<?xml version="1.0"?>
<!--
  ~ Copyright (c) 2010-2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<accessCertificationDefinition
        xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <name>All user assignments</name>
    <description>Certifies all users' assignments. Everything is certified by the administrator.</description>
    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/certification/handlers-3#direct-assignment</handlerUri>
    <scopeDefinition xsi:type="AccessCertificationAssignmentReviewScopeType">
        <objectType>UserType</objectType>
    </scopeDefinition>
    <ownerRef oid="00000000-0000-0000-0000-000000000002" type="UserType"><!-- administrator --></ownerRef>
    <remediationDefinition>
        <style>automated</style>
    </remediationDefinition>
    <stageDefinition>
        <number>1</number>
        <name>Administrator's review</name>
        <description>In this stage, the administrator has to review all the assignments of all users.</description>
        <duration>P14D</duration>   <!-- 14 days -->
        <notifyBeforeDeadline>PT48H</notifyBeforeDeadline> <!-- 48 hours -->
        <notifyBeforeDeadline>PT12H</notifyBeforeDeadline>
        <notifyOnlyWhenNoDecision>true</notifyOnlyWhenNoDecision>  <!-- this is the default -->
        <reviewerSpecification>
            <defaultReviewerRef oid="00000000-0000-0000-0000-000000000002" type="UserType" />   <!-- administrator -->
        </reviewerSpecification>
        <timedActions>
            <time>
                <value>P1D</value>
            </time>
            <actions>
                <escalate>
                    <approverRef oid="018fe48d-4952-4f4b-8c0a-b8670ec1748e" type="UserType" />  <!-- some other user -->
                    <delegationMethod>addAssignees</delegationMethod>
                    <escalationLevelName>Level1</escalationLevelName>
                </escalate>
            </actions>
        </timedActions>
        <timedActions>
            <time>
                <value>P3D</value>
            </time>
            <actions>
                <escalate>
                    <approverRef oid="42b48a07-e167-4fdc-baca-8eaa13d4eaad" type="UserType" />  <!-- yet another user -->
                    <delegationMethod>replaceAssignees</delegationMethod>
                    <escalationLevelName>Level2</escalationLevelName>
                </escalate>
            </actions>
            <escalationLevelFrom>1</escalationLevelFrom>
            <escalationLevelTo>1</escalationLevelTo>
        </timedActions>
    </stageDefinition>
</accessCertificationDefinition>
