<resource xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
          xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
          xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
          xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3"
          xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
          xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
          xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          oid="75c197a9-1071-4ac8-b8c0-414b1c8eb4f1">
    <name>AD first steps</name>
    <description>AD resource simple example</description>
    <documentation>
        This is a Active Directory resource template for training purposes:
        * It supports accounts (`inetOrgPerson`,`user`,`msDS-ManagedServiceAccount`) and groups (`group`).
        * The resource is configured as outbound (provisioning) with strong outbound mappings.
        * All mappings are by default disabled (lifecycleState=draft), resource itself, object types and synchronization configuration are prepared for simulation (lifecycleState=proposed), where available.
        * Support for group membership association and group creation.
    </documentation>
    <lifecycleState>active</lifecycleState>
    <indestructible>true</indestructible>
    <template>false</template>
    <abstract>false</abstract>
    <connectorRef relation="org:default" type="c:ConnectorType">
        <filter>
            <q:text>connectorType='com.evolveum.polygon.connector.ldap.ad.AdLdapConnector' and available = true</q:text>
        </filter>
    </connectorRef>
    <connectorConfiguration xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3">
        <icfc:connectorPoolConfiguration>
            <icfc:maxObjects>40000</icfc:maxObjects>
        </icfc:connectorPoolConfiguration>
        <icfc:configurationProperties xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.ad.AdLdapConnector">
            <icfcldap:host>test-ad-01.test-ad.lab.evolveum.com</icfcldap:host>
            <!--<icfcldap:port>389</icfcldap:port>-->
            <icfcldap:port>636</icfcldap:port>
            <icfcldap:connectionSecurity>ssl</icfcldap:connectionSecurity>
            <icfcldap:bindDn>CN=MidPoint,CN=Users,DC=test-ad,DC=lab,DC=evolveum,DC=com</icfcldap:bindDn>
            <icfcldap:bindPassword>
                    <t:clearValue>qwe.123</t:clearValue>
            </icfcldap:bindPassword>
            <icfcldap:baseContext>DC=test-ad,DC=lab,DC=evolveum,DC=com</icfcldap:baseContext>
            <icfcldap:pagingStrategy>spr</icfcldap:pagingStrategy>
            <icfcldap:uidAttribute>objectGUID</icfcldap:uidAttribute>
            <icfcldap:operationalAttributes>member</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>memberOf</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>msDS-parentdistname</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>manager</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>managedBy</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>adminDescription</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>groupType</icfcldap:operationalAttributes>
            <icfcldap:operationalAttributes>employeeNumber</icfcldap:operationalAttributes>
            <icfcldap:includeObjectClassFilter>true</icfcldap:includeObjectClassFilter>
            <icfcldap:defaultSearchScope>sub</icfcldap:defaultSearchScope>
            <icfcldap:nativeAdSchema>true</icfcldap:nativeAdSchema>
            <icfcldap:includeObjectCategoryFilter>true</icfcldap:includeObjectCategoryFilter>
            <icfcldap:addDefaultObjectCategory>true</icfcldap:addDefaultObjectCategory>
            <icfcldap:allowFSPProcessing>true</icfcldap:allowFSPProcessing>
        </icfc:configurationProperties>
    </connectorConfiguration>
    <schema>
        <generationConstraints>
            <generateObjectClass>ri:group</generateObjectClass>
            <generateObjectClass>ri:user</generateObjectClass>
        </generationConstraints>
    </schema>
    <schemaHandling>
        <objectType>
            <kind>account</kind>
            <intent>user</intent>
            <displayName>AD Account</displayName>
            <lifecycleState>active</lifecycleState>
            <default>true</default>
            <delineation>
                <objectClass>ri:user</objectClass>
                <searchHierarchyScope>sub</searchHierarchyScope>
            </delineation>
            <focus>
                <type>c:UserType</type>
                <archetypeRef oid="00000000-0000-0000-0000-000000000702" relation="org:default" type="c:ArchetypeType"/>
            </focus>
            <attribute>
                <ref>ri:msDS-parentdistname</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <fetchStrategy>explicit</fetchStrategy>
            </attribute>
            <attribute>
                <ref>ri:employeeNumber</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <fetchStrategy>explicit</fetchStrategy>
                <outbound>
                    <name>set-personalNumber</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>personalNumber</path>
                    </source>
                </outbound>
                <inbound>
                    <name>get-personalNumber</name>
                    <lifecycleState>active</lifecycleState>
                    <condition>
                        <script>
                            <code>
                                return input != null
                            </code>
                        </script>
                    </condition>
                    <target>
                        <path>personalNumber</path>
                    </target>
                    <!--if used in correlation rule uncomment-->
                    <!--<use>correlation</use>-->
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:dn</ref>
                <displayName>Distinguished Name</displayName>
                <modificationPriority>0</modificationPriority>
                <secondaryIdentifier>true</secondaryIdentifier>
                <volatilityTrigger>true</volatilityTrigger>
                <displayNameAttribute>true</displayNameAttribute>
                <outbound>
                    <name>set-dn</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>$focus/fullName</path>
                    </source>
                    <source>
                        <path>$focus/name</path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                import com.evolveum.midpoint.util.exception.ExpressionEvaluationException
                                import com.evolveum.midpoint.util.exception.ObjectNotFoundException
                                String baseContext
                                String errorMsg
                                try {
                                    try {
                                        baseContext = basic.getResourceIcfConfigurationPropertyValue(resource, 'baseContext')
                                    } catch ( ObjectNotFoundException onf){
                                        errorMsg = "Empty \"Base Context\" attribute in resource configuration. Non empty value is required.\n" + onf.getMessage()
                                        log.error(errorMsg)
                                        throw new ObjectNotFoundException(errorMsg)
                                    }
                                    String fullNameVar
                                    if(midpoint.isUniquePropertyValue(focus, "fullName", fullName.toString())){
                                        fullNameVar =  fullName.toString()
                                    } else {
                                        fullNameVar = fullName.toString() + "(" + name.toString() + ")"
                                    }
                                    /*change DN suffix regarding to your deployment*/
                                    return basic.composeDnWithSuffix('CN', fullNameVar, "OU","Users","OU","FirstSteps", baseContext)
                                } catch (ExpressionEvaluationException expErr) {
                                    errorMsg = "Failed return value in outbound expression of attribute in resource configuration.\n" + expErr.getMessage()
                                    log.error(errorMsg)
                                    throw new ExpressionEvaluationException(errorMsg)
                                }
                            </code>
                        </script>
                    </expression>
                </outbound>
                <inbound>
                    <name>get-lifecycleState</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <expression>
                        <variable>
                            <name>effectiveStatus</name>
                            <path>$shadow/activation/effectiveStatus</path>
                        </variable>
                        <variable>
                            <name>administrativeStatus</name>
                            <path>$shadow/activation/administrativeStatus</path>
                        </variable>
                        <script>
                            <code>import com.evolveum.midpoint.xml.ns._public.common.common_3.ActivationStatusType;
                                import com.evolveum.midpoint.schema.constants.SchemaConstants
                                if (administrativeStatus == ActivationStatusType.ENABLED){
                                    return SchemaConstants.LIFECYCLE_ACTIVE
                                } else if (administrativeStatus == ActivationStatusType.DISABLED) {
                                    return SchemaConstants.LIFECYCLE_ACTIVE
                                }</code>
                        </script>
                    </expression>
                    <target>
                        <path>lifecycleState</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null  &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:sAMAccountName</ref>
                <displayName>Login name</displayName>
                <limitations>
                    <minOccurs>1</minOccurs>
                    <maxOccurs>1</maxOccurs>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <modificationPriority>0</modificationPriority>
                <secondaryIdentifier>true</secondaryIdentifier>
                <outbound>
                    <name>set-sAMAccountName</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <source>
                        <path>$focus/name</path>
                    </source>
                </outbound>
                <inbound>
                    <name>get-name</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>name</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null  &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </inbound>
                <inbound>
                    <name>get-name-correlation</name>
                    <lifecycleState>active</lifecycleState>
                    <target>
                        <path>name</path>
                    </target>
                    <use>correlation</use>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:sn</ref>
                <limitations>
                    <minOccurs>0</minOccurs>
                    <maxOccurs>1</maxOccurs>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <outbound>
                    <name>set-sn</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>familyName</path>
                    </source>
                    <condition>
                        <script>
                            <code>familyName!=null &amp;&amp; !familyName.isEmpty() &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
                <inbound>
                    <name>get-familyName</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>familyName</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:givenName</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <name>set-givenName</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>givenName</path>
                    </source>
                    <condition>
                        <script>
                            <code>givenName!=null &amp;&amp; !givenName.isEmpty() &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
                <inbound>
                    <name>get-givenName</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>givenName</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:displayName</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <name>set-displayName</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <source>
                        <path>fullName</path>
                    </source>
                    <condition>
                        <script>
                            <code>fullName!=null &amp;&amp; !fullName.isEmpty() &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:cn</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <name>set-cn</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>fullName</path>
                    </source>
                    <source>
                        <path>$focus/name</path>
                    </source>
                    <expression>
                        <script>
                            <code>String fullNameVar
                                    if(midpoint.isUniquePropertyValue(focus, "fullName", fullName.toString())){
                                        fullNameVar =  fullName.toString()
                                    } else {
                                        fullNameVar = fullName.toString() + "(" + name.toString() + ")"
                                    }
                                    return fullNameVar</code>
                        </script>
                    </expression>
                    <condition>
                        <script>
                            <code>fullName!=null &amp;&amp; !fullName.isEmpty() &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
                <inbound>
                    <name>get-cn</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>fullName</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:title</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <name>set-title</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>title</path>
                    </source>
                    <condition>
                        <script>
                            <code>title!=null &amp;&amp; !title.isEmpty() &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
                <inbound>
                    <name>get-title</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>title</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:userPrincipalName</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <modificationPriority>0</modificationPriority>
                <secondaryIdentifier>true</secondaryIdentifier>
                <outbound>
                    <name>set-userPrincipalName</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <source>
                        <path>emailAddress</path>
                    </source>
                    <source>
                        <path>name</path>
                    </source>
                    <expression>
                        <script>
                            <includeNullInputs>false</includeNullInputs>
                            <code>
                                import com.evolveum.midpoint.util.exception.ExpressionEvaluationException
                                import com.evolveum.midpoint.util.exception.ObjectNotFoundException

                                String baseContext
                                String errorMsg
                                String returnValue
                                try {
                                    try {
                                        baseContext = basic.getResourceIcfConfigurationPropertyValue(resource, 'baseContext')
                                    } catch ( ObjectNotFoundException onf){
                                        errorMsg = "Empty \"Base Context\" attribute in resource configuration. Non empty value is required.\n" + onf.getMessage()
                                        log.error(errorMsg)
                                        throw new ObjectNotFoundException(errorMsg)
                                    }
                                    baseContext = baseContext.replaceAll("DC=","").replaceAll(",",".")
                                    returnValue = basic.concatName(name.toString()+"@"+baseContext)
                                    return returnValue
                                } catch (ExpressionEvaluationException expErr) {
                                    errorMsg = "Unable to construct userPrincipalName.\n" + expErr.getMessage()
                                    log.error(errorMsg)
                                    throw new ExpressionEvaluationException(errorMsg)
                                }
                            </code>
                        </script>
                    </expression>
                    <condition>
                        <script>
                            <code>name!=null &amp;&amp; emailAddress!=null &amp;&amp; !emailAddress.isEmpty() &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:mail</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <modificationPriority>0</modificationPriority>
                <secondaryIdentifier>true</secondaryIdentifier>
                <inbound>
                    <name>get-mail</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>emailAddress</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </inbound>
                <outbound>
                    <name>set-mail</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>emailAddress</path>
                    </source>
                    <condition>
                        <script>
                            <code>emailAddress!=null &amp;&amp; !emailAddress.isEmpty() &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:pwdLastSet</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <fetchStrategy>explicit</fetchStrategy>
                <outbound>
                    <name>set-reset-password</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <expression>
                        <script>
                            <code>
                                // -1 next logon reset password required
                                // 0 no previous loggon
                                return "-1"
                            </code>
                        </script>
                    </expression>
                    <condition>
                        <script>
                            <code>"add".equals(operation.toString()) &amp;&amp; midpoint.isEvaluateNew()</code>
                        </script>
                    </condition>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:createTimeStamp</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <fetchStrategy>explicit</fetchStrategy>
                <inbound>
                    <name>get-validFrom</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <name>validFrom</name>
                        <path>activation/validFrom</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:accountExpires</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <fetchStrategy>explicit</fetchStrategy>
                <outbound>
                    <name>set-accountExpires</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <name>validTo</name>
                        <path>activation/validTo</path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                def longDate
                                if(validTo!=null){
                                    def gc = validTo.toGregorianCalendar()
                                    def offset = 11644560000000
                                    longDate = (gc.getTimeInMillis() + offset)*10000
                                }
                                else {
                                    longDate = "9223372036854775807"
                                }
                                return longDate.toString()
                            </code>
                        </script>
                    </expression>
                </outbound>
            </attribute>
            <attribute>
                <ref>ri:nTSecurityDescriptor</ref>
                <limitations>
                    <minOccurs>0</minOccurs>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <fetchStrategy>explicit</fetchStrategy>
            </attribute>
            <attribute>
                <ref>ri:instanceType</ref>
                <limitations>
                    <minOccurs>0</minOccurs>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <fetchStrategy>explicit</fetchStrategy>
            </attribute>
            <attribute>
                <ref>ri:company</ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <inbound>
                    <name>get-company</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>organization</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:ou</ref>
                <limitations>
                    <minOccurs>0</minOccurs>
                    <maxOccurs>1</maxOccurs>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <matchingRule xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3">mr:stringIgnoreCase</matchingRule>
                <inbound>
                    <name>get-ou</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>weak</strength>
                    <target>
                        <path>organizationalUnit</path>
                    </target>
                    <condition>
                        <script>
                            <code>input != null</code>
                        </script>
                    </condition>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:memberOf</ref>
                <fetchStrategy>explicit</fetchStrategy>
            </attribute>
            <attribute>
                <ref>ri:l</ref>
                <outbound>
                    <name>set-locality</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>$focus/locality</path>
                    </source>
                </outbound>
                <inbound>
                    <name>get-locality</name>
                    <strength>weak</strength>
                    <lifecycleState>active</lifecycleState>
                    <target>
                        <path>locality</path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <ref>ri:initials</ref>
                <outbound>
                    <name>mapping-initials</name>
                    <lifecycleState>active</lifecycleState>
                    <strength>strong</strength>
                    <source>
                        <path>$focus/givenName</path>
                    </source>
                    <source>
                        <path>$focus/familyName</path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                basic.uc(basic.stringify(givenName)?.take(1) + basic.stringify(familyName)?.take(1))
                            </code>
                        </script>
                    </expression>
                </outbound>
            </attribute>
            <protected>
                <filter>
                    <q:text>attributes/dn contains[stringIgnoreCase] ",cn=builtin,"</q:text>
                </filter>
            </protected>
            <protected>
                <filter>
                    <q:text>attributes/dn contains[stringIgnoreCase] "cn=administrator,cn=users,"</q:text>
                </filter>
            </protected>
            <protected>
                <filter>
                    <q:text>attributes/dn contains[stringIgnoreCase] "cn=guest,cn=users,"</q:text>
                </filter>
            </protected>
            <protected>
                <filter>
                    <q:text>attributes/dn contains[stringIgnoreCase] "cn=midpoint,cn=users,"</q:text>
                </filter>
            </protected>
            <protected>
                <filter>
                    <q:text>attributes/dn contains[stringIgnoreCase] "cn=krbtgt,cn=users,"</q:text>
                </filter>
            </protected>
            <protected>
                <filter>
                    <q:text>attributes/dn contains[stringIgnoreCase] ",cn=managed service accounts,"</q:text>
                </filter>
            </protected>
            <activation>
                <existence/>
                <administrativeStatus>
                    <outbound>
                        <name>set-account-status-based-on-midpoint-user</name>
                        <lifecycleState>active</lifecycleState>
                        <strength>strong</strength>
                    </outbound>
                </administrativeStatus>
                <disableInsteadOfDelete>
                    <lifecycleState>active</lifecycleState>
                </disableInsteadOfDelete>
                <delayedDelete>
                    <lifecycleState>active</lifecycleState>
                    <deleteAfter>PT2M</deleteAfter>
                </delayedDelete>
            </activation>
            <credentials>
                <password>
                    <outbound>
                        <name>passwd-change</name>
                        <lifecycleState>suspended</lifecycleState>
                        <description>Copy password from midPoint when changed</description>
                        <strength>normal</strength>
                    </outbound>
                    <outbound>
                        <name>passwd-initial</name>
                        <strength>weak</strength>
                        <lifecycleState>suspended</lifecycleState>
                        <expression>
                            <generate>
                                <valuePolicyRef oid="00000000-0000-0000-0000-000000000003" xsi:type="c:ObjectReferenceType"/>
                            </generate>
                        </expression>
                    </outbound>
                </password>
            </credentials>
            <correlation>
                <correlators>
                    <items>
                        <name>personalNumber-correlation</name>
                        <description>Correlation using personalNumber. Please note: inbound mapping for personalNumber is used only during correlation.</description>
                        <enabled>false</enabled>
                        <item>
                            <ref>personalNumber</ref>
                        </item>
                        <composition>
                            <tier>21</tier>
                        </composition>
                    </items>
                    <items>
                        <name>samAccountName-correlation</name>
                        <enabled>true</enabled>
                        <item>
                            <ref>c:name</ref>
                            <search>
                                <matchingRule>polyStringOrig</matchingRule>
                            </search>
                        </item>
                        <composition>
                            <tier>2</tier>
                        </composition>
                    </items>
                </correlators>
            </correlation>
            <synchronization>
                <reaction>
                    <name>set-linked</name>
                    <lifecycleState>active</lifecycleState>
                    <situation>linked</situation>
                    <actions>
                        <synchronize/>
                    </actions>
                </reaction>
                <reaction>
                    <name>set-unlinked</name>
                    <lifecycleState>active</lifecycleState>
                    <situation>unlinked</situation>
                    <actions>
                        <link/>
                    </actions>
                </reaction>
                <reaction>
                    <name>set-unmatched</name>
                    <lifecycleState>active</lifecycleState>
                    <situation>unmatched</situation>
                    <actions>
                        <addFocus/>
                    </actions>
                </reaction>
                <reaction>
                    <name>set-deleted</name>
                    <lifecycleState>active</lifecycleState>
                    <situation>deleted</situation>
                    <actions>
                        <inactivateResourceObject/>
                        <synchronize/>
                    </actions>
                </reaction>
                <reaction>
                    <name>set-disputed</name>
                    <lifecycleState>active</lifecycleState>
                    <situation>disputed</situation>
                    <actions>
                        <createCorrelationCase/>
                    </actions>
                </reaction>
            </synchronization>
        </objectType>
    </schemaHandling>
    <capabilities>
        <native xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3">
            <cap:schema/>
            <cap:discoverConfiguration/>
            <cap:activation>
                <cap:status/>
            </cap:activation>
            <cap:credentials>
                <cap:password>
                    <cap:returnedByDefault>false</cap:returnedByDefault>
                </cap:password>
            </cap:credentials>
            <cap:liveSync/>
            <cap:create/>
            <cap:read>
                <cap:returnDefaultAttributesOption>true</cap:returnDefaultAttributesOption>
            </cap:read>
            <cap:update>
                <cap:delta>true</cap:delta>
                <cap:addRemoveAttributeValues>true</cap:addRemoveAttributeValues>
            </cap:update>
            <cap:delete/>
            <cap:testConnection/>
            <cap:script>
                <cap:host>
                    <cap:type>connector</cap:type>
                </cap:host>
            </cap:script>
            <cap:pagedSearch/>
            <cap:auxiliaryObjectClasses/>
        </native>
    </capabilities>
    <consistency>
        <avoidDuplicateValues>true</avoidDuplicateValues>
        <shadowConstraintsCheck>light</shadowConstraintsCheck>
        <avoidDuplicateOperations>true</avoidDuplicateOperations>
        <validateSchema>true</validateSchema>
        <caseIgnoreAttributeNames>true</caseIgnoreAttributeNames>
        <discovery>true</discovery>
        <deadShadowRetentionPeriod>PT0H</deadShadowRetentionPeriod>
    </consistency>
    <business>
        <administrativeState>enabled</administrativeState>
        <approverRef oid="00000000-0000-0000-0000-00000000000a" relation="org:default" type="c:RoleType"/>
        <ownerRef oid="00000000-0000-0000-0000-000000000002" relation="org:default" type="c:UserType"/>
        <operatorRef oid="00000000-0000-0000-0000-00000000000b" relation="org:default" type="c:RoleType"/>
        <correlatorRef oid="00000000-0000-0000-0000-000000000004" relation="org:default" type="c:RoleType"/>
    </business>
</resource>
