">
        <name>Atreides</name>
        <subtype>tenancy</subtype>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a000-000000000000" type="OrgType"/>
        </assignment>
        <displayName>House Atreides</displayName>
        <identifier>200</identifier>
        <locality>Caladan</locality>
        <tenant>true</tenant>
    </org>

    <role oid="00000000-8888-6666-a200-100000000000">
        <name>Atreides Admin</name>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a200-000000000000" type="OrgType"/>
        </assignment>
        <inducement>
            <targetRef oid="00000000-8888-6666-a000-100000000000" type="RoleType"/> <!-- Tenant admin role -->
        </inducement>
    </role>

    <role oid="00000000-8888-6666-a200-100000000001">
        <name>Atreides End User</name>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a200-000000000000" type="OrgType"/>
        </assignment>
        <inducement>
            <targetRef oid="00000000-8888-6666-a000-100000000001" type="RoleType"/> <!-- Tenant end user role -->
        </inducement>
    </role>

    <user oid="00000000-8888-6666-a200-200000000000">
        <name>leto</name>
        <givenName>Leto</givenName>
        <familyName>Atreides</familyName>
        <fullName>Duke Leto Atreides</fullName>
        <honorificPrefix>Duke</honorificPrefix>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a200-000000000000" type="OrgType"/> <!-- House Atreides -->
        </assignment>
        <assignment id="2">
            <targetRef oid="00000000-8888-6666-a200-100000000000" type="RoleType"/> <!-- Atreides Admin -->
        </assignment>
        <credentials>
            <password>
                <value>
                    <t:clearValue>5ecr3t</t:clearValue>
                </value>
            </password>
        </credentials>
    </user>

    <user oid="00000000-8888-6666-a200-200000000001">
        <name>paul</name>
        <givenName>Paul</givenName>
        <familyName>Atreides</familyName>
        <fullName>Paul Atreides</fullName>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a200-000000000000" type="OrgType"/> <!-- House Atreides -->
        </assignment>
        <assignment id="2">
            <targetRef oid="00000000-8888-6666-a200-100000000001" type="RoleType"/> <!-- End User -->
        </assignment>
        <credentials>
            <password>
                <value>
                    <t:clearValue>5ecr3t</t:clearValue>
                </value>
            </password>
        </credentials>
    </user>


    <!-- ===[ House Harkonnen ]=== -->

    <org oid="00000000-8888-6666-a300-000000000000">
        <name>Harkonnen</name>
        <subtype>tenancy</subtype>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a000-000000000000" type="OrgType"/>
        </assignment>
        <displayName>House Harkonnen</displayName>
        <identifier>300</identifier>
        <locality>Giedi Prime</locality>
        <tenant>true</tenant>
    </org>

    <role oid="00000000-8888-6666-a300-100000000000">
        <name>Harkonnen Admin</name>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a300-000000000000" type="OrgType"/>
        </assignment>
        <inducement>
            <targetRef oid="00000000-8888-6666-a000-100000000000" type="RoleType"/> <!-- Tenant admin role -->
        </inducement>
    </role>

    <user oid="00000000-8888-6666-a300-200000000000">
        <name>baronharkonnen</name>
        <givenName>Vladimir</givenName>
        <familyName>Harkonnen</familyName>
        <fullName>Baron Vladimir Harkonnen</fullName>
        <honorificPrefix>Baron</honorificPrefix>
        <assignment id="1">
            <targetRef oid="00000000-8888-6666-a300-000000000000" type="OrgType"/> <!-- House Harkonnen -->
        </assignment>
        <assignment id="2">
            <targetRef oid="00000000-8888-6666-a300-100000000000" type="RoleType"/> <!-- Harkonnen Admin -->
        </assignment>
    </user>

</objects>
