<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2017 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  -->

<valuePolicy oid="00000000-0000-0000-0000-000000000003"
        xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3">
    <name>Default Password Policy</name>
    <description>Default password policy</description>
    <stringPolicy>
        <description>String policy for the password value</description>
        <limitations>
            <minLength>8</minLength>
            <minUniqueChars>3</minUniqueChars>
            <checkAgainstDictionary>true</checkAgainstDictionary>
            <checkPattern/>
            <checkExpression>
                <expression>
                    <script>
                        <code><![CDATA[
                            import com.evolveum.midpoint.xml.ns._public.common.common_3.UserType

                            if (object instanceof UserType) {
                                return !basic.containsIgnoreCase(input, object.getName())
                                        && !basic.containsIgnoreCase(input, object.getFamilyName())
                                        && !basic.containsIgnoreCase(input, object.getGivenName())
                                        && !basic.containsIgnoreCase(input, object.getAdditionalName())
                            } else {
                                return true
                            }
                        ]]></code>
                    </script>
                </expression>
                <failureMessage>must not contain username, family name and given name and additional names</failureMessage>
            </checkExpression>
            <limit>
                <description>Lowercase characters</description>
                <name>
                    <t:orig>Lowercase characters</t:orig>
                    <t:translation>
                        <t:key>ValuePolicy.lowercaseCharacters</t:key>
                    </t:translation>
                </name>
                <minOccurs>1</minOccurs>
                <mustBeFirst>false</mustBeFirst>
                <characterClass>
                    <value>abcdefghijklmnopqrstuvwxyz</value>
                </characterClass>
            </limit>
            <limit>
                <description>Uppercase characters</description>
                <name>
                    <t:orig>Uppercase characters</t:orig>
                    <t:translation>
                        <t:key>ValuePolicy.uppercaseCharacters</t:key>
                    </t:translation>
                </name>
                <minOccurs>1</minOccurs>
                <mustBeFirst>false</mustBeFirst>
                <characterClass>
                    <value>ABCDEFGHIJKLMNOPQRSTUVWXYZ</value>
                </characterClass>
            </limit>
            <limit>
                <description>Numeric characters</description>
                <name>
                    <t:orig>Numeric characters</t:orig>
                    <t:translation>
                        <t:key>ValuePolicy.numericCharacters</t:key>
                    </t:translation>
                </name>
                <minOccurs>1</minOccurs>
                <mustBeFirst>false</mustBeFirst>
                <characterClass>
                    <value>1234567890</value>
                </characterClass>
            </limit>
            <limit>
                <description>Special characters (allowed when generating)</description>
                <minOccurs>0</minOccurs>
                <mustBeFirst>false</mustBeFirst>
                <characterClass>
                    <value>!$%()+,-.:;&lt;&gt;?@[]^_`{|}~</value>
                </characterClass>
            </limit>
            <limit>
                <description>Special characters (avoided when generating)</description>
                <minOccurs>0</minOccurs>
                <mustBeFirst>false</mustBeFirst>
                <ignoreWhenGenerating>true</ignoreWhenGenerating>
                <characterClass>
                    <value>#&amp; "*'</value>
                </characterClass>
            </limit>
        </limitations>
    </stringPolicy>
</valuePolicy>
