<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2017-2019 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<objects xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
         xmlns:c='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
         xmlns:org='http://midpoint.evolveum.com/xml/ns/public/common/org-3'
         xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
         xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">

    <role oid="08bd752e-1cf1-11e6-90a3-a3ad27be3da2">
        <name>System Administrator</name>
        <description>Permission to access the system with system administrator privileges. Non-requestable role. This role has to be explicitly assigned by IDM administrator.</description>
        <requestable>false</requestable>
        <subtype>operational</subtype>
    </role>

    <role oid="a04fd258-ce0a-11e7-819c-435b398f7636">
        <name>Business Metarole</name>
        <description>Metarole for business roles.</description>
        <inducement>
            <policyRule>
                <policyConstraints>
                    <assignment/>
                </policyConstraints>
                <policyActions>
                    <approval>
                        <approvalSchema>
                            <stage>
                                <name>Line managers</name>
                                <approverExpression>
                                    <script>
                                        <code>midpoint.getManagersOidsExceptUser(object)</code>
                                    </script>
                                </approverExpression>
                                <evaluationStrategy>firstDecides</evaluationStrategy>
                                <outcomeIfNoApprovers>reject</outcomeIfNoApprovers>
                            </stage>
                            <stage>
                                <name>Role approvers</name>
                                <approverRelation>approver</approverRelation>
                                <evaluationStrategy>firstDecides</evaluationStrategy>
                                <outcomeIfNoApprovers>reject</outcomeIfNoApprovers>
                            </stage>
                        </approvalSchema>
                    </approval>
                </policyActions>
            </policyRule>
        </inducement>
        <subtype>meta</subtype>
    </role>

    <role oid="9ff31e4c-1cf3-11e6-bc5d-0727c08b96ed">
        <name>Contributor</name>
        <description>Contributor to Evolveum projects. Requestable role with an approver.</description>
        <assignment>
            <targetRef oid="a04fd258-ce0a-11e7-819c-435b398f7636" type="RoleType" /> <!-- Business metarole -->
        </assignment>
        <inducement>
            <description>Automatically include write privileges to the wiki.</description>
            <targetRef oid="08bd752e-1cf1-11e6-90a3-a3ad27be3da2" type="RoleType" /> <!-- Wiki Contributor -->
        </inducement>
        <requestable>true</requestable>
        <subtype>business</subtype>
    </role>

    <role oid="a73b0386-1cf3-11e6-ac6e-dfedc87cdda3">
        <name>Blogger</name>
        <description>Author of Evolveum blog posts. Requestable role with an approver.</description>
        <assignment>
            <targetRef oid="a04fd258-ce0a-11e7-819c-435b398f7636" type="RoleType" /> <!-- Business metarole -->
        </assignment>
        <requestable>true</requestable>
        <subtype>business</subtype>
    </role>

    <role oid="ad1fd0ce-1cf3-11e6-8a68-fbf7c6fc2f97">
        <name>Wiki Contributor</name>
        <description>Write access to the wiki. This role is requestable, but it has no approver. Therefore anyone requesting it will get it automatically.</description>
        <requestable>true</requestable>
        <subtype>application</subtype>
    </role>

    <role oid="b613c706-3889-11e6-b175-d78cc67d7066">
        <name>Delegated Identity Administrator</name>
        <description>Allows full identity administration for organizations where the user is a manager.</description>
        <assignment>
            <policyRule>
                <name>identity administrator exclusion</name>
                <policyConstraints>
                    <exclusion>
                        <targetRef oid="7750ef7a-4a04-11e7-af32-638f754f4ddf" type="RoleType"/> <!-- Auditor -->
                    </exclusion>
                </policyConstraints>
                <policyActions>
                    <enforcement/>
                </policyActions>
            </policyRule>
        </assignment>
        <authorization>
            <name>gui-access</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#usersAll</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgAll</action>
        </authorization>
        <authorization>
            <name>autz-read</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <orgRelation>
                    <subjectRelation>org:manager</subjectRelation>
                    <scope>allDescendants</scope>
                    <includeReferenceOrg>true</includeReferenceOrg>
                </orgRelation>
            </object>
        </authorization>
        <authorization>
            <name>autz-write</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
            <object>
                <orgRelation>
                    <subjectRelation>org:manager</subjectRelation>
                </orgRelation>
            </object>
        </authorization>
        <authorization>
            <name>autz-shadow</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
            <object>
                <type>ShadowType</type>
                <owner>
                    <orgRelation>
                        <subjectRelation>org:manager</subjectRelation>
                    </orgRelation>
                </owner>
            </object>
        </authorization>
        <subtype>application</subtype>
    </role>

    <role oid="9ebe365e-baf7-11e6-bf9d-8b7318f64996">
        <name>Weak Identity Administrator</name>
        <description>Allows some identity administration.</description>
        <authorization>
            <name>gui-access</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#usersAll</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgAll</action>
        </authorization>
        <authorization>
            <name>autz-read</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <item>c:name</item>
            <item>fullName</item>
            <item>activation/administrativeStatus</item>
            <item>activation/effectiveStatus</item>
            <item>activation/validFrom</item>
            <item>activation/validTo</item>
            <item>assignment</item>
        </authorization>
        <authorization>
            <name>modify some</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <object>
                <type>UserType</type>
            </object>
            <item>description</item>
            <item>activation/administrativeStatus</item>
            <item>activation/validFrom</item>
            <item>activation/validTo</item>
        </authorization>
        <authorization>
            <name>modify-some-operational-exec</name>
            <description>Required, these are operational properties that midPoint changes automatically</description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <phase>execution</phase>
            <object>
                <type>UserType</type>
            </object>
            <item>activation/validityStatus</item>
            <item>activation/validityChangeTimestamp</item>
            <item>activation/effectiveStatus</item>
            <item>activation/disableTimestamp</item>
            <item>activation/disableReason</item>
            <item>activation/enableTimestamp</item>
            <item>activation/archiveTimestamp</item>
            <item>activation/validityChangeTimestamp</item>
        </authorization>
        <subtype>application</subtype>
    </role>

    <!-- JOB Roles -->

    <role oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2">
        <name>Employee</name>
        <description>Basic employee role</description>
        <inducement>
            <description>Automatically include privilege to access midPoint end-user GUI.</description>
            <targetRef oid="d032653c-ce0d-11e7-a372-87f071f39cab" type="RoleType" /> <!-- Evolveum End User -->
        </inducement>
        <inducement>
            <description>Automatically assign employee LDAP account.</description>
            <construction>
                <resourceRef oid="28b699cc-107c-11e6-8277-034841879377"/> <!-- LDAP resource -->
                <kind>account</kind>
            </construction>
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>


    <role oid="7b6f2704-07ea-11e7-8ca4-eba3d9df42bb">
        <name>CEO</name>
        <description>Chief Executive Officer</description>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <inducement>
            <targetRef oid="b70d8ae8-cf96-11e7-9fed-cb4449227dd2" type="RoleType" /> <!-- Management Responsibility -->
        </inducement>
        <inducement>
            <targetRef oid="5d516f6e-cf97-11e7-97d6-6fb8d2e8c59f" type="RoleType" /> <!-- Addresssbook Maintenance Responsibility -->
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="a12c11c8-07ea-11e7-bd69-bf7bb8c15360">
        <name>Software Architect</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <inducement>
            <targetRef oid="ae97e3fa-07ea-11e7-a354-13b959d5572d" type="RoleType" /> <!-- Software Developer -->
        </inducement>
        <inducement>
            <targetRef oid="b70d8ae8-cf96-11e7-9fed-cb4449227dd2" type="RoleType" /> <!-- Management Responsibility -->
        </inducement>
        <inducement>
            <targetRef oid="5d516f6e-cf97-11e7-97d6-6fb8d2e8c59f" type="RoleType" /> <!-- Addresssbook Maintenance Responsibility -->
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="ae97e3fa-07ea-11e7-a354-13b959d5572d">
        <name>Software Developer</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <inducement>
            <description>LDAP devel group</description>
            <construction>
                <resourceRef oid="28b699cc-107c-11e6-8277-034841879377"/> <!-- LDAP resource -->
                <kind>account</kind>
                <association>
                    <ref>ri:ldapGroup</ref>
                    <outbound>
                        <expression>
                            <associationTargetSearch>
                                <filter>
                                    <q:text>attributes/cn = "devel"</q:text>
                                </filter>
                                <searchStrategy>onResource</searchStrategy>
                            </associationTargetSearch>
                        </expression>
                    </outbound>
                </association>
            </construction>
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="d161eb4c-07ea-11e7-9ef9-4720a07d67c8">
        <name>IDM Engineer</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="e774a9c4-07ea-11e7-99b1-bb2574fc17b7">
        <name>Accountant</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="ef9f0be4-07ea-11e7-aa44-27bf6e51efa9">
        <name>Marketing Specialist</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="f618e68e-07ea-11e7-b049-93c0d71b481a">
        <name>Assistant</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="2015685e-07eb-11e7-9508-6ba358bcb10c">
        <name>Project Manager</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <inducement>
            <targetRef oid="b70d8ae8-cf96-11e7-9fed-cb4449227dd2" type="RoleType" /> <!-- Management Responsibility -->
        </inducement>
        <requestable>false</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="7750ef7a-4a04-11e7-af32-638f754f4ddf">
        <name>Auditor</name>
        <inducement>
            <targetRef oid="2e242b4c-07f5-11e7-9369-83a5c3b84cb2" type="RoleType" /> <!-- Employee -->
        </inducement>
        <assignment>
            <policyRule>
                <name>auditor exclusion</name>
                <policyConstraints>
                    <exclusion>
                        <targetRef oid="b613c706-3889-11e6-b175-d78cc67d7066" type="RoleType"/> <!-- Delegated identity administrator -->
                    </exclusion>
                </policyConstraints>
                <policyActions>
                    <enforcement/>
                </policyActions>
            </policyRule>
        </assignment>
        <requestable>true</requestable>
        <subtype>job</subtype>
    </role>

    <role oid="b70d8ae8-cf96-11e7-9fed-cb4449227dd2">
        <name>Management Responsibility</name>
        <inducement>
            <targetRef oid="00000000-0000-0000-0000-00000000000c" type="RoleType" /> <!-- Delegator -->
        </inducement>
        <requestable>false</requestable>
        <subtype>responsibility</subtype>
    </role>

    <role oid="5d516f6e-cf97-11e7-97d6-6fb8d2e8c59f">
        <name>Addressbook Maintenance Responsibility</name>
        <requestable>false</requestable>
        <delegable>true</delegable>
        <subtype>responsibility</subtype>
        <authorization>
            <name>addressbook-maintenance</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <object>
                <type>UserType</type>
            </object>
            <item>telephoneNumber</item>
            <item>locality</item>
        </authorization>
    </role>

    <role oid="d032653c-ce0d-11e7-a372-87f071f39cab"
          xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
          xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
        <name>Evolveum End User</name>
        <description>Role authorizing end users to log in, change their passwords and review assigned accounts.</description>
        <authorization>
            <name>eeu-gui-self-service-access</name>
            <description>
                Allow access to all self-service operations in GUI.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll</action>
        </authorization>
        <authorization>
            <name>eeu-read-users</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>UserType</type>
            </object>
            <item>name</item>
            <item>fullName</item>
            <item>givenName</item>
            <item>familyName</item>
        </authorization>
        <authorization>
            <name>eeu-read-roles</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>RoleType</type>
            </object>
            <item>name</item>
            <item>description</item>
            <item>identifier</item>
            <item>displayName</item>
            <item>subtype</item>
        </authorization>
        <authorization>
            <name>eeu-workflow-end-user</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#myRequests</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#requestsAboutMe</action>
        </authorization>
        <authorization>
            <name>eeu-self-read</name>
            <description>
                Allow to read all the properties of "self" object. I.e. every logged-in user can read
                object that represent his own identity.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <special>self</special>
            </object>
        </authorization>
        <authorization>
            <name>eeu-self-shadow-read</name>
            <description>
                Allow to read all the properties of all the shadows that belong to "self" object.
                I.e. every logged-in user can read all his accounts.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>ShadowType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <name>eeu-self-persona-read</name>
            <description>
                Allow to read all the personas of currently logged-in user.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>UserType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <name>eeu-self-credentials-request</name>
            <description>
                Allow to modify user's own credentials.
                Note that this is a request phase authorization. It also requires corresponding execution-phase authorization.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
            <phase>request</phase>
            <object>
                <special>self</special>
            </object>
            <item>credentials</item>
        </authorization>
        <authorization>
            <name>eeu-self-shadow-credentials-request</name>
            <description>
                Allow to modify credentials of all users accounts.
                Note that this is a request phase authorization. It also requires corresponding execution-phase authorization.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
            <phase>request</phase>
            <object>
                <type>ShadowType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
            <item>credentials</item>
        </authorization>
        <authorization>
            <name>eeu-assign-requestable-roles</name>
            <description>
                Allow to assign requestable roles. This allows to request roles in a request-and-approve process.
                The requestable roles will be displayed in the role request dialog by default.
                Please note that the roles also need an approved definition to go through the approval process.
                Otherwise they will be assigned automatically wihout any approval.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
            <phase>request</phase>
            <object>
                <special>self</special>
            </object>
            <target>
                <type>RoleType</type>
                <filter>
                    <q:text>requestable = true</q:text>
                </filter>
            </target>
        </authorization>
        <authorization>
            <name>eeu-self-execution-modify</name>
            <description>
                Authorization that allows to self-modification of some properties, but only in execution phase.
                The limitation real limitation of these operations is done in the request phase.
                E.g. the modification of assignments is controlled in the request phase by using the #assign
                authorization.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <phase>execution</phase>
            <object>
                <special>self</special>
            </object>
            <item>credentials</item>
            <item>assignment</item>
        </authorization>
        <authorization>
            <name>eeu-self-shadow-execution-add-modify-delete</name>
            <description>
                Authorization that allows to self-modification of user's accounts, but only in execution phase.
                The real limitation of these operations is done in the request phase.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
            <phase>execution</phase>
            <object>
                <type>ShadowType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <name>eeu-assignment-target-read</name>
            <description>
                Authorization that allows to read all the object that are possible assignment targets. We want that
                to display the targets in the selection windows.
                Note that this authorization may be too broad for production use. Normally it should be limited to just
                selected properties such as name and description.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>OrgType</type>
            </object>
            <object>
                <type>ResourceType</type>
            </object>
            <object>
                <type>RoleType</type>
            </object>
            <object>
                <type>ServiceType</type>
            </object>
        </authorization>
        <authorization>
            <name>eeu-assignment-target-read-case</name>
            <description>
                Authorization that allows to read workflow status of tasks. This is used to display requests
                to the end users, especially in the "My Requests" box in user dashboard.
                This authorization is a temporary solution. It will be replaced by a finer-grained
                permissions in the future.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>CaseType</type>
            </object>
            <item>approvalContext</item>
        </authorization>
        <authorization>
            <name>eeu-self-owned-task-read</name>
            <description>
                Authorization that allows to see all tasks owned by a currently logged-in user.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>TaskType</type>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <authorization>
            <!-- TODO fix this (does not work with activity-based tasks) -->
            <name>eeu-self-owned-task-add-execute-changes</name>
            <description>
                Authorization to create a new 'execute changes' task owned by a currently logged-in user.
                This is needed to execute asynchronous operations from the GUI.
            </description>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
            <object>
                <type>TaskType</type>
                <filter>
                    <q:text>handlerUri = "http://midpoint.evolveum.com/xml/ns/public/model/synchronization/task/execute/handler-3"</q:text>
                </filter>
                <owner>
                    <special>self</special>
                </owner>
            </object>
        </authorization>
        <subtype>operational</subtype>
    </role>

    <role oid="8d93aef4-d4f0-11e7-85ee-5728c3e3ca7d">
        <name>Limited midPoint administrator</name>
        <authorization>
            <name>ladmin-ui-all</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#all</action>
        </authorization>
        <authorization>
            <name>ladmin-read-users</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>UserType</type>
            </object>
        </authorization>
        <authorization>
            <name>ladmin-read-roles</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
            <object>
                <type>RoleType</type>
            </object>
        </authorization>
        <authorization>
            <name>ladmin-raw</name>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#rawOperation</action>
        </authorization>
        <subtype>operational</subtype>
    </role>

</objects>
