<?xml version="1.0" encoding="UTF-8" standalone="no"?><!--
  ~ Copyright (C) 2010-2023 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  --><xsd:schema xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:jaxb="https://jakarta.ee/xml/ns/jaxb" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3" xmlns:s="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3" xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3" xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc" elementFormDefault="qualified" jaxb:extensionBindingPrefixes="xjc" jaxb:version="3.0" targetNamespace="http://midpoint.evolveum.com/xml/ns/public/common/common-3">

    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/annotation-3" schemaLocation="../annotation-3.xsd"/>
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/types-3" schemaLocation="../types-3.xsd"/>
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/query-3" schemaLocation="../query-3.xsd"/>
    <xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/model/scripting-3" schemaLocation="../model/scripting/scripting-3.xsd"/>
    <xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3" schemaLocation="../resource/capabilities-3.xsd"/>
    <xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" schemaLocation="../connector/icf-1/resource-schema-3.xsd"/>

    <xsd:include schemaLocation="common-model-context-3.xsd"/>
    <xsd:include schemaLocation="common-certification-3.xsd"/>
    <xsd:include schemaLocation="common-notifications-3.xsd"/>
    <xsd:include schemaLocation="common-asynchronous-3.xsd"/>
    <xsd:include schemaLocation="common-workflows-3.xsd"/>
    <xsd:include schemaLocation="common-tasks-3.xsd"/>
    <xsd:include schemaLocation="common-policy-3.xsd"/>
    <xsd:include schemaLocation="common-case-management-3.xsd"/>
    <xsd:include schemaLocation="common-security-3.xsd"/>
    <xsd:include schemaLocation="common-metadata-3.xsd"/>
    <xsd:include schemaLocation="common-gui-3.xsd"/>
    <xsd:include schemaLocation="common-provisioning-3.xsd"/>
    <xsd:include schemaLocation="common-correlation-3.xsd"/>
    <xsd:include schemaLocation="common-simulations-3.xsd"/>
    <xsd:include schemaLocation="common-mining-3.xsd"/>

    <!-- ################################## -->
    <!-- ##      Common Schema Layer     ## -->
    <!-- ################################## -->

    <!-- See https://docs.evolveum.com/midpoint/architecture/archive/data-model/midpoint-common-schema/ -->

    <xsd:element name="displayName" type="xsd:string">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                Human readable name. This name may be displayed in tools and GUIs
                to provide more pleasant user experience, as the XML data type names
                or object names may look quite frightening.</p>

                <p>
                The "displayName" should contain a value that is readable for almost any
                user. It is never used in the "logic", it is used only for display purposes.
                </p>

                <p>
                The use of national characters is in "displayName" is fully supported.
                </p>

                <p>
                DisplayName is reused in several location, but the meaning is still the same.
                </p>
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>

    <xsd:element name="description" type="xsd:string">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Free-form textual description of the object. It is supposed to describe
                    the object or a construct that it is attached to.
                </p>
                <p>
                    This information may be presented to midPoint users, even to ordinary end users.
                    For example role description may be presented to users when they are selecting
                    roles to request. Therefore the description should be written in a language that
                    the users can understand.
                </p>
                <p>
                    Description is assumed to be a plan, non-formatted text.
                    Amount of white space is considered insignificant. E.g. leading and trailing
                    white space may be skipped, multiple spaces can be collapsed to one and so on.
                </p>
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>

    <xsd:element name="documentation" type="xsd:string">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Technical documentation for a particular object or construct.
                </p>
                <p>
                    The purpose of this element is to document system configuration and behavior.
                    The documentation will not be presented to end users. In fact, it will probably
                    not be presented at all in midPoint user interface. This documentation element
                    is supposed to be a part of the technical documentation of midPoint deployment.
                    The tools than generate deployment configuration will look for these elements
                    and combine them to compiled documentation document.
                </p>
                <p>
                    AsciiDoc formatting is assumed for this element. Any leading or trailing
                    whitespace is skipped. Indentation equivalent to he indentation of the first
                    non-blank line of text is also skipped.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
    </xsd:element>

    <xsd:element default="false" name="ignore" type="xsd:boolean">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                Presence of this element signifies that the structure that contains it should
                be ignored. If this element is present in the attribute definition, the attribute
                should be ignored. If it appears in the object class definition, the entire object
                class should be ignored. "Ignored" means that the system should pretend that the
                structure does not exist at all.
                </p>
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>

    <xsd:element name="lifecycleState" type="xsd:string">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Lifecycle state of the object. This property defines whether the
                    object represents a draft, proposed definition, whether it is active,
                    deprecated, archived, and so on. See "Object Lifecycle" in the documentation.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.5</a:since>
                <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000230" type="tns:LookupTableType"/>
            </xsd:appinfo>
        </xsd:annotation>
    </xsd:element>

    <!-- Basic Object Types -->

    <xsd:complexType abstract="true" name="ObjectType">

        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Common supertype for all identity objects. Defines basic properties
                    that each object must have to live in our system (identifier, name).
                </p>
                <p>
                    All objects are identified by OID. The OID is an immutable identifier
                    (usually UUID). Except the OID all the objects have human-readable name.
                    The name is usually unique for each object type, but this is not a
                    strict requirement.
                </p>
                <p>
                    Note: object type is fixed, it cannot be changed. The object retains its
                    type from the time it was created to the end of its life.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:object/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="t:ObjectType">
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="t:PolyStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Human-readable, mutable name of the object. It
                            may also be an identifier (login name, group name).
                            It is usually unique in the respective context of
                            interpretation. E.g. the name of the UserType subtype
                            is usually unique in the whole system.
                            The name of the ShadowType subtype is usually unique in the
                            scope of resource (target system) that it belongs to.
                        </p>

                        <p>
                            The name may not be human-readable in a sense to display
                            to a common end-user. It is intended to be displayed to
                            IDM system administrator. Therefore it may contain quite
                            a "ugly" structures such as LDAP DN or URL.
                        </p>

                        <p>
                            Name is mutable. It is considered to be ordinary property
                            of the object. Therefore it can be changed by invoking
                            usual modifyObject operations. However, change of the name
                            may have side effects (rename process).
                        </p>


                        <p>
                            Although name is specified as optional by this schema, it
                            is in fact mandatory for most object types. The reason for
                            specifying the name as optional is that the name may be
                            generated by the system instead of supplied by the clients.
                            However, all objects stored in the repository must have a name.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.name</a:displayName>
                        <a:displayOrder>0</a:displayOrder>
                        <a:displayHint>emphasized</a:displayHint>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" ref="tns:description">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Free-form textual description of the object. This is meant to
                            be displayed in the user interface.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.description</a:displayName>
                        <a:displayOrder>10</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" ref="tns:documentation">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            AsciiDoc-formatted technical documentation of the object.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.documentation</a:displayName>
                        <a:displayOrder>11</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="subtype" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Type of the object. It is used to distinguish what a specific object
                            represents. Whether it is a different kind of organizational unit, project,
                            team, or different kind of user, etc.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.subtype</a:displayName>
                        <a:displayOrder>15</a:displayOrder>
                        <a:deprecated>true</a:deprecated>
                        <a:deprecatedSince>4.2</a:deprecatedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="fetchResult" type="tns:OperationResultType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Result of the operation that fetched this instance of the object.
                            It is mostly used to indicate that the object is not complete or
                            there is some problem with the object. This is used instead of
                            exception if the object is part of larger structures (lists as in
                            list/search operations or composite objects). If not present then
                            the "SUCCESS" state is assumed.
                        </p>

                        <p>
                            This field is TRANSIENT. It must only be used in runtime. It should
                            never be stored in the repository.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" ref="tns:extension">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Extension container that provides generic extensibility mechanism.
                            Almost any extension property can be placed in this container.
                            This mechanism is used to extend objects with new properties.
                            The extension is treated exactly the same as other object
                            properties by the code (storage, modifications, etc), except
                            that the system may not be able to understand their meaning.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.extension</a:displayName>
                        <a:displayOrder>1000</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="parentOrgRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Set of the orgs (organizational units, projects, teams) that the object relates to.
                            This usually means that the object belongs to them but it may have other meanings as well
                            (e.g. user manages an organizational unit).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>OrgType.parentOrganization</a:displayName>
                        <a:displayOrder>240</a:displayOrder>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="trigger" type="tns:TriggerType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Triggers for this object. They drive invocations of corresponding trigger handlers
                            at specified time.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="metadata" type="tns:MetadataType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Meta-data about object creation, modification, etc.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="tenantRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Reference to the tenant to which this object belongs. It is a computed value set automatically
                            by midPoint. It is determined from the organizational structure. Even though this value is
                            computed it is also stored in the repository due to performance reasons.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>OrgType.tenant</a:displayName>
                        <a:displayOrder>250</a:displayOrder>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" ref="tns:lifecycleState">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Lifecycle state of the object. This property defines whether the
                            object represents a draft, proposed definition, whether it is active,
                            deprecated, archived, and so on. See "Object Lifecycle" in the documentation.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.lifecycleState</a:displayName>
                        <a:displayOrder>20</a:displayOrder>
                        <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000230" type="tns:LookupTableType"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="operationExecution" type="tns:OperationExecutionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Description of recent operations executed on this object (or related objects in special
                            cases). The number of operations to be kept here is configurable.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="lensContext" type="tns:LensContextType">
                <xsd:annotation>
                    <xsd:documentation>
                        Model context describing executed operation
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="policySituation" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        The policy situation(s) of this object. The situations are result of
                        evaluation of the policy rules. This property is recorded for each object
                        and can be used for reporting, diagnostics, target selection in certification
                        campaigns, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="triggeredPolicyRule" type="tns:EvaluatedPolicyRuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        Triggered policy rules for this object. (Not necessarily complete; subject to specified storage strategy.)
                        This is EXPERIMENTAL functionality. It is possibly to change in the near future.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="policyException" type="tns:PolicyExceptionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Recorded exception from a policy rule. The exceptions that are approved are
                        recoded here to avoid re-evaluating and re-approving them all the time.
                        This is EXPERIMENTAL functionality. It is likely to change in the near future.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="diagnosticInformation" type="tns:DiagnosticInformationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Diagnostic information attached to this object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element default="false" minOccurs="0" name="indestructible" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Protection against accidental deletion.
                        If set to true then this object cannot be deleted.
                        If the object needs to be deleted then it has to be modified first to reset this flag.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="effectiveMarkRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Effective object marks for this object.

                        When stored in the repository, this includes computed marks (for shadows by the marking mechanism,
                        and for other objects by the policy rules), as well as applied policy statements.

                        Conditions that these values hold:

                        1. They always have an OID.

                        2. For shadows: They have either a default relation, or `org:related` one. The latter means
                        that the reference is inactive, and is present only for the purpose of holding value metadata
                        (usually that it was computed by a rule, but disabled by a statement).

                        3. They are computed using the `production` configuration (regarding statements, and later e.g.
                        marking rules).

                        Value metadata (currently applies only to shadows):

                        1. provenance/markingRule is set when the value is provided by the automatic marking rule;
                        2. provenance/policyStatement is set when the value is influenced by the policy statement
                        (either enforced or suppressed).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:MarkType</a:objectReferenceTargetType>
                        <a:displayName>ObjectType.effectiveMarkRef</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
             </xsd:element>
           <xsd:element maxOccurs="unbounded" minOccurs="0" name="policyStatement" type="tns:PolicyStatementType">
               <xsd:annotation>
                   <xsd:documentation>
                      Policy statements to manually add or exclude effective marks of shadow.
                   </xsd:documentation>
                   <xsd:appinfo>
                       <a:experimental>true</a:experimental>
                   </xsd:appinfo>
               </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="effectiveOperationPolicy" type="tns:ObjectOperationPolicyType">
               <xsd:annotation>
                 <xsd:documentation>
                     Effective provisioning policy derived from Shadow marks and resource configuration.
                     Currently supported for shadows only.
                     Transient: not stored in the repository.
                 </xsd:documentation>
                 <xsd:appinfo>
                     <a:experimental>true</a:experimental>
                 </xsd:appinfo>
               </xsd:annotation>
           </xsd:element>
        </xsd:sequence>

        <xsd:attribute name="oid" type="xsd:string">
            <xsd:annotation>
                <xsd:documentation>
                    <p>
                        System-wide immutable identifier for the object.
                        Will be probably quite long and not human-readable. It
                        should NOT be displayed to user.
                    </p>
                    <p>
                        This identifier must be unique in the entire system.
                    </p>
                    <p>
                        This attribute is immutable.
                        It cannot be changed. Any operation attempting
                        to change this identifier must fail.
                        However OID is not property and therefore cannot
                        be "addressed" in usual operations.
                    </p>
                    <p>
                        OID must be provided for all objects that are persistently
                        stored. There may be detached objects without OID.
                        Such objects have the same structure as normal objects,
                        they are just not stored in the repository. E.g.
                        object that are only stored on resource and are
                        not replicated in the repository. Such objects
                        do not have OID therefore their XML representation
                        cannot contain oid attribute.
                    </p>
                    <p>
                        The OID should be unique in both time and space. That
                        means that OIDs must be unique in the whole system
                        in any moment and should not be re-used. If an object is
                        deleted, the OID of that object should not be used by
                        a new object. The reason is to avoid problems with stale
                        links pointing to a wrong object and appearing valid.
                        However, this is not a strict requirement. Some marginal
                        probability of OID reuse is tolerated. The recommended
                        practice is to add some randomness to the process of
                        OID generation.
                    </p>

                    <p>
                        This attribute is NOT (necessarily) ASN.1 OID and should not
                        be confused with it.
                        The attribute is named "oid" meaning object identifier.
                        It is not named "id" to avoid confusion with xml:id
                        attribute as it is easy to confuse these two if
                        namespace prefix is omitted. The confusion with ASN.1
                        OID id not likely.
                    </p>
                    <p>
                        The oid is XML attribute of this object instead of
                        element because it has special purpose of identifying
                        the object. It is also immutable, therefore we do not
                        need to handle changes to it.
                    </p>
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>

        <xsd:attribute name="version" type="xsd:string">
            <xsd:annotation>
                <xsd:documentation>
                    <p>
                        Object version for the purposes of optimistic locking, cache
                        coherency, etc.
                    </p>
                    <p>
                        Contains the version in which this object was read from the
                        repository, fetched from the resource, etc.
                    </p>
                    <p>
                        Type of the version attribute is string, not integer to provide
                        flexibility for various versioning schemes in implementation
                        (e.g. ETags). The type really does not matter, the only
                        things that matters is if the version is the same or different.
                    </p>
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
    </xsd:extension>
    </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="object" type="tns:ObjectType"/>

    <xsd:complexType name="ObjectReferenceType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Reference to an object. It contains OID of the object that it
                    refers to.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:objectReference/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="filter" type="q:SearchFilterType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Filter that can be used to dynamically lookup the reference OID e.g. during imports.
                            It must not be used for normal operations. The filter may be stored in the repository
                            to avoid data loss. But even if it is stored it will not be used beyond initial
                            import or unless explicitly requested (e.g. by setting resolutionTime).
                        </p>
                        <p>
                            Note: The filter will NOT be used if the OID in the reference is set. The OID always takes
                            precedence.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="import" minOccurs="0" name="resolutionTime" type="t:EvaluationTimeType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Definition of the "time" when the reference will be resolved. Resolving the reference means using
                            the filter to get object(s) or OID(s).
                        </p>
                        <p>
                            Import-time resolution means that the reference will be resolved once when the file is imported.
                            OID will be recorded in the reference and then only the OID will be used to follow the reference.
                            This is a very efficient method and it is the default.
                        </p>
                        <p>
                            Run-time resolution means that the reference will be resolved every time that the reference is
                            evaluated. This is less efficient but it provides great flexibility as the filter may contain
                            expressions and therefore the reference target may dynamically change.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="default" minOccurs="0" name="referentialIntegrity" type="t:ReferentialIntegrityType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Definition of the behavior related to non-existence of object with specified target OID.
                            (Currently supported only at selected places in midPoint.)
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="targetName" type="t:PolyStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Cached name of the target object.
                            This is an ephemeral value. It is not stored in the repository.
                            It may be computed at object retrieval time or it may not be present at all.
                             This is NOT an authoritative information. Setting it or changing it will
                             not influence the reference meaning. OID is the only authoritative linking
                             mechanism.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="oid" type="xsd:string">
            <xsd:annotation>
                <xsd:documentation>
                    <p>
                        Target of the reference.
                    </p>
                    <p>
                        Optional only during imports. The objects stored in the repository must have the OID
                        value filled in.
                    </p>
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
        <xsd:attribute name="type" type="xsd:QName">
            <xsd:annotation>
                <xsd:documentation>
                    <p>
                        Type of the reference target object.
                    </p>
                    <p>
                        It has to be provided unless the schema explicitly defines
                        a non-polymorphic type for the reference target type.
                    </p>
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
        <xsd:attribute name="relation" type="xsd:QName">
            <xsd:annotation>
                <xsd:documentation>
                    <p>
                        The relation or a "role" of this reference. It may further specify
                        the meaning of the reference. E.g. it may specify whether the objects
                        linked by the reference are analogous, form a composition, aggregation,
                        are members of the org or managers of the org, etc.
                    </p>
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
    </xsd:complexType>
    <xsd:element name="objectRef" type="tns:ObjectReferenceType"/>

    <xsd:complexType name="ExtensionType">
        <xsd:annotation>
            <xsd:documentation>
                Place for non-standard object properties. The
                elements placed here will be handled exactly
                like the elements in the object body.

                It must NOT contain standard elements.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any maxOccurs="unbounded" minOccurs="0" processContents="lax">
            </xsd:any>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="extension" type="tns:ExtensionType"/>

    <xsd:complexType name="GenericObjectType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                Generic object for storing unknown (unexpected) object types.
                </p>

                <p>
                The generic object should be used if there is a need to
                store a custom object (e.g. KangarooType) at deployment-time.
                The properties of such custom objects are to be placed in the
                extension part of this object. The schema is not checked or
                enforced for this type of objects if technically possible.
                </p>
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:FocusType">
                <xsd:sequence>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="genericObject" substitutionGroup="tns:object" type="tns:GenericObjectType"/>

    <xsd:complexType name="MarkType">
        <xsd:annotation>
            <xsd:documentation>
                A mark is a "label" given to an object - currently a prism object, an assignment, or audited/simulation event.
                Tags are used in various contexts, for example as policy situations or event marks.
                This object serves as a point of definition of such marks.

                Well-known archetypes: object mark, event mark.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="displayOrder" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                An order in which this mark should be displayed relative to other marks within the same context.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MarkType.displayOrder</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="uri" type="xsd:anyURI">
                        <xsd:annotation>
                            <xsd:documentation>
                                Optional URI assigned to this tag. For example, policy situations had traditionally such URIs.
                                It should be globally unique.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MarkType.uri</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="display" type="tns:DisplayType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Display properties of the tag. It is used to display the tag in drop-down lists, buttons, etc..
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MarkType.display</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="policyRule" type="tns:GlobalPolicyRuleType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Global policy rules that can yield this mark (object or event mark).
                                By including them here they are evaluated automatically, just like if they would be included
                                in the system configuration. (Provided that this mark is in appropriate lifecycle state.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MarkType.policyRule</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="objectOperationPolicy" type="tns:ObjectOperationPolicyType">
                       <xsd:annotation>
                            <xsd:documentation>
                                Provisioning policy, which is applied to shadows, which have this tag assigned.

                                If shadow have multiple tags with provisioning policy applied, the strongest effect is applied.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MarkType.objectOperationPolicy</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="eventMark" type="tns:EventMarkInformationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Information specific to event marks.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>MarkType.eventMark</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="mark" substitutionGroup="tns:object" type="tns:MarkType"/>

    <xsd:complexType name="EventMarkInformationType">
        <xsd:annotation>
            <xsd:documentation>
                Information specific for event marks.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:experimental>true</a:experimental>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="domain" type="tns:EventMarkDomainType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of objects on which this tag is applicable.
                        Normally, the applicability is determined by the presence of the respective policy rule(s) related to
                        this tag (by assignments or global policy rules selectors). But we need more fine-grained approach
                        when reporting on the tags. For example, we may need to consider only a subset of all projections
                        (shadows) that were processed.

                        Experimental. This may be a bad idea overall.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>EventMarkInformationType.domain</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="enabledByDefault" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Is this event tag processing enabled by default?

                        TODO is this the correct place (as it most probably applies only to simulations)?
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>EventMarkInformationType.enabledByDefault</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="eventMarkInformation" type="tns:EventMarkInformationType"/>

    <xsd:complexType name="TriggerType">
        <xsd:annotation>
            <xsd:documentation>
                Defines triggers for an object. Trigger is an action that should take place
                at specified time or under some other condition.
            </xsd:documentation>
            <xsd:appinfo>
                <!-- We don't consider this type to be operational per se. We set operational flag
                     on some elements with this type. -->
                <a:operational>false</a:operational>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="timestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        The time when a trigger needs to be activated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <!-- cannot be operational: it's a substantial piece of information, used to compare triggers -->
                        <!-- TODO think again about this (MID-3828) -->
                        <a:operational>false</a:operational>
                        <a:indexed>true</a:indexed>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="handlerUri" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Handler URI indirectly specifies which class is responsible to handle the task. The handler will
                        to be used to handle trigger activation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="originDescription" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short description of trigger origin, e.g. name of the mapping.
                        Used for diagnostic purposes.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:indexed>false</a:indexed>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:extension">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Extension container used to provide additional situation-specific information to the trigger.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
           </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
     </xsd:complexType>

    <xsd:complexType name="MetadataType">
           <xsd:annotation>
            <xsd:documentation>
                <p>
                    Meta-data about data creation, modification, etc.
                    It may apply to objects but also parts of the object (e.g. assignments).
                </p>

                <p>
                    Meta-data only apply to successful operations. That is obvious for create, but it also applies
                    to modify. For obvious reasons there are no metadata about delete.
                    We keep no metadata about reading. That would be a huge performance hit.
                </p>

                <p>
                    Meta-data only describe the last operation of its kind. E.g. there is a record of last
                    modification, last approval, etc. There is no history. The last operation overwrites data
                    about the previous operation.
                </p>

                <p>
                    These data are informational only. They should not be used for security purposes (use auditing
                    subsystem for that). But presence of metadata simplifies system administration and may provide
                    some basic information "at the glance" which may be later confirmed by the audit logs.
                </p>

                <p>
                    Meta-data are also supposed to be searchable. Therefore they may be used to quickly find
                    "candidate" objects for a closer examination.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:operational>true</a:operational>
                <a:container/>
                <a:displayName>Metadata</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="requestTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            The timestamp of "create" operation request. It is set once and should never be changed.
                        </p>
                        <p>
                            In case of "background" processes to create object (e.g. create with approval)
                            this should be the timestamp when the process started. I.e. the timestamp when
                            the operation was requested.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.requestTimestamp</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.5</a:since>
                        <a:valueMetadata/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="requestorRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the user that requested the "create" operation for this object or assignment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.requestorRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                        <a:valueMetadata/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="requestorComment" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Comment of the user that requested the "create" operation for this object or assignment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.requestorComment</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="createTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            The timestamp of data creation. It is set once and should never be changed.
                        </p>
                        <p>
                            In case of "background" processes to create object (e.g. create with approval)
                            this should be the timestamp when the process ended. I.e. the timestamp when
                            the operation was executed.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.createTimestamp</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                        <a:since>3.5</a:since>
                        <a:help>MetadataType.createTimestamp.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="creatorRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the user that created the data.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.creatorRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="createApproverRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the user that approved the creation of the data (if there was such a user).
                        This is multi-value reference therefore multiple approvers may be recorded. However the order and
                        hierarchy of the approvers is lost.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.createApproverRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="createApprovalComment" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Comments of the approvers during the creation of the data. Note that these comments are in no
                        particular order, so basically it is not known who entered which comment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.createApprovalComment</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="createApprovalTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        The timestamp of creation approval.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.createApprovalTimestamp</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.5</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="createChannel" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Channel in which the object was created.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.createChannel</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="createTaskRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the task that created the object (if it was a persistent one).
                        If the task was a subtask, then the reference to the task tree is stored here.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.createTaskRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:objectReferenceTargetType>tns:TaskType</a:objectReferenceTargetType>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="modifyTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        The timestamp of last data modification. It should be updated to a current time
                        when the object is modified.
                        The modifications that change only operational attributes may not update the
                        modify timestamp.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.modifyTimestamp</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                        <a:help>MetadataType.modifyTimestamp.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="modifierRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the user that modified the data.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.modifierRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="modifyApproverRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Reference to the user that approved the last modification of the data (if there was such a user).
                            This is multi-value reference therefore multiple approvers may be recorded. However the order and
                            hierarchy of the approvers is lost.
                        </p>
                        <p>
                            Even though this is multi-value reference it will get overwritten after each approval.
                            The multiple values are used only if all the approvers are known at the same time,
                            e.g. if multi-level approval is evaluated at the same time. But generally this refers
                            only to the last approval event.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.modifyApproverRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="modifyApprovalComment" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Comments of the approvers during the last modification of the data. Note that these comments are in no
                            particular order, so basically it is not known who entered which comment.
                        </p>
                        <p>
                            Even though this is multi-value property it will get overwritten after each approval.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.modifyApprovalComment</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="modifyApprovalTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        The timestamp of last modification approval.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.modifyApprovalTimestamp</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.5</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="modifyChannel" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Channel in which the object was last modified.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.modifyChannel</a:displayName>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="modifyTaskRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the task that last modified the object (if it was a persistent one).
                        If the last modification was carried out by synchronous task, this reference will be empty.

                        If the task was a subtask, then the reference to the task tree is stored here.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.modifyTaskRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:objectReferenceTargetType>tns:TaskType</a:objectReferenceTargetType>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lastProvisioningTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            The timestamp last provisioning operation that was based on this object.
                            E.g. the timestamp of last modification of any account based on the
                            data from the user. This value is only updated if there was any
                            real change in the resource.
                        </p>
                        <p>
                            This meta-datum is used as an informational property that tells when
                            the data were last synchronized in outbound direction. But it has another
                            important role. It is used indirectly to trigger optimistic locking
                            conflicts that are used to detect a "clean" recompute (i.e. recompute
                            that is processing data without any outside interaction).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.lastProvisioningTimestamp</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.6.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="certificationFinishedTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        When last certification related to this item was finished.
                        Only certifications that resulted in non-null outcome are taken into account.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.certificationFinishedTimestamp</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="certificationOutcome" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Outcome (URI) of the last certification.
                        Only certifications that resulted in non-null outcome are taken into account.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.certificationOutcome</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="certifierRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the user that certified the data.
                        Contrary to approver/modifierRef, this field is filled-in also when certifier denies the item status.
                        Only certifications that resulted in non-null outcome are taken into account.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.certifierRef</a:displayName>
                        <a:operational>true</a:operational>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="certifierComment" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Comments of the certifiers during the last certification of the data. Note that these comments are in no
                            particular order, so basically it is not known who entered which comment.
                        </p>
                        <p>
                            Even though this is multi-value property it will get overwritten after each approval.
                        </p>
                        <p>
                            Only certifications that resulted in non-null outcome are taken into account.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.certifierComment</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="originMappingName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Identifies the mapping that caused the automated creation of this object or assignment.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MetadataType.originMappingName</a:displayName>
                        <a:operational>true</a:operational>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <!-- Property-related types -->

    <xsd:complexType name="EmptyType">
        <xsd:annotation>
            <xsd:documentation>
                Type that contains nothing.
                Used in WSDL messages that do not return anything to silence the warnings.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:complexType>

    <xsd:simpleType name="BeforeAfterType">
        <xsd:annotation>
            <xsd:documentation>
                An enumeration that defines when the activity will be executed.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="before">
                <xsd:annotation>
                    <xsd:documentation>
                        The activity will be executed before the "main" operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BEFORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="after">
                <xsd:annotation>
                    <xsd:documentation>
                        The activity will be executed after the "main" operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AFTER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="DeadlineRoundingType">
        <xsd:annotation>
            <xsd:documentation>
                Way of rounding deadline(s) e.g. for certification or approval stages.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        The deadline will not be rounded.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="hour">
                <xsd:annotation>
                    <xsd:documentation>
                        The deadline will be rounded to 59:59 of the computed hour.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HOUR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="day">
                <xsd:annotation>
                    <xsd:documentation>
                        The deadline will be rounded to 23:59:59 of the computed day.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DAY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="DiagnosticInformationType">
        <xsd:annotation>
            <xsd:documentation>
                A diagnostic information attached to an object.
                It can be put there because of a user request or by midPoint itself.
                EXPERIMENTAL.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="timestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        When the information was created.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="type" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of the information (e.g. thread dump).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="cause" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Cause of the information being created (e.g. a user request).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="nodeIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier of a node where the information was captured.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="content" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        A textual representation of the information.
                        (It can be augmented/replaced by more structured form using a subclass of DiagnosticInformationType.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AssignmentHolderType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Abstract supertype for all object types that can have assignments.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:object/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="assignment" type="tns:AssignmentType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Set of object's assignments.
                                Assignments define the privileges and "features" that this object should have, that
                                this object is entitled to. Typical assignment will point to a role or define
                                a construction of an account.
                                </p>
                                <p>
                                Assignments represent what the object SHOULD HAVE. The assignments represent a policy,
                                a desired state of things (cf. linkRef, roleMembershipRef).
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.assignmentKey</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="iteration" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                Iteration number. Starts with 0. It is used to iteratively find unique identifier
                                for the object.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:operational>true</a:operational>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="iterationToken" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Iteration token. String value that is usually a suffix to the identifier based
                                on iteration number. E.g. ".007". It is used to iteratively find unique identifier
                                for the object.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:operational>true</a:operational>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="archetypeRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                  References to all applicable archetypes, including "indirect" archetypes such as archetype supertypes.
                                  Contains references to active archetypes only.
                                </p>
                                <p>
                                  Note: the value of this reference is only updated when object is recomputed.
                                  Therefore if a role definition changes then all the affected objects must be recomputed
                                  for this reference to be consistent.
                                </p>
                                <p>
                                  This is an operational property. It is set and managed by the system. It is used
                                  for efficient use of archetypes.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                                <a:operational>true</a:operational>
                                <a:displayName>AssignmentHolderType.archetypeRef</a:displayName>
                                <a:since>4.0</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="roleMembershipRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                  References to abstract roles (roles, orgs, services) that this focus currently belongs to - directly
                                  or indirectly. This reference points to all the roles in the role hierarchy. It only points to
                                  the roles that were evaluated as active during last recompute (conditions were true, validity
                                  constraints not violated).
                                </p>
                                <p>
                                  Note: the value of this reference is only updated when a focal object is recomputed.
                                  Therefore if a role definition changes then all the affected focal objects must be recomputed
                                  for this reference to be consistent.
                                </p>
                                <p>
                                  Roles mentioned here are those that are NOT obtained via delegation, i.e. "deputy" relations.
                                  Relations acquired by delegation are listed in delegatedRef item.
                                </p>
                                <p>
                                  This is an operational property. It is set and managed by the system. It is used
                                  for efficient search of all current role members, e.g. for the purpose of displaying this
                                  information in the GUI.
                                </p>
                                <p>
                                    Note: roleMembershipRef will be probably renamed to something like linkRef or
                                    outboundLinkRef. We need to generalize it to contain information on generic links
                                    between objects (e.g. between child and its parents).
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:AbstractRoleType</a:objectReferenceTargetType>
                                <a:operational>true</a:operational>
                                <a:displayName>FocusType.roleMembershipRef</a:displayName>
                                <a:help>FocusType.roleMembershipRef.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="delegatedRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    References to objects (abstract roles as well as users) obtained via delegation.
                                    If A1 is a deputy of A, its delegatedRef contains a union of A, A.roleMembershipRef and
                                    A.delegatedRef.
                                </p>
                                <p>
                                    This is an operational property. It is set and managed by the system. It is used
                                    for efficient search of all current role members, e.g. for the purpose of displaying this
                                    information in the GUI.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                                <a:operational>true</a:operational>
                                <a:since>3.5</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="roleInfluenceRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                  References to abstract roles (roles and orgs) that this focus may directly belong to.
                                  This reference only points to the next role in the hierarchy. However, it is backed by
                                  a "closure" index in the repository subsystem. Therefore it can efficiently support tree-like
                                  queries. This reference points to the roles for whose the condition is not true.
                                  Therefore it does not reliably show
                                  who actually has a role. It shows potential role members - all the object that are possibly
                                  influenced when a role definition changes.
                                </p>
                                <p>
                                  This is an operational property. It is set and managed by the system. It is used
                                  for efficient search of all possible role members, e.g. for the purpose of recomputing
                                  all role members after the role definition is changed.
                                </p>
                                <p>
                                    TODO. NOT IMPLEMENTED YET. EXPERIMENTAL. UNSTABLE.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:AbstractRoleType</a:objectReferenceTargetType>
                                <a:operational>true</a:operational>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <!-- No element definition for AssignmentHolderType, because it is abstract. -->
    <!-- [med] but we need this to find PCD for AssignmentHolderType see MID-5010 -->
    <xsd:element name="assignmentHolder" type="tns:AssignmentHolderType"/>

    <xsd:complexType abstract="true" name="FocusType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Abstract supertype for all object types that can be focus of full midPoint computation.
                    This basically means objects that have projections. But focal objects also have
                    activation, they may have personas, etc.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:object/>
                <a:schemaMigration>
                    <a:element>tns:objectType</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="identities" type="tns:FocusIdentitiesType">
                        <xsd:annotation>
                            <xsd:documentation>
                                (Alternative?) identities of this focus object.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.6</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="linkRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Set of shadows (projections) linked to this focal object.
                                    E.g. a set of accounts linked to a user. This is the set of
                                    shadows that belongs to the focal object in a sense
                                    that these shadows represents the focal object on the resource.
                                    E.g. The set of accounts that represent the same midPoint user (the
                                    same physical person, they are "analogous").
                                </p>
                                <p>
                                    Links define what the object HAS. The links reflect real state of things
                                    (cf. assignment).
                                </p>
                                <p>
                                    The relation in linkRef has the following meaning: org:default means that
                                    the shadow the link is pointing to is "live", i.e. the corresponding
                                    object exists on the resource. On the other hand, org:related means that
                                    the shadow exists in repo, but with dead = true, i.e. the corresponding
                                    object is not existing on the resource anymore.
                                </p>
                                <p>
                                    Especially, when the shadow is in the Reaping state (see
                                    https://docs.evolveum.com/midpoint/reference/resources/shadow/dead/), the
                                    relation should be still org:default.
                                </p>
                                <p>
                                    Note: linkRef will be probably renamed to projectionRef or projectionLinkRef.
                                    There are more kinds of links between objects than focus - projection links
                                    (cf. roleMembershipRef).
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.linkRef</a:displayName>
                                <a:objectReferenceTargetType>tns:ShadowType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="personaRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Set of personas linked to this focal object.
                                E.g. a set of virtual identities linked to a user. This is the set of
                                "secondary" focal objects that belongs to this focal object in a sense
                                that the current focal object is in control over the linked focal objects.
                                E.g. this reference can be used to link user object which specified a physical
                                person with his virtual identities (personas) that specify his identity as an
                                employee, system administrator, customer, etc.
                                The default meaning is that the personas are "analogous", i.e. the represent
                                different facets of the same physical person. However, this meaning may be
                                theoretically overridden by using various relation parameters in this reference.
                                </p>
                                <p>
                                This reference define what the object HAS. The links reflect real state of
                                things (cf. assignment).
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="activation" type="tns:ActivationType">
                    </xsd:element>

                    <xsd:element minOccurs="0" name="jpegPhoto" type="xsd:base64Binary">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Photo corresponding to the user / org / role.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.jpegPhoto</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="costCenter" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    The name, identifier or code of the cost center to which the user belongs.
                                </p>
                                <p>
                                    Please note that organization objects (OrgType) also have a costCenter property.
                                    Therefore it is usual that if a user belongs to an organization the costCenter from
                                    the organization is used. Therefore this property is usually used only for users that
                                    do not belong to any organization or for users that have different cost center than
                                    the one defined by the organization.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.costCenter</a:displayName>
                                <a:displayOrder>420</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="locality" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Primary locality of the user, the place where
                                    the user usually works, the country, city or
                                    building that he belongs to. The specific meaning
                                    and form of this property is deployment-specific.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.locality</a:displayName>
                                <a:displayOrder>450</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="preferredLanguage" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Indicates user's preferred language, usually for the purpose of localizing
                                    user interfaces. The format is IETF language tag defined in BCP 47, where
                                    underscore is used as a subtag separator. This is usually a ISO 639-1 two-letter
                                    language code optionally followed by ISO 3166-1 two letter country code
                                    separated by underscore. The languages that do not have country-specific
                                    variants are usually specified by using a two-letter country code ("sk",
                                    "cs", "tr"). Languages with country-specific variants have country-specific
                                    subtags ("pt_BR", "zn_CN").
                                    If no value is specified in this property then system default locale is assumed.
                                </p>
                                <p>
                                    Examples:
                                    <ul>
                                        <li>en_US</li>
                                        <li>sk</li>
                                        <li>cs</li>
                                        <li>pt_BR</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.preferredLanguage</a:displayName>
                                <a:displayOrder>200</a:displayOrder>
                                <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000200" type="tns:LookupTableType"/>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="locale" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Defines user's preference in displaying currency, dates and other items
                                    related to location and culture. The format is IETF language tag defined in BCP 47, where
                                    underscore is used as a subtag separator. This is usually a ISO 639-1 two-letter
                                    language code optionally followed by ISO 3166-1 two letter country code
                                    separated by underscore. The languages that do not have country-specific
                                    variants are usually specified by using a two-letter country code ("sk",
                                    "cs", "tr"). Languages with country-specific variants have country-specific
                                    subtags ("pt_BR", "zn_CN").
                                    If not specified then system default locale is assumed.
                                </p>
                                <p>
                                    Examples:
                                    <ul>
                                        <li>en_US</li>
                                        <li>sk</li>
                                        <li>cs</li>
                                        <li>pt_BR</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.locale</a:displayName>
                                <a:displayOrder>210</a:displayOrder>
                                <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000210" type="tns:LookupTableType"/>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="timezone" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    User's preferred timezone. It is specified in the "tz database" (a.k.a "Olson")
                                    format. If not specified then system default timezone is assumed.
                                </p>
                                <p>
                                    Examples:
                                    <ul>
                                        <li>Europe/Bratislava</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.timezone</a:displayName>
                                <a:displayOrder>220</a:displayOrder>
                                <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000220" type="tns:LookupTableType"/>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="emailAddress" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    E-Mail address of the user, org. unit, etc. This is the address
                                    supposed to be used for communication with the
                                    user, org. unit, etc. E.g. IDM system may send notifications
                                    to the e-mail address. It is NOT supposed to be
                                    full-featured e-mail address data structure
                                    e.g. for the purpose of complex address-book application.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.emailAddress</a:displayName>
                                <a:displayOrder>300</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="telephoneNumber" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Primary telephone number of the user, org. unit, etc.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.telephoneNumber</a:displayName>
                                <a:displayOrder>310</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="credentials" type="tns:CredentialsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The set of focus's credentials (such as passwords).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.credentials</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="behavior" type="tns:BehaviorType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>FocusType.behavior</a:displayName>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <!-- No element definition for FocusType, because it is abstract.
         [med] OK but later :) We need this to be able to find PCD for FocusType ... see MID-5010 -->
    <xsd:element name="focus" type="tns:FocusType"/>

    <xsd:complexType name="UserType">
        <xsd:annotation>
            <xsd:documentation>
                User object represents a physical user of the system.
                It differs from the account, as "account" represents a data structure in a target system while
                "user" represents data structure in midPoint. One user typically has many accounts.
                Properties of User object typically describe the user as a physical person.
                Therefore the user object defines handful of properties that are commonly used to describe users
                in the IDM solutions (employees, customers, partners, etc.) Custom extensions are possible by utilizing
                the "extension" container.
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:result</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:employeeType</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:diagram>
                    <a:name>user-shadow-resource</a:name>
                    <a:form>collapsed</a:form>
                    <a:inclusion>include</a:inclusion>
                    <a:subitemInclusion>auto</a:subitemInclusion>
                </a:diagram>
                <a:diagram>
                    <a:name>user-details</a:name>
                    <a:form>expanded</a:form>
                </a:diagram>
                <a:diagram>
                    <a:name>user-overview</a:name>
                    <a:form>expanded</a:form>
                    <a:subitemInclusion>exclude</a:subitemInclusion>
                </a:diagram>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:FocusType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="fullName" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Full name of the user with all the decorations,
                                middle name initials, honorific title and any
                                other structure that is usual in the cultural
                                environment that the system operates in. This
                                element is intended to be displayed to
                                a common user of the system.
                                </p>

                                <p>
                                Examples:
                                    <ul>
                                        <li>cpt. Jack Sparrow</li>
                                        <li>William "Bootstrap" Turner</li>
                                        <li>James W. Random, PhD.</li>
                                        <li>Chuck Norris</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.fullName</a:displayName>
                                <a:displayOrder>100</a:displayOrder>
                                <a:displayHint>emphasized</a:displayHint>
                                <a:diagram>
                                    <a:name>user-overview</a:name>
                                    <a:inclusion>include</a:inclusion>
                                </a:diagram>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="givenName" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Given name of the user. It is usually the first
                                name of the user, but the order of names may
                                differ in various cultural environments. This
                                element will always contain the name that was
                                given to the user at birth or was chosen
                                by the user.
                                </p>

                                <p>
                                Examples:
                                    <ul>
                                        <li>Jack</li>
                                        <li>Chuck</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.givenName</a:displayName>
                                <a:displayOrder>110</a:displayOrder>
                                <a:displayHint>emphasized</a:displayHint>
                                <a:diagram>
                                    <a:name>user-overview</a:name>
                                    <a:inclusion>include</a:inclusion>
                                </a:diagram>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="familyName" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Family name of the user. It is usually the last
                                name of the user, but the order of names may
                                differ in various cultural environments. This
                                element will always contain the name that was
                                inherited from the family or was assigned
                                to a user by some other means.
                                </p>

                                <p>
                                Examples:
                                    <ul>
                                        <li>Sparrow</li>
                                        <li>Norris</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.familyName</a:displayName>
                                <a:displayOrder>120</a:displayOrder>
                                <a:displayHint>emphasized</a:displayHint>
                                <a:diagram>
                                    <a:name>user-overview</a:name>
                                    <a:inclusion>include</a:inclusion>
                                </a:diagram>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="additionalName" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Middle name, patronymic, matronymic or any other name of a person. It is usually the
                                    middle component of the name, however that may be culture-dependent.
                                </p>
                                <p>
                                Examples:
                                    <ul>
                                        <li>Walker</li>
                                        <li>John</li>
                                        <li>Iljic</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.additionalName</a:displayName>
                                <a:displayOrder>130</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="nickName" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Familiar or otherwise informal way to address a person.
                                </p>
                                <p>
                                Examples:
                                    <ul>
                                        <li>Bootstrap</li>
                                        <li>Bobby</li>
                                    </ul>
                                </p>
                                <p>
                                    The meaning of this property is to take part in the formatted full
                                    name of the person, e.g. William "Bootstrap" Turner. It is not intended
                                    to be used as a username or login name. This value is usually changeable
                                    by the user itself and it defines how the user wants other to address him.
                                    Therefore it is not ideal for use as an identifier.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.nickname</a:displayName>
                                <a:displayOrder>140</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="honorificPrefix" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Honorific titles that go before the name.
                                </p>
                                <p>
                                Examples:
                                    <ul>
                                        <li>cpt.</li>
                                        <li>Ing.</li>
                                        <li>Sir</li>
                                    </ul>
                                </p>
                                <p>
                                    This property is single-valued. If more
                                    than one title is applicable, they have to be represented in
                                    a single string (concatenated) form in the correct order.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.honorificPrefix</a:displayName>
                                <a:displayOrder>150</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="honorificSuffix" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Honorific titles that go after the name.
                                </p>
                                <p>
                                Examples:
                                    <ul>
                                        <li>PhD.</li>
                                        <li>KBE</li>
                                    </ul>
                                </p>
                                <p>
                                    This property is single-valued. If more
                                    than one title is applicable, they have to be represented in
                                    a single string (concatenated) form in the correct order.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.honorificSuffix</a:displayName>
                                <a:displayOrder>160</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="title" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    User's title defining a work position or a primary role in the
                                    organization.
                                </p>
                                <p>
                                Examples:
                                    <ul>
                                        <li>CEO</li>
                                        <li>Security Officer</li>
                                        <li>Assistant</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.title</a:displayName>
                                <a:displayOrder>170</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="employeeNumber" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Unique, business-oriented identifier of the employee.
                                    Typically used as correlation identifier and for
                                    auditing purposes. Should be immutable, but the
                                    specific properties and usage are deployment-specific.

                                    DEPRECATED, use personalNumber instead.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.employeeNumber</a:displayName>
                                <a:displayOrder>400</a:displayOrder>
                                <a:deprecated/>
                                <a:deprecatedSince>4.8</a:deprecatedSince>
                                <a:plannedRemoval>5.0</a:plannedRemoval>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="organization" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Name or (preferably) immutable identifier of organization that the user belongs to.
                                    The format is deployment-specific. This property together with organizationalUnit
                                    may be used to provide easy-to-use data about organizational membership of the user.
                                </p>
                                <p>
                                    This is multi-valued property to allow membership of a user to several
                                    organizations. Please note that midPoint does not maintain ordering in
                                    multi-value properties therefore this is not usable to model a complex
                                    organization hierarchies. Use OrgType instead.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.organization</a:displayName>
                                <a:displayOrder>430</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="organizationalUnit" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Name or (preferably) immutable identifier of organizational unit that the user belongs to.
                                    The format is deployment-specific. This property together with organization
                                    may be used to provide easy-to-use data about organizational membership of the user.
                                </p>
                                <p>
                                    This is multi-valued property to allow membership of a user to several
                                    organizational units. Please note that midPoint does not maintain ordering in
                                    multi-value properties therefore this is not usable to model a complex
                                    organization hierarchies. Use OrgType instead.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.organizationalUnit</a:displayName>
                                <a:displayOrder>440</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="adminGuiConfiguration" type="tns:AdminGuiConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies the admin GUI configuration that should be used
                                    by this user.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.5</a:since>
                                <a:displayName>AdminGuiConfigurationType.adminGuiConfiguration</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="personalNumber" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Unique, business-oriented identifier of the user.
                                    Typically used as correlation identifier and for
                                    auditing purposes. Should be immutable, but the
                                    specific properties and usage are deployment-specific.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>UserType.personalNumber</a:displayName>
                                <a:displayOrder>400</a:displayOrder>
                                <a:since>4.8</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="user" substitutionGroup="c:object" type="tns:UserType"/>

    <xsd:complexType name="CredentialsType">
        <xsd:annotation>
            <xsd:documentation>
                This is a container type for various credentials types: passwords, public keys, one-time password
                scheme identifiers, etc. However, we expect that password will be the most widely used credential
                type.

                The reason to "formalize" this structure is the ability to synchronize credentials. If the password
                would be just an ordinary attribute, we cannot automatically synchronize user and account passwords.
                Similarly as other credential types.
                Note: marking password with a special attribute type will not be enough. There may be numerous passwords
                with various meanings, we need to distinguish the "primary" one to synchronize. We also need to store
                user password somewhere.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="password" type="tns:PasswordType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CredentialsType.password</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="nonce" type="tns:NonceType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CredentialsType.nonce</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="securityQuestions" type="tns:SecurityQuestionsCredentialsType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CredentialsType.securityQuestions</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="attributeVerification" type="tns:AttributeVerificationCredentialsType"/>
            <!-- More credential types may be here, such as OTP seeds, X.509 credentials, etc. -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="credentials" type="tns:CredentialsType"/>

    <xsd:complexType name="BehaviorType">
        <xsd:annotation>
            <xsd:documentation>
                General-purpose behavioral data.
                In a more specific meaning: behavioral data of an agent (user or system), usually represented in midPoint by focus.
                This data structure records informational data about the agent's behavior, such as authentications, interaction with systems and so on.
                Such data are inherently _observed_, e.g. they are not configured by the user.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="authentication" type="tns:AuthenticationBehavioralDataType">
              <xsd:annotation>
                <xsd:appinfo>
                   <a:alwaysUseForEquals>tns:sequenceIdentifier</a:alwaysUseForEquals>
                </xsd:appinfo>
              </xsd:annotation>
            </xsd:element>
            <!-- More data may be added here in the future, e.g. last self-service access, last role request, etc.
                 Even compiled data may appear here, e.g. last access of user to any of his accounts.
                 Maybe we should even make this extensible, so custom items may be added here. -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AuthenticationBehavioralDataType">
        <xsd:annotation>
            <xsd:documentation>
                Behavioral data about past authentications.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="failedLogins" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        The number of failed logins. It should be
                        increased after every unsuccessful use of
                        the credential. It may be reset after
                        successful login or a time-out or may not.
                        It depends on the policy setting. If
                        not present, value of zero (0) is assumed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lastSuccessfulLogin" type="tns:LoginEventType">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of last successful login attempt.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="previousSuccessfulLogin" type="tns:LoginEventType">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of successful before the last login attempt.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lastFailedLogin" type="tns:LoginEventType">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of last failed login attempt.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="authenticationAttempt" type="tns:AuthenticationAttemptDataType">
                <xsd:annotation>
                    <xsd:documentation>
                        The information about authentication attempt, in most cases describing authentication modules failures.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="sequenceIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Identifier of the authentication sequence within which current authentication attempt was processed.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: lockoutTimestamp -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AbstractCredentialType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AuthenticationBehavioralDataType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="name" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of the credential. It is used as an identifier that
                                specifies credential purpose. E.g. it may specify whether
                                this is default user password or administration password,
                                whether this is a nonce for registration or password reset
                                and so on. Simply speaking the name is used to distinguish
                                credentials that have the same type but different purpose.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AbstractCredentialType.name</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="metadata" type="tns:MetadataType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Timestamps and general metadata describing the credential change.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:operational>true</a:operational>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="forceChange" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If it is required to change password. E.g. there are situation when you set first password
                                for the user, but after the user fist log in to the system, he/she has to change his/her password.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AbstractCredentialType.forceChange</a:displayName>
                                <a:experimental>true</a:experimental>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>


    <xsd:complexType name="PasswordType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
                <!-- TODO: support for "old password", e.g. some resource need it to change password. -->
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="value" type="t:ProtectedStringType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>PasswordType.value</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="historyEntry" type="tns:PasswordHistoryEntryType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:operational>true</a:operational>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="hint" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <xsd:documentation>
                                    Helps the user to remind his password.
                                </xsd:documentation>
                                <a:displayName>PasswordType.hint</a:displayName>
                                <a:help>PasswordType.value.help</a:help>
                                <a:since>4.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="NonceType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="value" type="t:ProtectedStringType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="PasswordHistoryEntryType">
        <xsd:annotation>
            <xsd:documentation>
                Contains a single entry of the password history. It contains a historical value
                of a password together with essential metadata.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="metadata" type="tns:MetadataType">
                <xsd:annotation>
                    <xsd:documentation>
                        Timestamps and general metadata describing the credential change.
                        This is a copy of the original metadata of the password before it was
                        changed and before it was moved to the history.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="value" type="t:ProtectedStringType"/>
            <xsd:element minOccurs="0" name="changeTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        The timestamp when this password was changed to a different value.
                        This is different from the date in metadata. The dates in metadata
                        tells when this password was created (when it started to be valid).
                        The changeTimestamp tells when the password stopped to be valid and
                        was moved to the history entries. This timestamp can be used to
                        chronologically order the entries.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:indexed>true</a:indexed>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="SecurityQuestionsCredentialsType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="questionAnswer" type="tns:SecurityQuestionAnswerType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AttributeVerificationCredentialsType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractCredentialType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SecurityQuestionAnswerType">
        <xsd:annotation>
            <xsd:documentation>
                Answer to the security question. This is a "personalized" answer and it is supposed to
                be associated with a single user. However, it may also optionally contain a question.
                E.g. in case a user specified a custom question.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>

            <xsd:element minOccurs="0" name="questionIdentifier" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier of a question that this answer applies to. It is expected to be
                        present only if this is an answer to a "configured question", i.e. a question
                        that is defined in a security policy.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

                  <xsd:element minOccurs="0" name="questionAnswer" type="t:ProtectedStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        Answer to the question
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

              <xsd:element default="true" minOccurs="0" name="enabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>Flag indicating that this particular question is enabled.
                           It can be used to temporarily disable a question.</p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LoginEventType">
        <xsd:sequence>
            <xsd:element minOccurs="0" name="timestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of login attempt.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="from" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        The source from where the login came. It is supposed to be human-readable,
                        e.g. a hostname, IP address, etc.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AuthenticationAttemptDataType">
        <xsd:sequence>
            <xsd:element minOccurs="0" name="sequenceIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Identifier of the authentication sequence within which current authentication attempt was processed.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="moduleIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Identifier of the authentication module which produces the current authentication attempt
                            data type. This means that current authentication attempt data log describes the results of that
                            module authentication which has the specified module identifier.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="channel" type="tns:AuthenticationSequenceChannelType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of the authentication channel used for the current authentication attempt.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lastSuccessfulAuthentication" type="tns:LoginEventType">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of last successful authentication attempt.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lastFailedAuthentication" type="tns:LoginEventType">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of last failed authentication attempt.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="failedAttempts" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        The number of failed attempts within the appropriate
                        module authentication. It should be
                        increased after every unsuccessful use of
                        the credential. It may be reset after
                        successful login or a time-out or may not.
                        It depends on the policy setting. If
                        not present, value of zero (0) is assumed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lockoutTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        Timestamp of a moment when authentication module state was changed to lockout.
                        Lockout state can be set to the authentication module in case when the user reached maximum number
                        of the failed authentication attempts (this maximum number is set within security policies for the
                        appropriate type of the authentication module).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lockoutExpirationTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        Timestamp of a moment when authentication module lockout expires and the module can
                        be normally usable again.

                        This is only an informational value. It should be considered as read-only
                        for most cases. It only makes sense if the lockoutStatus is not in the "normal" state.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lockoutStatus" type="tns:LockoutStatusType">
                <xsd:annotation>
                    <xsd:documentation>
                        This defines the state of the authentication module lock-out. Lock-out means that the module
                        was temporarily disabled due to failed authentication attempts.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AssignmentType">
        <xsd:annotation>
            <xsd:documentation>
                Generic assignments of one object to another object.
                This will usually be assignment of a role to a user, assignment of an
                organizational unit, team or whatever. It may also be used to assign
                role to another role, creating a role hierarchy.

                Assignment is an abstract concept. It can be anything that
                gives the "receptor" object additional access rights, privileges,
                capabilities or similar ability or right. But it may also constraint
                the object with policy, e.g. to implement separation of duties. Roles,
                organizations and privileges in IDM system are examples of assignments.

                The assignment may target either existing IDM object (such as a role)
                or abstract resource account that may or may not exist. In case of resource
                objects it is constrained to accounts, as accounts are the only resource objects
                that can be assigned to a user. Other resource objects (entitlements) can
                be assigned to accounts, but not to users.

                TODO: constraints

            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>AssignmentType.assignment</a:displayName>
                <a:schemaMigration>
                    <a:element>tns:trigger</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:merger>AssignmentType</a:merger>
                <a:naturalKey>tns:identifier</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>

            <xsd:element minOccurs="0" name="identifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AssignmentType.identifier</a:displayName>
                        <xsd:documentation>
                            Identifier of assignment. Have to be unique to the object. It is now used for merging.
                        </xsd:documentation>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AssignmentType.description</a:displayName>
                        <a:help>AssignmentType.description.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="documentation" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AssignmentType.documentation</a:displayName>
                        <a:help>AssignmentType.documentation.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="subtype" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Type of the assignment. It is used to describe the assignment e.g. from the point of view
                            of its origin or purpose. A typical use could be marking assignments created by a given
                            inbound mapping in order to efficiently delineate the mapping's range.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>AssignmentType.subtype</a:displayName>
                        <a:help>AssignmentType.subtype.help</a:help>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" ref="tns:extension">
                <xsd:annotation>
                    <xsd:documentation>
                        The assignment extension used to add parameters to the assignment.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="lifecycleState" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Lifecycle state of the assignment. This property defines whether the
                            assignment represents a draft, proposed definition, whether it is active,
                            deprecated, archived, and so on. See "Object Lifecycle" in the documentation.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                        <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000230" type="tns:LookupTableType"/>
                        <a:displayName>AssignmentType.lifecycleState</a:displayName>
                        <a:help>AssignmentType.lifecycleState.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="metadata" type="tns:MetadataType"/>

            <xsd:choice>

                <xsd:element minOccurs="0" name="targetRef" type="c:ObjectReferenceType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Target of assignment or inducement. This is the user, role, org or service that is assigned.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>AssignmentType.target</a:displayName>
                            <a:help>AssignmentType.target.help</a:help>
                            <a:objectReferenceTargetType>tns:AssignmentHolderType</a:objectReferenceTargetType>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>

                <xsd:element minOccurs="0" name="construction" type="tns:ConstructionType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Projection construction. This structure defines how a projection
                            (e.g. account) should be constructed.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>AssignmentType.construction</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>

                <xsd:element minOccurs="0" name="personaConstruction" type="tns:PersonaConstructionType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Persona construction. This structure defines how a persona
                            (e.g. virtual identity) should be constructed.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>AssignmentType.personaConstruction</a:displayName>
                            <a:since>3.6</a:since>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>

                <xsd:element minOccurs="0" name="focusMappings" type="tns:MappingsType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Set of mappings that are applied to a focus in addition to object template.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>

                <xsd:element minOccurs="0" name="policyRule" type="tns:PolicyRuleType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Policy rule that should be applied to the target object.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>AssignmentType.policyRule</a:displayName>
                            <a:help>AssignmentType.policyRule.help</a:help>
                            <a:schemaContext>
                                <a:type>tns:AssignmentHolderType</a:type>
                            </a:schemaContext>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>

            </xsd:choice>

            <xsd:element minOccurs="0" name="activation" type="tns:ActivationType"/>

            <xsd:element minOccurs="0" name="order" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Order of the inducement. Simply speaking order specifies the number
                        of assignments that the evaluation must traverse to apply the inducement.
                        The high-order inducements are used in meta-roles. These high-order inducements
                        apply to the object that is assigned to the role instead of meta-role.

                        This property specifies the summary order. This is a sum of all the (non-delegation)
                        assignments along the assignment path. More precise control over the order can
                        be achieved by using the orderConstraints.

                        If not specified and no orderConstraints are specified then the values of 1 is assumed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>AssignmentType.order</a:displayName>
                        <a:help>AssignmentType.order.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="orderConstraint" type="tns:OrderConstraintsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Constraint that defines the range of "orders" and relations when this assignment/inducement should be applied.
                        Set of orderConstraint definitions are evaluated together.
                        Each orderConstraint item specifies number (or number range) of assignment path elements with a given relation.

                        Therefore assignment path containing one manager relation and two default relations should be specified by two orderConstraint items.
                        First one specifying relation manager and order 1, the other specifying default relation and order 2 - even though the total "order" of the assignment path is three.

                        This is rather counter-intuitive, but it is current implementation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="limitTargetContent" type="tns:AssignmentSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Limitations that selects only some assignments/inducements from the target. It may be used to
                        incorporate only a part of the subrole in the role hierarchy. But it is most frequently used
                        to limit the scope of a delegation to the deputy.
                        If not specified, no limitations of this kind take place.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="limitOtherPrivileges" type="tns:OtherPrivilegesLimitationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Limitations related to other privileges, like the ability to complete work items.
                        If not specified, no limitations of this kind take place.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="focusType" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of focal object that this assignment/inducement applies to. E.g UserType, RoleType, OrgType, ...
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>AssignmentType.focusType</a:displayName>
                        <a:help>AssignmentType.focusType.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="tenantRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        Reference to the tenant which this assignment is associated with. This is an argument to the target of this
                        assignment. E.g. is if frequently used to parametrize the role which is assigned by this assignment.
                        However the exact interpretation of this value depends on the logic of the target role. It may be
                        significant or it may be entirely ignored.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>AssignmentType.tenantReference</a:displayName>
                        <a:help>AssignmentType.tenantReference.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="orgRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        Reference to the organization (org. unit, project, ...) which this assignment is associated with. This is an argument to the target of this
                        assignment. E.g. is if frequently used to parametrize the role which is assigned by this assignment.
                        However the exact interpretation of this value depends on the logic of the target role. It may be
                        significant or it may be entirely ignored.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>AssignmentType.orgReference</a:displayName>
                        <a:help>AssignmentType.orgReference.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="condition" type="tns:MappingType">
                <xsd:annotation>
                    <xsd:documentation>
                        The assignment is applied only if the condition is evaluated to true.
                        If condition is not present, it is assumed to be true.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <xsd:appinfo>
                            <a:displayName>AssignmentType.condition</a:displayName>
                        </xsd:appinfo>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="policySituation" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        The policy situation(s) of this assignment. The situations are result of
                        evaluation of the policy rules. This property is recorded for each assignment
                        and can be used for reporting, diagnostics, target selection in certification
                        campaigns, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                        <a:operational>true</a:operational>
                        <xsd:appinfo>
                            <a:displayName>AssignmentType.policySituation</a:displayName>
                            <a:help>AssignmentType.policySituation.help</a:help>
                        </xsd:appinfo>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="triggeredPolicyRule" type="tns:EvaluatedPolicyRuleType">
                <xsd:annotation>
                    <xsd:documentation>
                        Triggered policy rules for this assignment. (Not necessarily complete; subject to specified storage strategy.)
                        This is EXPERIMENTAL functionality. It is possibly to change in the near future.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="policyException" type="tns:PolicyExceptionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Recorded exception from a policy rule. The exceptions that are approved are
                        recoded here to avoid re-evaluating and re-approving them all the time.
                        This is EXPERIMENTAL functionality. It is likely to change in the near future.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.5</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="assignmentRelation" type="tns:AssignmentRelationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies what types of assignments can be made to the focal object when it is a target of an assignment.
                        This specifies possible relations of the assignment, type of assignment holder and so on.
                        Simply speaking, this specifies "who can have assignment to me" or "who can hold assignment with me as a target".
                        Limitations: assignmentRelation can appear only in archetype. It can appear in assignment or inducements, but
                        it must not have any order specification (i.e. it must be order 0 or 1).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element maxOccurs="unbounded" minOccurs="0" name="effectiveMarkRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Marks assigned to the assignment. TODO
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:MarkType</a:objectReferenceTargetType>
                        <a:experimental>true</a:experimental>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:element name="assignment" type="tns:AssignmentType"/>

    <xsd:complexType name="OrderConstraintsType">
        <xsd:annotation>
            <xsd:documentation>
                Constraint that defines the range of "orders" and relations when this assignment/inducement should be applied.
                Set of orderConstraint definitions are evaluated together.
                Each orderConstraint item specifies number (or number range) of assignment path elements with a given relation.

                Therefore assignment path containing one manager relation and two default relations should be specified by two orderConstraint items.
                First one specifying relation manager and order 1, the other specifying default relation and order 2 - even though the total "order" of the assignment path is three.

                This is rather counter-intuitive, but it is current implementation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
           <xsd:sequence>
               <xsd:element default="1" minOccurs="0" name="order" type="xsd:int">
                   <xsd:annotation>
                    <xsd:documentation>
                        Exact order to match. This is a short-hand for setting both
                        orderMin and orderMax to the same value.

                        Value of 0 (zero) means that no element with specified relation must appear in assignemnt path.

                        NOTE: This is not matching actual "order", rather than number of elements of this relation in the assignment path.
                        This is rather counter-intuitive, but it is current implementation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
               <xsd:element minOccurs="0" name="orderMin" type="xsd:string">
                   <xsd:annotation>
                    <xsd:documentation>
                        Minimum matching order. Applicable only if "order" element is not set.
                        Numeric value or string "unbounded".

                        NOTE: This is not matching actual "order", rather than number of elements of this relation in the assignment path.
                        This is rather counter-intuitive, but it is current implementation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
               <xsd:element minOccurs="0" name="orderMax" type="xsd:string">
                   <xsd:annotation>
                    <xsd:documentation>
                        Maximum matching order. Applicable only if "order" element is not set.
                        Numeric value or string "unbounded".

                        NOTE: This is not matching actual "order", rather than number of elements of this relation in the assignment path.
                        This is rather counter-intuitive, but it is current implementation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="resetOrder" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        The new value for order for this relation (or summary order), to be used when
                        evaluating subsequent inducements.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="relation" type="xsd:QName">
                   <xsd:annotation>
                    <xsd:documentation>
                        Relation to which the order constraints apply. If none present, summary (i.e. non-delegation) order is considered.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
       </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AssignmentRelationType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Specifies what types of assignments can be made to the focal object when it is a target of an assignment.
                    This specifies possible relations of the assignment, type of assignment holder and so on.
                    Simply speaking, this specifies "who can have assignment to me" or "who can hold assignment with me as a target".
                    Limitations: assignmentRelation can appear only in archetype. It can appear in assignment or inducements, but
                    it must not have any order specification (i.e. it must be order 0 or 1).
                </p>
                <p>
                    Assignment relation specification can be "wildcard", i.e. they can apply to a range of conditions.
                    E.g. if no relation is specified, the specification applies to all the relations. An extreme case is
                    an empty assignment relation, which is the ultimate wildcard. Such specification means that any
                    type, any archetype can be assigned with any relation. Which in fact means "open" assignment policy.
                    However, processing of wildcard assignment relations is limited in midPoint 4.0 (see documentation).
                </p>
                <p>
                    Assignment relation applies only to assignments by default. Therefore it controls when an assignment
                    can be made. It does not apply to inducements - yet. In later midPoint versions there will be an
                    element that can specify "order constraints". In that case assignment relation could specify properties
                    of inducements, including high-order inducements. However, the implementation in midPoint 4.0 is
                    limited to assignments.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:merger>AssignmentRelationType</a:merger>
            </xsd:appinfo>
        </xsd:annotation>
           <xsd:sequence>
               <xsd:element minOccurs="0" name="description" type="xsd:string">
                   <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
               <xsd:element minOccurs="0" ref="tns:documentation"/>
               <xsd:element maxOccurs="unbounded" minOccurs="0" name="holderType" type="xsd:QName">
                   <xsd:annotation>
                    <xsd:documentation>
                        Specification of the holder type. This specifies type of the objects that can
                        be "holders" of the assignment. If not specified at all then all object types
                        are applicable.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="holderArchetypeRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of holder archetype.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
               <xsd:element maxOccurs="unbounded" minOccurs="0" name="relation" type="xsd:QName">
                   <xsd:annotation>
                    <xsd:documentation>
                        Specification of a relation for the assignment/inducement.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: orderConstraint -->
       </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="MappingsType">
        <xsd:annotation>
            <xsd:documentation>
                Generic set of mappings.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="mapping" type="tns:MappingType">
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ActivationType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Type that defines activation properties. Determines whether something is active
                    (and working) or inactive (e.g. disabled).
                </p><p>
                    It applies to several object types. It may apply to user, account, assignment, etc.
                    The data in this type define if the described concept is active, from when it is active
                    and until when. The "active" means that it works. If something is not active, it should
                    not work or not cause any effect. E.g. inactive user should not be able to log in or run
                    any tasks, the non-active role should not be assigned and if assigned it should not be
                    taken into account when computing the accounts.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>ActivationType.activation</a:displayName>
                <a:help>ActivationType.help</a:help>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="administrativeStatus" type="tns:ActivationStatusType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            This defines the "administrative state", i.e. the administrator's decision.
                            If set, this property overrides any other constraints in the activation type.
                            E.g. if this is set to "enabled" and the object is not yet valid (according to
                            validFrom below), the user should be considered active. If set to "disabled" the
                            user should be considered inactive regardless of other settings.
                        </p><p>
                            Therefore this property does NOT define an actual state of
                            the object. It is a kind of "manual override".
                        </p><p>
                            If this property is not present then the other constraints in the activation type
                            should be considered.
                        </p><p>
                            If the administrative status is not present and there are no other constraints in
                            the activation type or if there is no activation type at all then the object is
                            assumed to be "enabled", i.e. that the described concept is active.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ActivationType.administrativeStatus</a:displayName>
                        <a:displayOrder>100</a:displayOrder>
                        <a:help>ActivationType.administrativeStatus.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="effectiveStatus" type="tns:ActivationStatusType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            This defines the "effective state", i.e. the result of combining several
                            activation settings (administrative status, validity dates, etc.).
                        </p><p>
                            This holds the result of a computation, therefore it is kind of VIRTUAL property
                            that is recomputed every time. It SHOULD NOT be set directly but it rather should be
                            computed from the values of other activation properties. Therefore it is considered
                            READ ONLY for the high-level code. It may be stored in the repository but in that
                            case it has only an informational value (the effective activation status at the time
                            the object was last updated).
                        </p><p>
                            If this property is not present then the computation haven't taken place yet.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:displayName>ActivationType.effectiveStatus</a:displayName>
                        <a:displayOrder>110</a:displayOrder>
                        <a:help>ActivationType.effectiveStatus.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="validFrom" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            A date from which is should the object be considered active.
                            Not applied if the "enabled" flag is set to any value.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ActivationType.validFrom</a:displayName>
                        <a:displayOrder>120</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="validTo" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            A date to which is should the object be considered active.
                            Not applied if the "enabled" flag is set to any value.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ActivationType.validTo</a:displayName>
                        <a:displayOrder>130</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="validityStatus" type="tns:TimeIntervalStatusType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            This property holds the result of validity period computation with respect to the current
                            date and time. E.g. it specifies whether the entity is before the validity period,
                            in the validity period or after validity period.
                        </p><p>
                            This holds the result of a computation, therefore it is kind of VIRTUAL property
                            that is recomputed every time. It SHOULD NOT be set directly but it rather should be
                            computed from the values of validity timestamps and current time. Therefore it is considered
                            READ ONLY for the high-level code. It may be stored in the repository but in that
                            case it has only an informational value (the effective activation status at the time
                            the object was last updated).
                        </p><p>
                            If this property is not present then the computation haven't taken place yet.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:displayName>ActivationType.validityStatus</a:displayName>
                        <a:displayOrder>140</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="disableReason" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            URL that identifies a reason for disable. This may be indication that that identity
                            was disabled explicitly, that the disable status was computed or other source of the
                            disabled event.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="disableTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Timestamp of the last modification of the activation status to the disabled state
                            OR of the last change of the disableReason property.

                            Note: This timestamp is used for recording purposes. Changing it will NOT change
                            the activation state.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:displayOrder>150</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="enableTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Timestamp of last modification of the activation status to the enabled state.
                            Note: This timestamp is used for recording purposes. Changing it will NOT change
                            the activation state.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:displayOrder>150</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="archiveTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Timestamp of last modification of the activation status to the archived state.
                            Note: This timestamp is used for recording purposes. Changing it will NOT change
                            the activation state.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:displayOrder>160</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="validityChangeTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Timestamp of last modification of the effective validity state, i.e. last time the validity
                            state was recomputed with result that was different from the previous recomputation. It is
                            used to avoid repeated validity change deltas.
                            Note: This timestamp is used for recording purposes. Changing it will NOT change
                            the activation state.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                        <a:displayOrder>170</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="lockoutStatus" type="tns:LockoutStatusType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            This defines the state of user or account lock-out. Lock-out means that the account
                            was temporarily disabled due to failed login attempts or a similar abuse attempt.
                        </p><p>
                            This value is usually set by the resource (or midpoint internal authentication code).
                            It is unlikely that it can be set to the "locked" value. However it usually can be used
                            to unlock the account by setting this property to "normal" value.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ActivationType.lockOutStatus</a:displayName>
                        <a:help>ActivationType.lockoutStatus.help</a:help>
                        <a:displayOrder>180</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" name="lockoutExpirationTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        Timestamp of a moment when account lockout expires and the account will
                        be normally usable again.

                        This is only an informational value. It should be considered as read-only
                        for most cases. It only makes sense if the lockoutStatus is not in the "normal" state.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ActivationType.lockOutExpiration</a:displayName>
                        <a:displayOrder>190</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ActivationStatusType">
        <xsd:annotation>
            <xsd:documentation>
                An enumeration that indicates the activation status of a particular entity.
                The activation status determines whether the entity is active (enabled)
                or inactive (disabled, archived, etc.). Please see documentation of individual
                enumeration values for more details.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="enabled">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            The entity is active.
                        </p><p>
                            It is enabled and fully operational.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="disabled">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            The entity is inactive.
                        </p><p>
                            It has been disabled, haven't reached the activation period, etc.
                            This is used to indicate that the entity is TEMPORARILY inactive
                            and there is an intent to enable the entity later.
                        </p><p>
                            Usually used for an employee on parental leave, sabbatical, temporarily disabled
                            account for security reasons, etc.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DISABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="archived">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            The entity is inactive.
                        </p><p>
                            It is no longer active and there are no plans to ever re-activate it.
                            This is a PERMANENT state of deactivation.
                        </p><p>
                            This state is used to keep the user record or account around for archival purposes.
                            E.g. some systems require that the account exists to maintain referential consistency
                            of historical data, audit records, etc. It may also be used to "blocks" the user or account
                            identifier to avoid their reuse.
                        </p><p>
                            Usually used for retired employees and similar cases.
                        </p><p>
                            DEPRECATED. The "archival" state is to be managed through the object lifecycle state instead.
                            Since 4.8, this value will not be put into "effectiveStatus" property anymore.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHIVED"/>
                        <a:deprecated>true</a:deprecated>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                        <a:plannedRemoval>4.9</a:plannedRemoval>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="TimeIntervalStatusType">
        <xsd:annotation>
            <xsd:documentation>
                Holds the result of time interval computation with respect to the current
                date and time. E.g. it specifies whether the entity is before the interval,
                in the interval or after the interval.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="before">
                <xsd:annotation>
                    <xsd:documentation>
                        Current time and date is before the interval.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BEFORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="in">
                <xsd:annotation>
                    <xsd:documentation>
                        Current time and date is in the interval.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="after">
                <xsd:annotation>
                    <xsd:documentation>
                        Current time and date is after the interval.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AFTER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="LockoutStatusType">
        <xsd:annotation>
            <xsd:documentation>
                This defines the state of account lock-out. Lock-out means that the account
                was temporarily disabled due to failed login attempts or a similar abuse attempt.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="normal">
                <xsd:annotation>
                    <xsd:documentation>
                        Account is in normal (unlocked state). It is usable without limitations.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NORMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="locked">
                <xsd:annotation>
                    <xsd:documentation>
                        The account has been locked. Log-in to the account is temporarily disabled.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOCKED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ErrorSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects error categories, e.g. for the purpose of criticality definition, selection
                which error types to handle, etc.

                EXPERIMENTAL: use with care
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="network" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects network errors (connection refused, timeouts, unreachable network, connection resets, ...)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="security" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects security issues (failed authentication, permission denied, ...)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="policy" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects policy violations. The operation failed because it violates
                        defined policies (e.g. exclusion policies), it fails data consistency checks,
                        etc.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="policyThreshold" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Policy threshold violations. The operation failed because it matched given policy rule more than defined
                        times (a threshold). This is a subtype of "policy" category.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.4</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="schema" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects schema and data format errors. These are errors that data
                        not complete, they contain unexpected elements, they do not match
                        pre-defined schema, etc.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="configuration" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects configuration errors. These are caused by misconfiguration of
                        midPoint, some of its components, the connector or the resource. This also
                        includes run-time errors that are likely caused by the configuration, such
                        as generic errors in the expressions.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="unsupported" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects "unsupported operation" issues. These errors are caused by
                        lack of functionality or support for the operation in connector
                        or any other part of midPoint. E.g. this may be missing (or disabled)
                        connector capability.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="generic" type="tns:CriticalityType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects generic, system and other non-specific issues. These errors
                        do not have any substantial definition about their cause. The error
                        may mean anything.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ErrorCategoryType">
        <xsd:annotation>
            <xsd:documentation>
                Categorizes errors. Mirrors ErrorSelectorType structure.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.3</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="network">
                <xsd:annotation>
                    <xsd:documentation>
                        Network errors (connection refused, timeouts, unreachable network, connection resets, ...).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NETWORK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="security">
                <xsd:annotation>
                    <xsd:documentation>
                        Security issues (failed authentication, permission denied, ...).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SECURITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="policy">
                <xsd:annotation>
                    <xsd:documentation>
                        Policy violations. The operation failed because it violates
                        defined policies (e.g. exclusion policies), it fails data consistency checks,
                        etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POLICY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="policyThreshold">
                <xsd:annotation>
                    <xsd:documentation>
                        Policy threshold violations. The operation failed because it matched given policy rule more than defined
                        times (a threshold). This is a subtype of "policy" category.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POLICY_THRESHOLD"/>
                        <a:since>4.4</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="schema">
                <xsd:annotation>
                    <xsd:documentation>
                        Schema and data format errors. These are errors that data
                        not complete, they contain unexpected elements, they do not match
                        pre-defined schema, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SCHEMA"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="configuration">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration errors. These are caused by misconfiguration of
                        midPoint, some of its components, the connector or the resource. This also
                        includes run-time errors that are likely caused by the configuration, such
                        as generic errors in the expressions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CONFIGURATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unsupported">
                <xsd:annotation>
                    <xsd:documentation>
                        "Unsupported operation" issues. These errors are caused by
                        lack of functionality or support for the operation in connector
                        or any other part of midPoint. E.g. this may be missing (or disabled)
                        connector capability.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNSUPPORTED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="generic">
                <xsd:annotation>
                    <xsd:documentation>
                        Generic, system and other non-specific issues. These errors
                        do not have any substantial definition about their cause. The error
                        may mean anything.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GENERIC"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="CriticalityType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies criticality of an operation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="fatal">
                <xsd:annotation>
                    <xsd:documentation>
                        Fatal criticality. Error in the operation will cause
                        fatal error. The processing will be interrupted,
                        error will be indicated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FATAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="partial">
                <xsd:annotation>
                    <xsd:documentation>
                        Partial criticality. The error will be indicated,
                        composite result of the operation will be presented
                        as partial error, but the processing will NOT be interrupted.
                        The operation may try recover and continue.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PARTIAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ignore">
                <xsd:annotation>
                    <xsd:documentation>
                        No criticality. The error will be ignored. It will not
                        be indicated as error in any result (may be indicated as handler error).
                        Warning: this may be dangerous.
                        Experimental: this is only partially supported now.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IGNORE"/>
                        <a:experimental>true</a:experimental>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- TODO: warning? -->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ShadowDiscriminatorType">
        <xsd:annotation>
            <xsd:documentation>
                Shadow discriminator uniquely identifies a projection among other projections linked to the
                same focus.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="resourceRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to a resource that is the target of reference. It may be implicit in some cases.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ResourceType</a:objectReferenceTargetType>
                        <a:displayName>ShadowDiscriminatorType.resourceRef</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="kind" type="tns:ShadowKindType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ShadowDiscriminatorType.kind</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="intent" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of projection that is the target of reference. E.g "default", "admin", "testing"
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ShadowDiscriminatorType.intent</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tag" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Tag tha distinguished shadows that have the same combination of resource+kind+intent.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ShadowDiscriminatorType.tag</a:displayName>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="objectClassName" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO exact meaning
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tombstone" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether the projection is a remnant of a deleted/dead resource object.
                        TODO should be named differently, as "tombstone" is a very specific
                        lifecycle state of a shadow. In live object (ResourceShadowDiscriminator)
                        it is called "gone".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="discriminatorOrder" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO resolve conflict with ResourceObjectTypeDependencyType
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ItemRefinedDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Description of the common item handling details, such as display name,
                read/write access and value and synchronization expressions.
                These are the parts that are common to both attributes and associations.

                This is supposed to be used in schemaHandling part and therefore
                describe the decisions of the system administrator about the
                way how that attribute or association is used in midPoint.

                Used also in object template item definitions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="ref" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        Path of the item that this definition describes. It must point to an object property or to an attribute
                        in the resource schema that belongs to an object class that is being described here.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:displayName">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.displayName</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="help" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Help text for the displayed item. Help text is usually
                            displayed when the user clicks on help/information icon.
                            This may be a longer text (several sentences).
                        </p>
                        <p>
                            This is equivalent to "help" schema annotation and can be used
                            to override it.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.help</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:description">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.documentation</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:lifecycleState">
                <xsd:annotation>
                    <xsd:documentation>
                        Lifecycle state of the item. Production configuration consists (by default) of `active`
                        and `deprecated` ones. Development configuration consists (by default) of `active` and
                        `proposed` ones. If the item is not in the configuration, it is ignored by the processing
                        at the model level - no inbound nor outbound mappings are evaluated for it, as well as no
                        (outbound) reconciliation is carried out. The effect is similar to setting "ignore" processing
                        on the model level.

                        Currently supported only for resource object items (attributes and associations).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.lifecycleState</a:displayName>
                        <a:since>4.7</a:since>
                        <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000230" type="tns:LookupTableType"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="apply" minOccurs="0" name="changeApplicationMode" type="tns:ItemChangeApplicationModeType">
                <xsd:annotation>
                    <xsd:documentation>
                        How should the computed changes of this item be regarded? (Applied, recorded, ignored.)

                        Currently supported only for resource object attributes.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.changeApplication</a:displayName>
                        <a:experimental>true</a:experimental>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="displayOrder" type="xsd:int">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.displayOrder</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="limitations" type="tns:PropertyLimitationsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Limits the usage of the attribute, e.g. whether it may is read-only, read write or entirely ignored.
                        The limitations may apply to several system layers, therefore this element may be repeated several times.
                        But it there may be only one instance for each layer.

                        Note that the support for focus items at the model layer is limited.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.limitations</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="matchingRule" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of a matching rule for an attribute. Matching rule is used to compare values
                        of the attribute. The default rule is a literal comparison which is good for most attribute
                        types and for case-sensitive strings. An alternative matching rule may be specified e.g.
                        for case insensitive strings.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.matchingRule</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="valueEnumerationRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to an object that directly or indirectly represents possible values for
                        this item. We do not define here what exactly the object has to be. It can be a lookup
                        table, script that dynamically produces the values or anything similar.
                        The object must produce the values of the correct type for this item otherwise an
                        error occurs.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:LookupTableType</a:objectReferenceTargetType>
                        <a:displayName>ItemRefinedDefinitionType.valueEnumerationRef</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
               </xsd:element>
            <xsd:element default="true" minOccurs="0" name="tolerant" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        When set to true, allows attribute/property values that are set outside midPoint (or
                        outside object template mappings).
                        The synchronization will only remove values that are assigned by midPoint (or template mappings),
                        but will tolerate extra native values.
                        When set to false, extra values are not tolerated. When midPoint detects
                        such value (e.g. during reconciliation) it will remove it.

                        Support of non-tolerant items in object templates is currently EXPERIMENTAL.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.tolerant</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="tolerantValuePattern" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Pattern (regexp) for attribute/property value. If the value matches the pattern such value is tolerated.
                        It is left in the attribute/property even if it is not derived from any mapping.

                        This element is currently supported only in resource object type definitions.
                        Support in object templates is planned.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.tolerantValuePattern</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="intolerantValuePattern" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Pattern (regexp) for attribute/property value. If the value matches the pattern such value is NOT tolerated.
                        The value must be derived from a mapping or it will be removed.

                        This element is currently supported only in resource object type definitions.
                        Support in object templates is planned.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ItemRefinedDefinitionType.intolerantValuePattern</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="displayHint" type="tns:DisplayHintType">
                <xsd:annotation>
                    <xsd:documentation>
                        <!-- todo -->
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                        <a:displayName>ItemRefinedDefinitionType.displayHint</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="emphasized" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Set true for definitions that are more important than others and that should be emphasized
                         during presentation. E.g. the emphasized definitions will always be displayed in the user
                         interfaces (even if they are empty), they will always be included in the dumps, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated>true</a:deprecated>
                        <a:deprecatedSince>4.9</a:deprecatedSince>
                        <a:since>3.4</a:since>
                        <a:displayName>ItemRefinedDefinitionType.emphasized</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="deprecated" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        This setting can be used to control the value of "deprecated" flag determined from
                        the schema. I.e. it can be used to override the value taken from the schema.
                        E.g. it can be used to "unmark" a deprecated item, so it will behave as normal,
                        non-deprecated item. This may be used as a temporary measure during the period of
                        migrating the configuration to non-deprecated setting.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                        <a:displayName>ItemRefinedDefinitionType.deprecated</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="experimental" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        This setting can be used to control the value of "experimental" flag determined from
                        the schema. I.e. it can be used to override the value taken from the schema.
                        E.g. it can be used to "unmark" an experimental item, so it will behave as normal,
                        non-experimental item.
                        USE WITH CARE. Experimental items are marked as experimental for a reason.
                        When those items are "unmarked", they will not get any less experimental.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ItemRefinedDefinitionType.experimental</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: display as FormItemDisplayType -->
            <xsd:element minOccurs="0" name="validation" type="tns:FormItemValidationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Validation rules for the item. Validation rule may be applied in the
                        user interface. But server-side validation may also be applied during
                        the computation process.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ItemRefinedDefinitionType.validation</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="persistence" type="tns:ItemPersistenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether values of this item should be persisted.
                        Currently implemented for metadata only.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ItemRefinedDefinitionType.persistence</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="correlator" type="tns:ItemCorrelatorDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Creates a single-item correlator for this item.

                        For attributes this automatically turns on "beforeCorrelation" mapping evaluation phase.
                        (If not explicitly forbidden in the attribute definition.)

                        Currently supported for attributes only.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.6</a:since>
                        <a:displayName>ItemRefinedDefinitionType.correlator</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ItemPersistenceType">
        <xsd:annotation>
            <xsd:documentation>
                Whether or how data should be persisted.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="persistent">
                <xsd:annotation>
                    <xsd:documentation>
                        Data are stored in the repository.
                        (In full object and/or in indices.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PERSISTENT"/>
                    </xsd:appinfo>
                    <!--
                     It is questionable whether we want to specify storage method in details here
                     or we should use other properties for that. Currently the storage method
                     is represented by:
                     - ResourceItemDefinitionType.storageStrategy (normal / indexOnly) - only for attributes
                     - "indexed" annotation - only in schema

                     Overall, any item stored in the repository can be stored using one of the following three methods:
                     1. in XML and "index tables"
                     2. in XML but not in the index tables
                     3. in index tables but not in XML

                     I think it's preferable to specify exact storage method separately from the fact that given
                     item should or should not be stored persistently.
                    -->
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="transient">
                <xsd:annotation>
                    <xsd:documentation>
                        Data are not stored in the repository but provided to the client
                        (e.g. when invoking preview changes).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TRANSIENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="internal">
                <xsd:annotation>
                    <xsd:documentation>
                        Data are held only during computation. They are not provided to the client.
                        (Not implemented yet.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INTERNAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="PropertyLimitationsType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:schemaMigration>
                    <a:element>tns:ignore</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:merger>PropertyLimitationsType</a:merger>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="layer" type="tns:LayerType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of a layers that this limitation applies to. If not specified then it applies
                        to all layers.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="minOccurs" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Override of schema minOccurs specification.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="maxOccurs" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Override of schema maxOccurs specification.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="auto" minOccurs="0" name="processing" type="tns:ItemProcessingType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies the "depth" of item processing - whether the item is ignored,
                        there is minimal processing or full automatic processing.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="access" type="tns:PropertyAccessType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="LayerType">
        <xsd:annotation>
            <xsd:documentation>
                Defines a system layer.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="schema">
                <xsd:annotation>
                    <xsd:documentation>
                        The lowest layer. It means that the schema is taken in almost unmodified form.
                        This efficiently means "bottom of provisioning component" from the architectural perspective.

                        This is the default.

                        Note that this means that the schemaHandling is actually applied on the schema
                        on this layer. The LayerType does not apply to the "pure" schema, therefore this
                        is the lowest practically applicable level.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SCHEMA"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="model">
                <xsd:annotation>
                    <xsd:documentation>
                        Model layer means application of schema constraints inside the IDM model.

                        This efficiently means "bottom of IDM model component" from the architectural perspective.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODEL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="presentation">
                <xsd:annotation>
                    <xsd:documentation>
                        The presentation layer that is used to display information to the user but it
                        also means presentation of the data outside midpoint. Therefore it applies both to
                        GUI and also the web service interface and also to similar interfaces.

                        This efficiently means "top of IDM model component" or "Model API" from the architectural perspective.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PRESENTATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="PropertyAccessType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="read" type="xsd:boolean"/>
            <xsd:element minOccurs="0" name="add" type="xsd:boolean"/>
            <xsd:element minOccurs="0" name="modify" type="xsd:boolean"/>
            <!-- delete does not make sense here -->
        </xsd:sequence>
    </xsd:complexType>

    <!-- TODO: somehow align with DisplayHintType in annotation-3.xsd -->
    <xsd:simpleType name="DisplayHintType">
        <xsd:annotation>
            <xsd:documentation>
                Display hints for an item.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="hidden">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HIDDEN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="regular">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REGULAR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="emphasized">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EMPHASIZED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="collapsed">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="COLLAPSED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="expanded">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXPANDED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <!-- TODO: somehow align with ItemProcessingType in annotation-3.xsd -->
    <xsd:simpleType name="ItemProcessingType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies the "depth" of item processing.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="ignore">
                <xsd:annotation>
                    <xsd:documentation>
                        Item is ignored. No processing is done at all.
                        The item will behave in the same way as it is does not
                        exists at all.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IGNORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="minimal">
                <xsd:annotation>
                    <xsd:documentation>
                        Only very minimal item processing is done. This usually means
                        that basic data structures about the item is maintained.
                        The item values may be logged. But all automatic processing,
                        presentation, transformation or any similar processing is
                        skipped. This type of processing is designed to support
                        item processing by custom code. The underlying data structures
                        will be present and they can be manipulated by custom code.
                        But any built-in automatic processing will be skipped.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MINIMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="auto">
                <xsd:annotation>
                    <xsd:documentation>
                        All usual processing of the item is applied.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AUTO"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="full">
                <xsd:annotation>
                    <xsd:documentation>
                        Full processing of the item is applied. For GUI this means that
                        automated presentation takes place. For metadata the meaning is that
                        built-in mappings are applied.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FULL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ItemChangeApplicationModeType">
        <xsd:annotation>
            <!-- TODO nouns or verbs for the modes? -->
            <xsd:documentation>
                What to do with the changes computed for the given item?
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="apply">
                <xsd:annotation>
                    <xsd:documentation>
                        Any changes for this item are treated in the traditional way: They are applied if the task runs
                        in "persistent effects" mode, and recorded if it runs in "simulation" mode.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="APPLY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="report">
                <xsd:annotation>
                    <xsd:documentation>
                        Any changes for this item are reported by adding them to the "simulation result" structure
                        (regardless of whether running in persistent-effects or simulation mode).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ignore">
                <xsd:annotation>
                    <xsd:documentation>
                        Any changes for this item are silently discarded (ignored).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IGNORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="AttributeFetchStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                The way how an attribute is fetched from the resource. Or more exactly a way how midPoint requests the
                attribute from the connector.

                This setting is used if no other (more specific) setting is specified for an attribute in the run-time.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="implicit">
                <xsd:annotation>
                    <xsd:documentation>
                        The decision whether to return an attribute is left to the connector.

                        If the attribute is returned by default, midPoint won't try to explicitly request it.
                        (Unless midPoint needs to block returning default attributes, for some reason.)

                        If the attribute is not returned by default, midPoint won't request it either.

                        This is the default. This strategy will be used if no other strategy is specified.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IMPLICIT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="explicit">
                <xsd:annotation>
                    <xsd:documentation>
                        MidPoint expects that the attribute will NOT be implicitly returned by the connector.
                        To fetch the attribute midPoint has to explicitly request it. Therefore midPoint will
                        explicitly request this attribute in each fetch request.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXPLICIT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="minimal">
                <xsd:annotation>
                    <xsd:documentation>
                        Fetch the attribute only if absolutely necessary.
                        MidPoint expects that the attribute might be implicitly returned by the connector.
                        Therefore it will try to avoid fetching this value (if possible).
                        This option can be used for values that cause performance overhead (e.g. list of members
                        of large groups).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MINIMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    <xsd:simpleType name="AttributeStorageStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                The way how an attribute is stored in repo - in case of passive caching.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="normal">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NORMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="indexOnly">
                <xsd:annotation>
                    <xsd:documentation>
                        Attribute is not stored in full repo object (XML) structure.
                        It can be queried. If needed to get it, explicit INCLUDE option has to be used.

                        Ignored for the native repository, as it stores all attributes as "index only".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INDEX_ONLY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="notIndexed">
                <xsd:annotation>
                    <xsd:documentation>
                        Attribute is not indexed. It cannot be queried. It is stored in full repo object (XML) structure only.

                        Ignored for the native repository, as it stores all attributes as "index only".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NOT_INDEXED"/>
                        <a:since>4.9</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="PasswordCompareStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                The way how a resource password is compared with the current password.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.7.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="auto">
                <xsd:annotation>
                    <xsd:documentation>
                        Auto-detect comparison method. If no way of comparison
                        is possible then an error is indicated.
                        Note: Currently this strategy will end with an error if there
                        is no cached password value.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AUTO"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="error">
                <xsd:annotation>
                    <xsd:documentation>
                        There is no way to compare password. Any operation to that
                        tries to compare the password on the resource should end
                        up with an error.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="cached">
                <xsd:annotation>
                    <xsd:documentation>
                        Compare password with the value cached in the shadow.
                        This setting assumes that passwords for all accounts are
                        properly cached. Therefore if there is no password value
                        in the shadow then we assume that there is no resource password.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CACHED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- TODO: ignore, read (compare password by reading password value), resourceAuthenticate, ... -->
        </xsd:restriction>
    </xsd:simpleType>


    <xsd:complexType name="ResourceCredentialsDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="password" type="tns:ResourcePasswordDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Defines how the password synchronization is handled for the resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ResourceBehaviorDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition for different behaviors are handled for the resource.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.9.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="lastLoginTimestamp" type="tns:ResourceLastLoginTimestampDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Defines how the last login timestamp synchronization is handled for the resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="IterationSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of iteration properties for a resource account or other resource objects.
                Iteration is a process of choosing unique (or otherwise acceptable) values. E.g. it
                is usually used to generate unique user names.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="maxIterations" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Maximum number of iteration attempts. The number specifies attempts
                        beyond the first one, which is not considered to be an iteration.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>IterationSpecificationType.maxIterations</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tokenExpression" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        An expression that will be used to format an iteration token.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>IterationSpecificationType.tokenExpression</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="preIterationCondition" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        A condition that will be executed prior to iteration. If it returns true
                        then the iteration will continue. If it returns false then the iteration
                        will be skipped (as if there is an conflict).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>IterationSpecificationType.preIterationCondition</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="postIterationCondition" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        A condition that will be executed after the iteration. If it returns true
                        then the iteration will be accepted as valid. If it returns false then
                        the iteration will be skipped (as if there is an conflict).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>IterationSpecificationType.postIterationCondition</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ProvenanceFeedDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies data provenance properties for a particular data feed (source), such as resource.
                TODO actually it's more powerful as it allows to specify other metadata items as well;
                consider renaming
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="originRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the origin object.
                        This object represents the business-wise origin of the data.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ObjectType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="acquisitionItemPopulator" type="c:PopulateItemType">
                <xsd:annotation>
                    <xsd:documentation>
                        Custom population of acquisition items.
                        Path in the populator is rooted at provenance/acquisition container in the metadata.
                        (In the future the path will be allowed to be empty i.e. the populator can provide a value for the whole acquisition.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- Or maybe we can use expression in the originRef instead? -->
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="metadataItemPopulator" type="c:PopulateItemType">
                <xsd:annotation>
                    <xsd:documentation>
                        Custom population of metadata items.
                        Path in the populator is rooted at metadata container value.
                        (In the future the path will be allowed to be empty i.e. the populator can provide a value for the whole metadata.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="useBuiltinPopulators" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Should we use built-in populators for originRef, resourceRef, actorRef, and timestamp?
                        true = always, false = never, null = only if populator returns no value
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- A flag that determines that we want to provide different values for different attributes (to speed up processing)?
                 Currently we use the same metadata for all values in given resource object. -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="CommandLineScriptType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies a command to be executed on an operating system command-line.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="macro" type="tns:ProvisioningScriptArgumentType">
                <xsd:annotation>
                    <xsd:documentation>
                        Command-line macro. Any occurrence of the macro will be replaced in the command-line code.
                        The order of arguments is not significant.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: later
            <xsd:element name="argument" type="tns:ProvisioningScriptArgumentType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Script arguments. The arguments will passed to the script
                        in any way suitable for the script. The argument name
                        is "local" to the script (script-specific). Argument name
                        must be unique in the argument set.
                        The order of arguments is not significant.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="environment" type="tns:ProvisioningScriptArgumentType" minOccurs="0" maxOccurs="unbounded">
            </xsd:element>
             -->
            <xsd:element name="executionMethod" type="tns:CommandLineExecutionMethod">
            </xsd:element>
            <xsd:element name="code" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Represents command with arguments. Sequences starting with percent sign (%) will be
                        replaced by the value of midPoint arguments to the command line script.
                        E.g. for the code bash -c "echo %source ; echo %name" the %source and %name strings will be
                        replaced by the value of midPoint arguments "source" for the path to the newly created report and "name" for the name
                        of the same report file.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="CommandLineExecutionMethod">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="exec">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Plain execution using OS services (exec).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXEC"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="shell">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Execution using UNIX-like shell (e.g. bash)
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SHELL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <!-- TODO find a better name for this! -->
    <xsd:complexType name="EvenMoreAbstractMappingType">
        <xsd:annotation>
            <xsd:documentation>
                Defines how a value of a property (or attribute) should be
                constructed. The value may be static or constructed as an
                result of evaluating an expression.

                This structure also defines a method how to merge several value
                construction definitions, how to behave if a property already
                has a value, etc.

                This is reusable data structure, used in schemaHandling, roles
                and it may also be used in may other places.

                Motivation: We need to construct attribute or property values on
                many places in midPoint. E.g. we need that in roles to generate
                dynamic account attribute values, we need that to define "templates"
                for identifiers and default values for attributes when creating a
                new account. We also need that to specify values when creating a
                new user (user templates). Having the same data structure for all of
                these cases may simplify the code, as it all can be handled by a
                generic library reused in many places through the system.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>MappingType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short name of the mapping. Used for provenance metadata management and debugging purposes.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayOrder>110</a:displayOrder>
                        <a:displayName>MappingType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="mappingAlias" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short alias of the mapping. Used for provenance metadata management and debugging purposes.
                        Alias is usually previous name of the mapping and it is used to identify mapping values which
                        were emitted in previous version of the mapping.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.mappingAlias</a:displayName>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element minOccurs="0" ref="tns:description">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" ref="tns:lifecycleState">
                <xsd:annotation>
                    <xsd:documentation>
                        Lifecycle state of the mapping. Production configuration consists (by default) of `active`
                        and `deprecated` ones. Development configuration consists (by default) of `active` and
                        `proposed` ones.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectType.lifecycleState</a:displayName>
                        <a:since>4.7</a:since>
                        <a:valueEnumerationRef oid="00000000-0000-0000-0000-000000000230" type="tns:LookupTableType"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:extension">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.extension</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="trace" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Explicitly trace the execution of this mapping. The execution will be
                        logged on INFO level if this property is set to true to make sure that it
                        will be visible in the logs.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.trace</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="authoritative" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Authoritative flag controls the way how mapping is used to remove values.
                            It does not influence adding of values.
                            If mapping is authoritative then it will add value and also remove the value.
                            If mapping is not authoritative it will only add the value.
                        </p>

                        <p>
                            Non-authoritative mappings are used if there are several possible sources for a particular value.
                            E.g. the value may be added by the mapping and also added directly on the resource by system administrator.
                            In this case midPoint cannot remove the value when the assignment (or role) containing
                            the mapping is removed because the value might have been added manually.
                            Other settings, such as tolerance may apply on attribute level.
                        </p>

                        <p>
                            The default value for authoritative flag is true.
                        </p>

                        <p>
                            Development note: Even though there is an overlap with mapping range, we still need this option.
                            Empty mapping range may avoid deletion of values that are not produced by a mapping.
                            However, the mapping may still create delete deltas in a "relative" way.
                            Setting authoritative to false disables that, making sure the mapping will never remove a value.
                            However, it is not clear how many people are actually using this feature.
                            This feature was designed in early stages of midPoint development.
                            We have more sophisticated mechanisms now.
                            Therefore, it is not clear whether this option is still needed.
                            Should it be a candidate for deprecation?
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.authoritative</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="exclusive" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Exclusive mapping may be applied only as a single mapping for a
                            particular target property. If an exclusive mapping is applied
                            together with any other mapping it results in an error.
                        </p>
                        <p>
                            The default value for exclusive flag is false.
                        </p>
                        <p>
                            Development note: Naturally enforced for single-valued items, do we need this also for multi-value?
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.exclusive</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="normal" minOccurs="0" name="strength" type="tns:MappingStrengthType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Strength of the mapping defines how aggressively will the mapping be applied.
                            The strongest mappings are applied all the time (regardless of the consequences)
                            and the weakest mappings are applied only if nothing else can be applied.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayOrder>120</a:displayOrder>
                        <a:displayName>MappingType.strength</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="channel" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Limits application of this mapping only to specific channel. If the channel is listed then the
                        mapping will be applied. If it is not then it will not be applied.
                        If no channel is specified then no limitations apply and the mapping will be applied for all channels.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.channel</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="exceptChannel" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Limits application of this mapping except for channel specified. If the channel is listed then the
                        mapping will be not applied in this channel. If it is not then it will be applied.
                        If no channel is specified then no limitations apply and the mapping will be applied for all channels.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.exceptChannel</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timeFrom" type="tns:MappingTimeDeclarationType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.timeFrom</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timeTo" type="tns:MappingTimeDeclarationType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>MappingType.timeTo</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AbstractMappingType">
        <xsd:annotation>
            <xsd:documentation>
                Defines how a value of a property (or attribute) should be
                constructed. The value may be static or constructed as an
                result of evaluating an expression.

                This structure also defines a method how to merge several value
                construction definitions, how to behave if a property already
                has a value, etc.

                This is reusable data structure, used in schemaHandling, roles
                and it may also be used in may other places.

                Motivation: We need to construct attribute or property values on
                many places in midPoint. E.g. we need that in roles to generate
                dynamic account attribute values, we need that to define "templates"
                for identifiers and default values for attributes when creating a
                new account. We also need that to specify values when creating a
                new user (user templates). Having the same data structure for all of
                these cases may simplify the code, as it all can be handled by a
                generic library reused in many places through the system.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>MappingType.details</a:displayName>
                <a:schemaMigration>
                    <a:element>tns:tolerant</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:inputFilter</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:outputFilter</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:range</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:EvenMoreAbstractMappingType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="source" type="tns:VariableBindingDefinitionType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>MappingType.source</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="expression" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>MappingType.expression</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="target" type="tns:VariableBindingDefinitionType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>MappingType.target</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="condition" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>MappingType.condition</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="true" minOccurs="0" name="enabled" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies if the mapping is enabled and is being evaluated. Default
                                    value is true. It means, that each defined mapping is by default enabled.
                                    To skip mapping evaluation, it has to be set to false.

                                    DEPRECATED. Use value DRAFT for lifecycleState element, that means same behaviour.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:deprecated>true</a:deprecated>
                                <a:deprecatedSince>4.8</a:deprecatedSince>
                                <a:plannedRemoval>4.9</a:plannedRemoval>
                                <a:displayName>MappingType.enabled</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="MappingType">
        <xsd:annotation>
            <xsd:documentation>
                Specialization of abstract mapping for regular data mappings.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>MappingType.details</a:displayName>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractMappingType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="metadataMapping" type="tns:MetadataMappingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Explicit definition of metadata mappings. Should be used only when really needed:
                                Metadata item definition is the preferred way how to express metadata handling.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:since>4.2</a:since>
                                <a:displayName>MappingType.metadataMapping</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="ignoreMetadataProcessing" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                When set, processing of given metadata item (specified by path prefix) is completely
                                ignored for this mapping. VERY EXPERIMENTAL
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:since>4.2</a:since>
                                <a:displayName>MappingType.ignoreMetadataProcessing</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="mapping" type="tns:MappingType"/>

    <xsd:simpleType name="MappingStrengthType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Strength of the mapping defines how aggressively will
                    the mapping be applied. The strongest mappings are
                    applied all the time (regardless of the consequences)
                    and the weakest mappings are applied only if nothing
                    else can be applied.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="strong">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Always applied, regardless of context. Strong mappings enforce particular values.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STRONG"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="normal">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Apply the mapping unless there is a more specific change.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NORMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="weak">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Apply the mapping only if there is a no other change on target property
                            and the target property does not have any value. This mapping strength
                            is use to set initial (default) values for attributes and properties.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WEAK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="MappingTimeDeclarationType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of time-based mapping constraints.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="referenceTime" type="tns:VariableBindingDefinitionType"/>
               <xsd:element minOccurs="0" name="offset" type="xsd:duration"/>
               <xsd:element minOccurs="0" name="expression" type="tns:ExpressionType">
                   <xsd:annotation>
                       <xsd:documentation>
                           Expression that is supposed to return the timestamp.
                           The expression may return null. In that case the time constraint will be
                           considered unsatisfied.
                       </xsd:documentation>
                       <xsd:appinfo>
                           <a:since>4.0</a:since>
                       </xsd:appinfo>
                   </xsd:annotation>
               </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="VariableBindingDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of variable which is bound to the property. This is used
                for mapping sources and targets or similar definitions that can work
                on properties of objects. It is designed to handle relativistic behavior.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:QName"/>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="path" type="t:ItemPathType">
               <xsd:annotation>
                   <xsd:documentation>
                       Path of the item (property) that is the target of the binding.
                       This is the item which is source/target of the mapping or which
                       is used for the form field. The path may not be specified if it
                       can be inferred by other means (e.g. using default source or
                       target definitions). But even in a case that the path is default
                       we may still want to define other aspects of the binding, e.g.
                       the value set or type override.
                   </xsd:documentation>
               </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="assignmentSubtype" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        If the item is assignment, here we can restrict the set with specific assignment subtype.
                        EXPERIMENTAL. Probably will be removed/replaced later.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="set" type="tns:ValueSetDefinitionType">
               <xsd:annotation>
                   <xsd:documentation>
                       Definition of the set of values for this variable. The variable
                       definition will be valid only for those variable. The evaluation
                       of the set depends on the context that the definition is used.
                       E.g. if the set is used in mapping source then it defines the
                       domain of the expression. If it used in the mapping target
                       definition then it defines range of the expression. Etc.
                   </xsd:documentation>
               </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="type" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Type override. Normally the field type will be determined
                        by the type of backing item. This field can be used as type
                        override if a different presentation is required.
                        NOT IMPLEMENTED YET
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ValueSetDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of value set. It can define a set of values by several
                methods. E.g. it can define set by a condition, enumeration of the values
                and so on.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="predefined" type="tns:ValueSetDefinitionPredefinedType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                          Pre-defined set definition, such as all or none.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="condition" type="c:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                          Expression that is evaluated to check whether the value belongs to the set.
                          If the condition returns true then the value belongs to the set. Otherwise
                          it does not.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="yieldCondition" type="c:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                          Expression that is evaluated to check whether specific value yield belongs to the set.
                          If the condition returns true then the value yield belongs to the set. Otherwise
                          it does not. VERY EXPERIMENTAL.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="additionalMappingSpecification" type="c:MappingSpecificationType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Specification of additional mappings, which are considered as part of value set. Ideal for migration
                        after rename of mapping.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: other set definition types:
                       * reference to lookup table
                       * reference to schema enumeration -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="ValueSetDefinitionPredefinedType">
        <xsd:annotation>
            <xsd:documentation>
                Pre-defined set definition, such as all or none.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="all">
                <xsd:annotation>
                    <xsd:documentation>
                        All possible elements will be part of the set.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        No values will be part of the set.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="matchingProvenance">
                <xsd:annotation>
                    <xsd:documentation>
                        Values of matching provenance (i.e. provided by the current mapping) will be
                        part of the set. Limited to target set definition for mappings.
                        Provenance metadata processing must be enabled for this to work.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MATCHING_PROVENANCE"/>
                        <a:experimental>true</a:experimental>
                        <a:since>4.2</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ExpressionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the expression (function). The name is used for several purposes.
                        If the expression is a function in a function library then this name identifies
                        the function (the name must be unique in the whole library).
                        But even if the expression is not part of the library the name may still be used
                        for diagnostic purposes.

                        Note: There are no formal limitations about the characters used in the
                        name, length of the name and so on. However, special characters in the function
                        name may prohibit reasonable use of the function in some scripting languages.
                        Therefore the recommendation is to use only alphanumeric names and to avoid
                        white spaces in the names.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" ref="tns:extension"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="parameter" type="tns:ExpressionParameterType">
                <xsd:annotation>
                    <xsd:documentation>
                        Function input parameters
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="returnType" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Formal definition of function return type. It may not be specified
                        if the expression is used in places where the return type can be
                        automatically determined (e.g. mappings).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="trace" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Explicitly trace the execution of this expression. The execution will be
                        logged on INFO level if this property is set to true to make sure that it
                        will be visible in the logs.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="stringFilter" type="tns:StringFilterType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="variable" type="tns:ExpressionVariableDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of additional variables that should be
                        present during evaluation of the expression.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="returnMultiplicity" type="tns:ExpressionReturnMultiplicityType"/>
            <xsd:element default="false" minOccurs="0" name="allowEmptyValues" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="filterEqualNull" minOccurs="0" name="queryInterpretationOfNoValue" type="tns:QueryInterpretationOfNoValueType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="runAsRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the user whose identity will be used to execute the expression.
                        The expression will use authorizations that this user has. If the expression
                        triggers any change then the change will be audited under the identity of
                        this user.
                        If no user is specified then the identify of currently logged-in user or
                        the owner of the task will be used.

                        DEPRECATED: Use "privileges" instead.
                        Cannot be present when "privileges" are used.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                        <a:deprecated>true</a:deprecated>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="privileges" type="tns:ExecutionPrivilegesSpecificationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Privileges and identity that will be used to execute the expression.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" ref="tns:expressionEvaluator">
                <xsd:annotation>
                    <xsd:documentation>
                        A single expression evaluator.
                        Although this element is formally multi-value it may be used only for multiple
                        instances of the same evaluator that in fact form a single group.
                        E.g. it may be used to define several "value" elements of literal evaluator that
                        define multiple values. But it must not be used to define multiple scripts or any
                        other combination of evaluators.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="expression" type="tns:ExpressionType">
        <xsd:annotation>
            <xsd:documentation>
                The expression that can be used to dynamically evaluate the value, e.g. in the query filter.

                It must be a top-level element so the processor of Query schema can find it. See prism query-2 schema.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>

    <xsd:complexType name="ParameterType">
        <xsd:annotation>
            <xsd:documentation>
                Describes input parameters.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.3</a:since>
                <a:container/>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the parameter
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ParameterType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="type" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Parameter type
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ParameterType.type</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ExpressionParameterType">
        <xsd:annotation>
            <xsd:documentation>
                Describes input parameters to the expression.
                Currently serves as both parameter declaration and parameter use (i.e. providing the argument value).
                <!-- TODO this should perhaps change -->
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ParameterType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="expression" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expression that determines parameter value.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ExpressionParameterType.expression</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="ExpressionReturnMultiplicityType">
        <xsd:annotation>
            <xsd:documentation>
                Expression result multiplicity.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="single">
                <xsd:annotation>
                    <xsd:documentation>
                        Single return value
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SINGLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="multi">
                <xsd:annotation>
                    <xsd:documentation>
                        Multiple return values
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MULTI"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="QueryInterpretationOfNoValueType">
        <xsd:annotation>
            <xsd:documentation>
                Defined how the expression will be interpreted in queries when it returns
                empty (or null) values.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="filterEqualNull">
                <xsd:annotation>
                    <xsd:documentation>
                        The expression will be interpreted as an EQUAL filter
                        that looks for entries with no (null) value.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FILTER_EQUAL_NULL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="filterUndefined">
                <xsd:annotation>
                    <xsd:documentation>
                        The expression will be interpreted as an UNDEFINED filter.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FILTER_UNDEFINED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="filterNone">
                <xsd:annotation>
                    <xsd:documentation>
                        The expression will be interpreted as an NONE filter.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FILTER_NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="filterAll">
                <xsd:annotation>
                    <xsd:documentation>
                        The expression will be interpreted as an ALL filter.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FILTER_ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="error">
                <xsd:annotation>
                    <xsd:documentation>
                        Error will be thrown if the expression results in
                        empty (null) values.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="StringFilterType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
    </xsd:complexType>

    <xsd:complexType name="ExpressionVariableDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of a variable. This type declares a variable name
                and defines the initial content of the variable.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Variable name. The variable will be presented to the expression using specified name.

                        The name is a QName, which is good for XML-based expression languages such as XPath.
                        For languages with flat names the namespace is fixed (see documentation of midPoint
                        language binding) and the only relevant name is the local part.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <!-- This needs to be a sequence of optional elements instead of choice due to a JAXB "feature" that generates XML not valid with the schema. -->
               <xsd:element minOccurs="0" name="path" type="t:ItemPathType"/>
            <xsd:element minOccurs="0" name="objectRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:value">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ExecutionPrivilegesSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Privileges and identity that will be used to execute an expression or similar operation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.8</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="runAsRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the user (or other focal object) whose identity will be used to execute the operation
                        in question. The operation will use authorizations that this object has. If the operation triggers
                        any change then the change will be audited under the identity of this object as well as under
                        the identity of the original principal (this is valid since 4.8).

                        If no object is specified then the identity of currently logged-in user or the owner of the task
                        will be used.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="runPrivileged" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to "true", the full authorization (i.e.
                        "http://midpoint.evolveum.com/xml/ns/public/security/authorization-3#all" on all objects)
                        will be used to execute the operation.

                        An information about elevated privileges being used will be recorded in the audit log, if any
                        audit records are produced during the operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:element abstract="true" name="expressionEvaluator"/>

    <xsd:element name="value" nillable="true" substitutionGroup="tns:expressionEvaluator" type="xsd:anyType">
        <xsd:annotation>
            <xsd:documentation>
                Static value for the attribute or property.

                Static attribute values. The values in this element should be
                assigned to the account as-is.

                List of values for the attribute provided in an appropriate XML elements
                that specify attribute name. (as is usual for properties)

                Only one attribute may be specified here, although it may have multiple
                values. Multi-valued attributes are expressed by repeating the same XML
                element multiple times.
                Hence all the XML elements that match this xsd:any must have the same
                element names (may have different values of course).


                Please note that this is nillable and therefore it may be
                explicitly set to "nil" value. Doing this means that empty
                set of values should be constructed. E.g. setting
                this to "nil" and also setting "authoritative" flag
                may enforce removal of all attribute values (if used properly).
            </xsd:documentation>
            <xsd:appinfo>
                <a:rawType/>
            </xsd:appinfo>
        </xsd:annotation>
    </xsd:element>

    <xsd:complexType name="AsIsExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Copy value as is, without any modification.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:complexType>

    <xsd:element name="asIs" substitutionGroup="tns:expressionEvaluator" type="tns:AsIsExpressionEvaluatorType"/>

    <!-- Here we use complexType to create a Java class named ConstExpressionEvaluatorType -->
    <xsd:complexType name="ConstExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:simpleContent>
            <xsd:extension base="xsd:string"/>
        </xsd:simpleContent>
    </xsd:complexType>

    <xsd:element name="const" substitutionGroup="tns:expressionEvaluator" type="tns:ConstExpressionEvaluatorType"/>

    <xsd:complexType name="FunctionExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Evaluates custom defined functions from Function Library
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="libraryRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the library where is the function
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the function to use
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="parameter" type="tns:ExpressionParameterType">
                <xsd:annotation>
                    <xsd:documentation>
                        Parameters
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="function" substitutionGroup="tns:expressionEvaluator" type="tns:FunctionExpressionEvaluatorType"/>

    <xsd:complexType name="ProportionalExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Expression gets IntegerStatType as an input, IntegerStatType is derived from collection.
                This expression evaluator may autodetect that input is a ObjectCollectionType and find IntegerStatType inside.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="style" type="tns:ProportionalStyleType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="proportional" substitutionGroup="tns:expressionEvaluator" type="tns:ProportionalExpressionEvaluatorType"/>

    <xsd:simpleType name="ProportionalStyleType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
         <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="percentage">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PERCENTAGE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        For example 42%.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="value-only">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="VALUE_ONLY"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        For example 42.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="value-slash-domain">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="VALUE_SLASH_DOMAIN"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        For example 42/100.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="value-of-domain">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="VALUE_OF_DOMAIN"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        For example 42 of 100.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="GenerateExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Generate value according to a policy that is associated with the property/attribute.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="policy" minOccurs="0" name="mode" type="tns:GenerateExpressionEvaluatorModeType"/>
            <xsd:element minOccurs="0" name="valuePolicyRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the value policy that should be used to generate the value.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ValuePolicyType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:element name="generate" substitutionGroup="tns:expressionEvaluator" type="tns:GenerateExpressionEvaluatorType"/>

    <xsd:simpleType name="GenerateExpressionEvaluatorModeType">
        <xsd:annotation>
            <xsd:documentation>
                Value generator mode.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="policy">
                <xsd:annotation>
                    <xsd:documentation>
                        Generator generates the value according to the applicable value policy (e.g. a password policy).
                        The it generates a random string that satisfies the policy. If no policy can be determined then
                        a reasonable default policy is assumed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POLICY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="uuid">
                <xsd:annotation>
                    <xsd:documentation>
                        The generator generates a random Universally Unique Identifier (UUID) string.
                        The generated UUID is currently version 4 and complies with ISO/IEC 11578:1996, but this
                        can change in the future.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UUID"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:element name="script" substitutionGroup="tns:expressionEvaluator" type="tns:ScriptExpressionEvaluatorType"/>

    <xsd:element name="path" substitutionGroup="tns:expressionEvaluator" type="t:ItemPathType"/>

    <xsd:complexType abstract="true" name="TransformExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:allowEmptyValues</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
               </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="trace" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Explicitly trace the execution of this expression. The execution will be
                        logged on INFO level if this property is set to true to make sure that it
                        will be visible in the logs.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="relativityMode" type="tns:TransformExpressionRelativityModeType">
                <xsd:annotation>
                    <xsd:documentation>
                        Relativity mode of an expression, whether expression is processed in relative or absolute more.
                        In relative mode the inputs are provided to the expression one-by-one.
                        In absolute mode all inputs are provided to the expression at the same time.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="includeNullInputs" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true (which is the default) the script will be evaluated with null value
                        as argument when the input is changed from or to an empty value. This generally works
                        well for most cases. It may be set to false as an optimization.
                        Note: default setting for this property may be overridden in specific expression evaluators.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="condition" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Condition driving whether this expression is evaluated at all (for given inputs).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="TransformExpressionRelativityModeType">
        <xsd:annotation>
            <xsd:documentation>
                Relativity mode of an expression.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="relative">
                <xsd:annotation>
                    <xsd:documentation>
                        Relative expression. Works on (partial) individual values transforming each of them one by one.
                        This is the default.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RELATIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="absolute">
                <xsd:annotation>
                    <xsd:documentation>
                        Absolute expression. Works on all the values at once. May not be entirely reliable.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ABSOLUTE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ScriptExpressionEvaluatorConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Data structure that contains all the configuration details for script execution,
                except for code itself. It is used at places where there is a need to specify
                default configuration for a group of scripts (e.g. Jasper reports).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:TransformExpressionEvaluatorType">
                <xsd:sequence>
                    <xsd:element default="http://midpoint.evolveum.com/xml/ns/public/expression/language#Groovy" minOccurs="0" name="language" type="xsd:anyURI">
                        <xsd:annotation>
                            <xsd:documentation>
                                Language of the expression. Groovy is the default language if other language is not specified.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <!--
                    TODO: Consider renaming, because returnTypeof type QName is used also in expression, which is a mere level above and can be confusing.
                     Also - this seems to do nothing at the moment, it probably ends in ScriptExpressionEvaluationContext#suggestedReturnType and is not used further.
                     Related Jira: MID-8552
                    -->
                    <xsd:element minOccurs="0" name="returnType" type="tns:ScriptExpressionReturnTypeType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The type of the expression result, either "list" or "scalar". If not set it will be
                                determined automatically from the target data type for the expression. This setting
                                should be used only if the automatic mechanism does not work as expected.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO: Consider renaming to referenceVariableMode. -->
                    <xsd:element default="object" minOccurs="0" name="objectVariableMode" type="tns:ObjectVariableModeType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies how reference variables should be provided for the script.
                                By default, they are resolved to objects.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.0</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="realValue" minOccurs="0" name="valueVariableMode" type="tns:ValueVariableModeType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Type of variables that appear in the script.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ScriptExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Generic script expression. The purpose of the expression is to return
                a value. The expression must produce something that is a piece
                of XML, which means that it may produce either string value,
                XML node or a list of XML nodes.

                The expression may use variables or arguments. However, such
                variables or arguments passed to the expression will be different
                for each invocation. It should be documented in each case this type is used.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ScriptExpressionEvaluatorConfigurationType">
                <xsd:sequence>
                    <xsd:element name="code" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Script code in the native format of the scripting language.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="ScriptExpressionReturnTypeType">
        <xsd:annotation>
            <xsd:documentation>
                The type of the expression result, either "list" or "scalar".
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="scalar">
                <xsd:annotation>
                    <xsd:documentation>
                        Single return value
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SCALAR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="list">
                <xsd:annotation>
                    <xsd:documentation>
                        Multiple return values
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LIST"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ObjectVariableModeType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies how reference variables should be provided for the script.
                By default, they are resolved to objects.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="object">
                <xsd:annotation>
                    <xsd:documentation>
                        The variables will be presented as objects, e.g. UserType, ResourceType.
                        This is very convenient for use in scripts. But it has drawbacks.
                        E.g. if the object cannot be resolved from a reference then it will be
                        presented as null. No information about the object could be determined, not
                        even its OID or name (even though such information was present in the reference).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="prismReference">
                <xsd:annotation>
                    <xsd:documentation>
                        The variable will be presented as a Prism reference value (PrismReferenceValue).
                        The reference value will contain all the information from the original reference
                        or object (OID, type, name). If the object is available or if it could be resolved
                        then the object itself will be also present in the reference value (in "object" property).
                        This method is less convenient for scripts, but it is more reliable in corner cases.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PRISM_REFERENCE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- TODO: "prismObject" that will present the variables as PrismObject<O> -->
            <!-- TODO: maybe "reference" that will present the variables as ObjectReferenceType -->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ValueVariableModeType">
        <xsd:annotation>
            <xsd:documentation>
                Type of variables that appear in the script.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="realValue">
                <xsd:annotation>
                    <xsd:documentation>
                        The variables will be presented as real values, e.g. String, XMLGregorianCalendar, UserType,
                        AssignmentType, etc.

                        This is how it was done in midPoint from its beginnings. However, for simple types (like String)
                        the metadata are lost when the real value is presented.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REAL_VALUE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="prismValue">
                <xsd:annotation>
                    <xsd:documentation>
                        The variables will be presented as prism values, e.g. PrismPropertyValue&lt;String&gt;,
                        so the metadata can be accessed by the script. This is an experimental feature.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PRISM_VALUE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="SearchObjectExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Create an expression based on search results.
                </p>
                <p>
                    Note: search expression evaluators have changed default for includeNullInputs.
                    Null inputs are NOT processed by search expression evaluators by default.
                    The reason is that null inputs are usually insignificant for search expression
                    and skipping them results in fewer search operations.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:searchOnResource</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaContext>
                    <a:typePath>targetType</a:typePath> <!-- TODO check -->
                </a:schemaContext>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:TransformExpressionEvaluatorType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="targetType" type="xsd:QName">
                    </xsd:element>
                    <xsd:element minOccurs="0" name="oid" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Fixed OID. If this OID is present then no search will be done.

                                It is planned to be used to "remember" the search result. E.g. to
                                search for the target on import and then store the fixed OID.
                                But this is not yet implemented. Actually, it can be a problem if multiple objects
                                are found by the search by filter.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="filter" type="q:SearchFilterType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Filter or filters to use to look for objects.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="inRepository" minOccurs="0" name="searchStrategy" type="tns:ObjectSearchStrategyType">
                        <xsd:annotation>
                            <xsd:documentation>
                                How we try to find matching objects. Note that when "onResourceIfNeeded" is used,
                                it is applied onto the filters individually. That means, that each filter is evaluated
                                against the repository, and if nothing is found, the resource is consulted.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="defaultTargetRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference that will be used if no target is found.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="createOnDemand" type="xsd:boolean">
                    </xsd:element>
                    <xsd:element minOccurs="0" name="populateObject" type="tns:PopulateType">
                        <xsd:annotation>
                            <xsd:documentation>
                                TODO
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="populate" type="tns:PopulateType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Populate assignment, association,... (any container) specific attributes, e.g activation status, validTo, validFrom
                                and can be also used for setting assignment parameters
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="associationTargetSearch" substitutionGroup="tns:expressionEvaluator" type="tns:SearchObjectExpressionEvaluatorType"/>

    <xsd:simpleType name="ObjectSearchStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="inRepository">
                <xsd:annotation>
                    <xsd:documentation>
                        Search is carried out in repository only.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN_REPOSITORY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="onResource">
                <xsd:annotation>
                    <xsd:documentation>
                        Search is always carried out on the resource.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ON_RESOURCE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="onResourceIfNeeded">
                <xsd:annotation>
                    <xsd:documentation>
                        Search is carried out in the repository first. If not found, then the resource is queried.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ON_RESOURCE_IF_NEEDED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AssignmentTargetSearchExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Create an expression that provides an assignment based on search results.
                </p>
                <p>
                    Note: search expression evaluators have changed default for includeNullInputs.
                    Null inputs are NOT processed by search expression evaluators by default.
                    The reason is that null inputs are usually insignificant for search expression
                    and skipping them results in fewer search operations.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:relation</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:activation</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SearchObjectExpressionEvaluatorType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="assignmentProperties" type="tns:AssignmentPropertiesSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Properties of the new assignment.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="assignmentTargetSearch" substitutionGroup="tns:expressionEvaluator" type="tns:AssignmentTargetSearchExpressionEvaluatorType"/>

    <xsd:complexType name="ReferenceSearchExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Create an expression that provides a reference based on search results.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SearchObjectExpressionEvaluatorType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="relation" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                Relation that will be set for new reference.
                                Mutually exclusive with "relationExpression".
                            </xsd:documentation>
                            <xsd:appinfo>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="relationExpression" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expression that will provide the relation for the new reference.
                                Should provide at most one value.
                                Mutually exclusive with "relation".
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.9</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="referenceSearch" substitutionGroup="tns:expressionEvaluator" type="tns:ReferenceSearchExpressionEvaluatorType"/>

    <xsd:complexType name="ShadowOwnerReferenceSearchExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                An expression evaluator that provides a reference to the owner of the shadow in question.
                Applicable to association values.

                Some of the inherited properties have little sense here and/or are simply ignored.
                In particular, explicit filter(s) are not allowed when this expression evaluator is used.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.9</a:since>
            </xsd:appinfo>
            <!-- Later: applicable to shadows and references to shadows. -->
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ReferenceSearchExpressionEvaluatorType">
                <xsd:sequence>
                    <!-- Nothing for now -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="shadowOwnerReferenceSearch" substitutionGroup="tns:expressionEvaluator" type="tns:ShadowOwnerReferenceSearchExpressionEvaluatorType"/>

    <xsd:complexType name="ShadowDiscriminatorExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Expression based on selecting a specific projection.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:description">
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="projectionDiscriminator" type="tns:ShadowDiscriminatorType">
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="assignmentFromAssociation" substitutionGroup="tns:expressionEvaluator" type="tns:ShadowDiscriminatorExpressionEvaluatorType"/>

    <xsd:complexType name="AssociationFromLinkExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of an expression that creates association from links (linkRefs)
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ShadowDiscriminatorExpressionEvaluatorType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="recurseUpOrgType" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies orgType of an organization tree to recurse upward.
                                In case that the expression applies to an org, it will recurse the org
                                tree upwards and create associations for all the orgs in the hierarchy.
                                Only orgs with the orgType matching this specification will be processed.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="assignmentPathIndex" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Index to the assignment path. This index points to the object that should
                                    be used as a source to get the link from.
                                    Index 0 is the focal object, index 1 is the first (plain) role,
                                    index 2 is meta-role, index 3 is meta-meta-role and so on.
                                    Negative index can also be used, in that case the order is reversed:
                                    index -1 is that last meta-meta-meta-...-role. index -2 is the one before
                                    and so on.
                                </p>
                                <p>
                                    If the index is not specified then a legacy algorithm will be used.
                                    The legacy algorithm is guaranteed to work up to meta-role level.
                                    For plain roles (order-one inducement) the role itself is selected.
                                    For meta-roles (order-two inducement) the first (plain) role is selected.
                                    At the meta-meta role level (order-three inducement) and above the
                                    behavior is formally undefined and it may change in any future versions.
                                    However, current behaviour roughly corresponds to assignment path index -2.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="associationFromLink" substitutionGroup="tns:expressionEvaluator" type="tns:AssociationFromLinkExpressionEvaluatorType"/>

    <xsd:complexType name="PopulateType">
        <xsd:annotation>
            <xsd:documentation>TODO</xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="populateItem" type="tns:PopulateItemType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="PopulateItemType">
        <xsd:annotation>
            <xsd:documentation>TODO</xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:expression"/>
            <xsd:element name="target" type="tns:VariableBindingDefinitionType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SequentialValueExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Get a sequential value from a named sequence.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="sequenceRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the sequence from which the value is taken.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:SequenceType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:element name="sequentialValue" substitutionGroup="tns:expressionEvaluator" type="tns:SequentialValueExpressionEvaluatorType"/>

    <xsd:complexType name="ConditionalSearchFilterType">
        <xsd:annotation>
            <xsd:documentation>
                A filter with an expression that denotes a necessary condition for the filter to be applied.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="q:SearchFilterType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="condition" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A condition that must be true in order to evaluate the filter.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <!-- CONVENIENCE ELEMENTS Following definitions are there to use in examples,
        import files, etc. These should not be used in the services -->

    <xsd:element name="objects">
        <xsd:complexType>
            <xsd:annotation>
                <xsd:documentation>
                    Object list, to be used in import files and
                    examples.
                </xsd:documentation>
                <xsd:appinfo>
                    <a:container/>
                </xsd:appinfo>
            </xsd:annotation>
            <xsd:sequence>
                <xsd:element maxOccurs="unbounded" minOccurs="0" ref="c:object"/>
            </xsd:sequence>
            <xsd:attribute name="id" type="xsd:long"/>
        </xsd:complexType>
    </xsd:element>

    <xsd:complexType name="FilterExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Filter expression.
                The expression evaluates whether a provided object matches the filter.
                This is a boolean expression, only able to return true or false.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.10</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:TransformExpressionEvaluatorType">
                <xsd:sequence>
                    <xsd:element maxOccurs="1" minOccurs="1" name="filter" type="q:SearchFilterType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Filter to match the objects against.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:element name="filter" substitutionGroup="tns:expressionEvaluator" type="tns:FilterExpressionEvaluatorType"/>


    <!-- MODEL SCHEMA -->

    <!-- The following clauses belong to the model schema, not here. But due
        to a couple of OpenESB bug (see OPENIDM-124) we were forced to include the
        whole model and identity schema in this namespace. It's bad, ugly and very
        dangerous. But there is no other known solution. If you know one, please
        let us know. We will really appreciate that. -->

    <xsd:annotation>
        <xsd:documentation>
            IDM Model schema defines the structure of roles, rules, access policies,
            method of assignment of accounts and other resource objects and all
            the properties of access control model. It is based on the identity schema,
            using concepts of User, Account Shadow and so on. IDM Model schema is
            static, it is available in compile-time.

            Current IDM model schema defines very minimal RBAC model.
            It is defined as temporary model to allow midPoint to be usable
            while we take the time to design a full-featured complex IDM model.

            Expect that the model will be replaced and do not depend
            on this schema in low-level components (except perhaps repository).
        </xsd:documentation>
    </xsd:annotation>

    <xsd:complexType abstract="true" name="AbstractRoleType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Abstract class that contains the "essence" of a role.
                    This is kind of "Roleable" interface when speaking in Java terms.
                </p>
                <p>
                    A role implies assignments. The role may "grant" accounts on resources,
                    attributes and entitlements for such accounts. The role can also assign
                    organizational units, other roles or various IDM objects
                    that can be assigned directly to user. Role is in fact just
                    a named set of assignments.
                </p>
                <p>
                    This is the basic building block of role-based access
                    control (RBAC) in the provisioning system. It defines what
                    rights (e.g. accounts) should be given to user, how they
                    should look like (attributes) and what groups or native
                    roles to assign to them (entitlements).
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:exclusion</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:ownerRef</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:approverRef</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:approverExpression</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:approvalSchema</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:approvalProcess</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:automaticallyApproved</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:policyConstraints</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:FocusType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="displayName" type="t:PolyStringType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Human-readable name of the role or org. It may be quite long, container national characters
                                    and there is no uniqueness requirement. It is used if the "name" property contains a code that
                                    is not entirely user-friendly.
                                    This properly will be deprecated soon. Use of display/label is recommended instead of displayName.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AbstractRoleType.displayName</a:displayName>
                                <a:displayOrder>9</a:displayOrder>
                                <a:help>AbstractRoleType.displayName.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="identifier" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Identifier of the role or org. It should be a structured information usually used for
                                    referring to the role or org or correlating it in various systems. E.g. numeric organizational
                                    unit identifier, role code, etc. It should be unique in its "own" scope. E.g. an organizational
                                    unit identifier should be unique in the scope of all organizational units but it may conflict
                                    with an identifier of a project.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AbstractRoleType.identifier</a:displayName>
                                <a:displayOrder>110</a:displayOrder>
                                <a:help>AbstractRoleType.identifier.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                   <xsd:element maxOccurs="unbounded" minOccurs="0" name="inducement" type="tns:AssignmentType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Inducements define the privileges and "features" that other objects should have. It is
                                    a form of indirect assignment.
                                </p>
                                <p>
                                    Unlike assignments inducements do not apply to the object in which they are specified.
                                    Inducements apply to the object that is assigned the object which contains inducements.
                                    E.g. inducements specified in a role will not be applied to the role itself.
                                    The inducements will be applied to the user that is assigned to such role.
                                </p>
                                <p>
                                    See <a href="https://docs.evolveum.com/midpoint/reference/roles-policies/assignment/assignment-vs-inducement/">Assignment vs Inducement</a>
                                    in midPoint wiki.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AbstractRoleType.inducement</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="authorization" type="tns:AuthorizationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Set of role authorizations. Authorization define fine-grained access to midPoint objects
                                    and system functionality. The authorizations that are defined in a role apply to all
                                    users that have this role assigned (such user is a "subject" of the authorizations).
                                </p>
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="requestable" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    If set to true then this role may be directly requested by the users.
                                    This is an ordinary property without any special built-in function.
                                    It does NOT directly control any access control or presentation mechanisms.
                                    Appropriate authorization rules should be defined to make this property work.
                                    E.g. see authorization statements in the default end user role.
                                </p>
                            </xsd:documentation>
                             <xsd:appinfo>
                                <a:displayName>AbstractRoleType.requestable</a:displayName>
                                 <a:help>AbstractRoleType.requestable.help</a:help>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="delegable" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    If set to true then this role may be delegated to a deputy.
                                    This is an ordinary property without any special built-in function.
                                    It does NOT directly control any access control or presentation mechanisms.
                                    Appropriate authorization rules should be defined to make this property work.
                                </p>
                            </xsd:documentation>
                             <xsd:appinfo>
                                <a:displayName>AbstractRoleType.delegable</a:displayName>
                                <a:since>3.5</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="none" minOccurs="0" name="idempotence" type="tns:IdempotenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    <p>
                                        This value indicates whether the evaluation of this role gives the
                                        same results regardless of its position in the assignment/inducement
                                        hierarchy. I.e. evaluation of this role does not depend on the assignment
                                        parameters of focus or any of the preceding roles. This flag is used
                                        to enable aggressive caching of role evaluation, so idempotent roles
                                        are only evaluated once regardless of their position in the hierarchy
                                        as we can assume that any subsequent evaluation will produce exactly
                                        the same results as the first evaluation. This is a very important
                                        feature that allows efficient evaluation of big role hierarchies.
                                    </p>
                                    <p>
                                        Marking role as idempotent is likely to result in huge performance
                                        improvements in systems with large role hierarchies. But there are
                                        also risks of incorrect evaluation of the roles.
                                        If an role is idempotent then is is also assumed that any roles included
                                        in this role are also idempotent. Therefore please take care when
                                        constructing role hierarchies. This property has a default value
                                        that indicates no idempotency.
                                    </p>
                                    <p>
                                        Rules of the thumb:
                                        Roles that are frequently used, roles that are
                                        included in many other roles and roles that combine many other roles
                                        are should be idempotent. Typical example is a "basic" roles that is
                                        assigned to almost any user and that contains a lot of smaller roles.
                                        Roles that are parametric or very dynamic should NOT be idempotent.
                                        Note: it is perfectly OK for some dynamic roles to be marked as
                                        idempotent - even if the role contains complex expressions and conditions.
                                        If those conditions depend only on the environment or properties of the
                                        focus then their outcome does not depend on their position in
                                        assignment/inducement hierarchy and these roles can be made idempotent.
                                    </p>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AbstractRoleType.idempotent</a:displayName>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="riskLevel" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Indication of the level of risk associated with the permissions that this role assigns.
                                    This may be a numeric value, textual label are any other suitable machine-processable indication.
                                </p>
                            </xsd:documentation>
                             <xsd:appinfo>
                                <a:displayName>AbstractRoleType.riskLevel</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="condition" type="tns:MappingType">
                       <xsd:annotation>
                           <xsd:documentation>
                                   <p>
                                   The role is applied only if the condition is evaluated to true.
                                   The condition is used to define conditional roles.
                                   If condition is not present, it is assumed to be true.
                               </p>
                           </xsd:documentation>
                       </xsd:annotation>
                   </xsd:element>
                    <xsd:element minOccurs="0" name="adminGuiConfiguration" type="tns:AdminGuiConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies the admin GUI configuration that should be used
                                    for the members of this role.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.4</a:since>
                                <a:displayName>AdminGuiConfigurationType.adminGuiConfiguration</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="dataProtection" type="tns:DataProtectionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies the GDPR related attributes
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                                <a:displayName>AbstractRoleType.dataProtection</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="autoassign" type="tns:AutoassignSpecificationType">
                       <xsd:annotation>
                           <xsd:documentation>
                                   <p>
                                   Specification of role auto-assignment properties. Those properties
                                   are evaluated to detect whether a role should be automatically
                                   assigned to focus.
                               </p>
                           </xsd:documentation>
                       </xsd:annotation>
                   </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="abstractRole" type="tns:AbstractRoleType"/>

    <xsd:simpleType name="IdempotenceType">
        <xsd:annotation>
            <xsd:documentation>
                This value indicates, whether the evaluation of this role gives the
                   same results regardless of its position in the assignment/inducement
                   hierarchy. I.e. evaluation of this roles does not depend on the assignment
                   parameters of focus or any of the preceding roles. This flag is used
                   to enable aggressive caching of role evaluation, so idempotent roles
                   are only evaluated once regardless of their position in the hierarchy
                   as we can assume that any subsequent evaluation will produce exactly
                   the same results as the first evaluation. This is a very important
                   feature that allows efficient evaluation of big role hierarchies.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        Role is not idempotent. The role must be evaluated for all situations:
                        all assignment paths, all orders, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="conservative">
                <xsd:annotation>
                    <xsd:documentation>
                        This value indicates, that the evaluation of this role gives the
                           same results regardless of its position in the assignment/inducement
                           hierarchy. I.e. evaluation of this roles does not depend on the assignment
                           parameters of focus or any of the preceding roles. However, the role
                           will still be re-evaluated if it is found with assignment path of
                           different depths or orders (e.g. in meta-role situations).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CONSERVATIVE"/>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="aggressive">
                <xsd:annotation>
                    <xsd:documentation>
                        This value indicates, that the evaluation of this role gives the
                           same results regardless of its position in the assignment/inducement
                           hierarchy including different path lengths and evaluation orders.
                           I.e. evaluation of this roles does not depend on the assignment
                           parameters of focus or any of the preceding roles and it has no
                           meta-role capability (e.g. higher-order inducements).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AGGRESSIVE"/>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

     <xsd:complexType name="DataProtectionType">
         <xsd:annotation>
             <xsd:documentation>
                 <p>
                     Container which specify legal content for the role related to the GDPR.
                     E.g which law enforce the presence of the attribute, who is a recipient
                     of the data, to which purposes are data used etc.
                 </p>
             </xsd:documentation>
             <xsd:appinfo>
                 <a:container/>
                 <a:since>3.7</a:since>
             </xsd:appinfo>
         </xsd:annotation>
         <xsd:sequence>
             <xsd:element minOccurs="0" name="controllerName" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         Name of the company, organization which controls data processing
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.controllerName</a:displayName>
                           <a:displayOrder>100</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="controllerContact" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         Contact information about company, organization which controls data processing
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.controllerContact</a:displayName>
                           <a:displayOrder>110</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="dpoContact" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         Contact information for data privacy officer
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.dpoContact</a:displayName>
                           <a:displayOrder>120</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="processingPurposesDescription" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Purposes for processing, e.g marketing, contract,...
                         </p>
                         <p>
                             This is a free-form field that can be used to describe data processing
                             purposes in a human-readable form suitable to be displayed to user.
                             This is NOT structured information. Structured information schema
                             is planned for future midPoint releases.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.processingPurposesDescription</a:displayName>
                           <a:displayOrder>130</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="legitimateInterestDescription" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Legitimate interest for data processing. This may be a legislation that allows
                             data processing, consent or other lawful basis.
                         </p>
                         <p>
                             This is a free-form field that can be used to describe legitimate
                             interests in a human-readable form suitable to be displayed to user.
                             This is NOT structured information. Structured information schema
                             is planned for future midPoint releases.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.legitimateInterestDescription</a:displayName>
                           <a:displayOrder>140</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="dataRecipientDescription" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Contains information about recipient of the data.
                         </p>
                         <p>
                             This is a free-form field that can be used to describe recipients
                             in a human-readable form suitable to be displayed to user.
                             This is NOT structured information. Structured information schema
                             is planned for future midPoint releases.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.dataRecipientDescription</a:displayName>
                           <a:displayOrder>150</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="periodOfStorageDescription" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             How long we need to store the data (e.g after the employee left the organization)
                         </p>
                         <p>
                             This is a free-form field that can be used to describe storage period
                             in a human-readable form suitable to be displayed to user.
                             This is NOT structured information. Structured information schema
                             is planned for future midPoint releases.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.periodOfStorageDescription</a:displayName>
                           <a:displayOrder>160</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="dataErasureDescription" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Description of data erasure practices, especially the period for data erasure.
                         </p>
                         <p>
                             This is a free-form field that can be used to describe data erasure
                             in a human-readable form suitable to be displayed to user.
                             This is NOT structured information. Structured information schema
                             is planned for future midPoint releases.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.dataErasureDescription</a:displayName>
                           <a:displayOrder>170</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="automatedDecisionMakingDescription" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Description whether automated decision making (e.g. profiling) is part of the
                             data processing.
                         </p>
                         <p>
                             This is a free-form field that can be used to describe automated decision making
                             in a human-readable form suitable to be displayed to user.
                             This is NOT structured information. Structured information schema
                             is planned for future midPoint releases.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.automatedDecisionMakingDescription</a:displayName>
                           <a:displayOrder>180</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="securityMeasuresDescription" type="xsd:string">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Description of the security measures that apply to data processing
                             (e.g. pseudonymization, confidentiality, ...)
                         </p>
                         <p>
                             This is a free-form field that can be used to describe security measures
                             in a human-readable form suitable to be displayed to user.
                             This is NOT structured information. Structured information schema
                             is planned for future midPoint releases.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>DataProtectionType.securityMeasuresDescription</a:displayName>
                           <a:displayOrder>190</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
         </xsd:sequence>
         <xsd:attribute name="id" type="xsd:long"/>
     </xsd:complexType>

     <xsd:complexType name="AutoassignSpecificationType">
         <xsd:annotation>
             <xsd:documentation>
                 <p>
                     Specification of role auto-assignment properties. Those properties
                    are evaluated to detect whether a role should be automatically
                    assigned to focus.
                 </p>
             </xsd:documentation>
             <xsd:appinfo>
                 <a:container/>
                 <a:since>3.7</a:since>
             </xsd:appinfo>
         </xsd:annotation>
         <xsd:sequence>
             <xsd:element default="false" minOccurs="0" name="enabled" type="xsd:boolean">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Flag indicating whether autoassign functionality is enabled for this
                             (abstract) role.
                         </p>
                         <p>
                             Use with care. MidPoint will have to process all the roles that
                             have this flag set to true. All the roles will be looked up, autoassign
                             specification will be processed to see if the focus is matching.
                             This will happen all the time for all modification operations.
                             Therefore it is disabled by default. Also, autoassign functionality
                             needs to be globally enabled in system configuration.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>AutoassignSpecificationType.enabled</a:displayName>
                           <a:displayOrder>100</a:displayOrder>
                           <a:indexed>true</a:indexed>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="focus" type="tns:FocalAutoassignSpecificationType">
                 <xsd:annotation>
                     <xsd:documentation>
                         This is "focal" specification. It is applied on the focus (similarly to object template).
                     </xsd:documentation>
                     <xsd:appinfo>
                           <a:displayName>AutoassignSpecificationType.focus</a:displayName>
                           <a:displayOrder>110</a:displayOrder>
                    </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <!-- TODO: later: inbound -->
         </xsd:sequence>
         <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

     <xsd:complexType name="FocalAutoassignSpecificationType">
         <xsd:annotation>
             <xsd:documentation>
                 <p>
                     Specification of role auto-assignment properties. Those properties
                    are evaluated to detect whether a role should be automatically
                    assigned to focus.
                    This is "focal" specification. It is applied on the focus (similarly
                    to object template).
                 </p>
             </xsd:documentation>
             <xsd:appinfo>
                 <a:container/>
                 <a:since>3.7</a:since>
             </xsd:appinfo>
         </xsd:annotation>
         <xsd:sequence>
             <xsd:element maxOccurs="unbounded" minOccurs="0" name="mapping" type="tns:AutoassignMappingType">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Mapping that decides whether the roles has to be assigned.
                             The mapping is supposed to produce an assignment for this role.
                             However, the assignment is fed as a default source to the
                             mapping. Therefore all that the mapping usually needs is to
                             specify the condition. However, mapping expression can still be
                             used to manipulate content of the assignment.
                         </p>
                         <p>
                             This is mostly equivalent to the object template mapping, but default
                             target is set to the assignment of this role.
                         </p>
                     </xsd:documentation>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element minOccurs="0" name="selector" type="tns:ObjectSelectorType">
                 <xsd:annotation>
                     <xsd:documentation>
                         <p>
                             Restrics autoassignment to concrete focus type (or other criteria).
                             Expressions are NOT supported here for now.
                         </p>
                     </xsd:documentation>
                     <xsd:appinfo>
                         <a:schemaContext>
                            <a:type>tns:FocusType</a:type>
                         </a:schemaContext>
                     </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <!-- TODO: later: mapping is too flexible. It is will be difficult for the
                  role managers to be set from GUI. But we can support most of the policy rule
                  constraints here (PolicyConstraintsType). -->
         </xsd:sequence>
         <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AutoassignMappingType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:MappingType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="assignmentProperties" type="tns:AssignmentPropertiesSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Properties of the new assignment.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="populate" type="tns:PopulateType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Populate the assignment with specific properties, e.g activation status, validTo, validFrom.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.0</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AssignmentPropertiesSpecificationType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="relation" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Relation that will be set for new assignment.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="subtype" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Subtype(s) that will be set for new assignment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: later: activation, lifecycle -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AuthorizationType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Authorization define fine-grained access to midPoint objects and system functionality.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string"/>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element default="allow" minOccurs="0" name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Decision that this authorization specifies. If the decision is "allow" (which is the
                            default) then this authorization allows access. If the decision is "deny" then this
                            authorization denies access. Denial is a final decisions. If at least one applicable
                            authorization denies access then the access is always denied, regardless of any other
                            allow authorizations.
                        </p>
                        <p>
                            Note: there is subtle (but important) difference between not allowing access and
                            denying access. Authorization that denies access specifies a final decision. Denied
                            access cannot be allowed by any other authorization. Deny authorization are very
                            strong from a security perspective, but it is extremely difficult to combine them
                            with other authorizations. Therefore deny authorizations are used very rarely.
                            On the other hand if the access is not allowed by a specific authorization then
                            it can still be allowed by another authorization. This makes authorizations "mergeable".
                            Not allowing access is usually the right approach.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" name="action" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Action part from the (subject,action,object) authorization triple. It is an URL to allow extension.
                        Multiple actions may be specified. In that case the authorization applies to all of them.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="phase" type="tns:AuthorizationPhaseType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies when to conduct authorization and what exactly to authorize.
                        If no phase is specified then the authorization applies to all phases.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="alwaysEnforce" minOccurs="0" name="enforcementStrategy" type="tns:AuthorizationEnforcementStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Setting that specifies when to enforce the authorization.
                        Default setting is to always enforce the authorization.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="keep" minOccurs="0" name="zoneOfControl" type="tns:ZoneOfControlType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="object" type="tns:OwnedObjectSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Object part from the (subject,action,object) authorization triple.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Specification of items that form a scope of this authorization. This authorization will
                            only affect the items specified in this element. If no items are specified then the
                            authorization applies to all items in the objects.
                        </p>
                        <p>
                            The item specification must not be combined with exceptItem. One or the other can be
                            used, but not both. If neither item nor exceptItem is specified then it is assumed
                            that the authorization applies to all items.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="exceptItem" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Specification of items that are excluded from the scope of this authorization.
                            I.e. the authorization applies to all the items except those items that are
                            specified here.
                        </p>
                        <p>
                            Note: there is subtle (but important) difference between not allowing access and
                            denying access. Authorization that denies access specifies a final decision. Denied
                            access cannot be allowed by any other authorization. Deny authorization are very
                            strong from a security perspective, but it is extremely difficult to combine them
                            with other authorizations. Therefore deny authorizations are used very rarely.
                            On the other hand if the access is not allowed by a specific authorization then
                            it can still be allowed by another authorization. This makes authorizations "mergeable".
                            Not allowing access is usually the right approach.
                            The exceptItem specification is a convenient way to "not allow" access to specific
                            items.
                        </p>
                        <p>
                            The item specification must not be combined with exceptItem. One or the other can be
                            used, but not both. If neither item nor exceptItem is specified then it is assumed
                            that the authorization applies to all items.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="target" type="tns:OwnedObjectSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Target of the operation. E.g. a role that is being assigned. It can be considered an operation
                        parameter. If no target is specified then the authorization applies to all possible targets.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="relation" type="xsd:QName">
                   <xsd:annotation>
                    <xsd:documentation>
                        Relation(s) to which the authorization applies.
                        This is applicable only to some authorizations, mostly those that
                        create new object references (e.g. assign/unassign authorizations).
                        If left empty it applies to all relations.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="orderConstraints" type="tns:OrderConstraintsType">
                   <xsd:annotation>
                    <xsd:documentation>
                        Order constraints for cases when assignment/inducement is a matter of the authorization
                        decision. Order constrain may limit the order of assignment/inducement being authorized.
                        Order constraint of zero (default) means assignment. Order constraint of one or greater
                        means inducement.
                        Note: Partially implemented in midPoint 3.9. Only values of zero and one are supported.
                        Only integer orders are supported.
                        Assignments/inducements with complex orderConstraints are not supported.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="limitations" type="tns:AuthorizationLimitationsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Limitations of this authorization when it is applied to other authorizations.
                        For example this specification may limit the power of attorney.
                        It is only applicable to some authorization types.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="exceptMetadata" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If true metadata access will not be allowed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: more elements will be added in the future: condition, parameters -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="AuthorizationDecisionType">
        <xsd:annotation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="allow">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALLOW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="deny">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DENY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="AuthorizationPhaseType">
        <xsd:annotation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="request">
                <xsd:annotation>
                    <xsd:documentation>
                        Authorize the requested operations. I.e. the authorization happens
                        at the beginning of request processing.
                        The request may be spread to many other operations but in this case
                        only the explicitly requested set is authorized.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REQUEST"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="execution">
                <xsd:annotation>
                    <xsd:documentation>
                        Authorize the executed operations. I.e. the authorization happens
                        at the end of request processing.
                        The request may be spread to many other operations but in this case
                        all the requested and computed operations are authorized.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXECUTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="AuthorizationEnforcementStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                Limitations of this authorization when it is applied to other authorizations.
                   For example this specification may limit the power of attorney.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="alwaysEnforce">
                <xsd:annotation>
                    <xsd:documentation>
                        The authorization will always be enforced for all applicable operations.
                        Even at the cost of running inefficient operation. If the authorization
                        cannot be enforced then the operation results in an error. We would rather
                        stop the operation entirely than risking data exposure.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALWAYS_ENFORCE"/>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="maySkipOnSearch">
                <xsd:annotation>
                    <xsd:documentation>
                        If this setting is applied then midPoint may skip this authorization during evaluation
                        of search operation. This is used for authorization that may be inefficient to evaluate
                        for search operations, especially when used in situations where there is another broader
                        authorization which is good enough to limit the search results.
                        Setting this strategy may cause that broader search results are returned. Use with care.
                        This setting influences search operations only. It does not influence other operations,
                        such as read, modify or assign.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MAY_SKIP_ON_SEARCH"/>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ZoneOfControlType">
        <xsd:annotation>
            <xsd:documentation>
                Defines how zone of control should be maintained.
                Zone of control is the set of objects for that particular authorization. E.g. the set
                of objects that satisfy specified filter, objects that belong to the same tenant and so on.

                Zone of control is evaluated for each particular authorization separately. Therefore the
                default setting of "keep" will not allow operation if the object leaves zone of control
                of one authorization but it enters zone of control of another authorization.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="keep">
                <xsd:annotation>
                    <xsd:documentation>
                        Always keep object in the zone of control. Do not allow any modifications that could
                        allow object to get out of zone of control of that particular authorization.
                        E.g. modify authorization will not be able to make such object modification that would
                        cause object to become unmodifiable.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="KEEP"/>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="allowEscape">
                <xsd:annotation>
                    <xsd:documentation>
                        Allow object to "escape" from the zone of control. Allow any modifications that could
                        allow object to get out of zone of control of that particular authorization.
                        E.g. modify authorization will be able to make such object modification that would
                        cause object to become unmodifiable.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALLOW_ESCAPE"/>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AuthorizationLimitationsType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Limitations of this authorization when it is applied to other authorizations.
                      For example this specification may limit the power of attorney.
                       It is only applicable to some authorization types.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="action" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Limitation of action. If any action is specified then the authorization
                        is limited only to those actions.
                        E.g. if this is applied to attorney authorization then only those
                        actions from the object are considered to be delegated to attorney.
                        Actions that are not part of this list are not delegated.
                        If the list is empty then there is no limitation. All actions
                        are delegated.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- Those limitations may come in the future:
            <xsd:element name="object" type="tns:OwnedObjectSelectorType" minOccurs="0" maxOccurs="unbounded">
            </xsd:element>
            <xsd:element name="item" type="t:ItemPathType"  minOccurs="0" maxOccurs="unbounded">
            </xsd:element>
            <xsd:element name="target" type="tns:OwnedObjectSelectorType" minOccurs="0" maxOccurs="unbounded">
            </xsd:element>  -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ObjectSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects some objects from all the objects in midPoint.

                Note that although we usually talk about "real" prism objects here,
                this selector can be also applied to sub-object structures, like case work items, and so on.

                See the "parent" item.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:merger>ObjectSelectorType</a:merger>
                <a:naturalKey>tns:name</a:naturalKey>
                <a:schemaContext>
                    <a:typePath>type</a:typePath>
                </a:schemaContext>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the selector (for troubleshooting).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectSelectorType.name</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:description">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ObjectSelectorType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="parent" type="tns:ObjectParentSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Requirements on the parent (owning) object + the position (path) of this object within the parent one.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectSelectorType.parent</a:displayName>
                        <a:elaborate>true</a:elaborate> <!-- because of recursion -->
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="type" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of the object to select.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectSelectorType.type</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="subtype" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Subtype of the object to select.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectSelectorType.subtype</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="archetypeRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Archetype of the object to select.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                        <a:since>4.0</a:since>
                        <!-- Since 4.2 it is moved from SubjectedObjectSelectorType to ObjectSelectorType. -->
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="orgRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Top node of an organizational hierarchy. All the subnodes (transitively, unlimited depth,
                            excluding the top node) are considered selected.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>ObjectSelectorType.orgRef</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="filter" type="q:SearchFilterType">
                <xsd:annotation>
                    <xsd:documentation>
                        Filter that an object must match to be considered selected by this statement.
                        This filter MUST NOT contain organization unit clauses. It may only contain
                        property clauses, logical operations and so on.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectSelectorType.filter</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="SubjectedObjectSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects some objects from all the objects in midPoint.
                This is an extension of ObjectSelectorType that adds
                criteria that relate objects to a specific subject
                (logged-in user).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectSelectorType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="orgRelation" type="tns:OrgRelationObjectSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Definition of object with respect to subject membership in organizational hierarchy.
                                    Used to specify authorizations for all objects that belong to an org where the subject is a manager, etc.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.4</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="roleRelation" type="tns:RoleRelationObjectSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Definition of object with respect to subject relation to a role.
                                    Used to specify authorizations for role approvers, owners and so on.
                                </p>
                                <p>
                                    EXPERIMENTAL. Use at your own risk.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="special" type="tns:SpecialObjectSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defines special object by relative description, such as "self".
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="allowInactive" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                If set to false (default) the specification will apply only to active relations
                                (e.g active delegations). If set to true then the specification will also be applied
                                to inactive relations (e.g. expired delegations).
                                Only partially implemented. Works only for some cases (delegator).
                                EXPERIMENTAL. Use at your own risk.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.6.1</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="OwnedObjectSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects some objects from all the objects in midPoint.
                This is an extension of SubjectedObjectSelectorType that adds
                criteria that for objects that can be owned (resource objects, roles, etc.)
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SubjectedObjectSelectorType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="owner" type="tns:SubjectedObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object matches the specification if it has an owner specified by this element.
                                The "owner" means a focus that has a link to the object.

                                LIMITATION: for search pre-processing this option is supported in a very limited way
                                (only for TaskType.ownerRef and only for "self" owners).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="delegator" type="tns:SubjectedObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object matches the specification if it has a delegator specified by this element.
                                The "delegator" means that the object has an active delegation assignment to delegator.

                                LIMITATION: only "self" delegator is supported now.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="requester" type="tns:SubjectedObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object matches the specification if it has a requester specified by this element.
                                (So it is applicable only for cases and, in the future, work items.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.9</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="assignee" type="tns:SubjectedObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object matches the specification if it has a (current) assignee specified by this element.
                                (So it is applicable only for cases and work items.)

                                LIMITATION: only "self" candidate assignee selector is supported when searching.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.9</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="candidateAssignee" type="tns:SubjectedObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object matches the specification if it has a candidate assignee
                                specified by this element. (So it is applicable only for cases and work items.)

                                LIMITATION: only "self" candidate assignee selector is supported now.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.8</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="relatedObject" type="tns:SubjectedObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object matches the specification if it has a related object specified by this element.
                                (So it is applicable only for cases and tasks and, in the future, work items.)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.9</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="tenant" type="tns:TenantSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The object matches the specification if it is related to the specified tenant.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.9</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ObjectParentSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Position of an object (an item in the language of prism) within midPoint objects structure.
                For example a case work item can be specified as having type=CaseType, path=workItem.

                Note that although technically this derives from OwnedObjectSelectorType, not all the features may be available
                in all contexts (e.g., sometimes only ObjectSelectorType features may be available).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:OwnedObjectSelectorType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="path" type="t:ItemPathType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of a path from the parent to the current object (item).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AssignmentSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects some assignments from all the assignments in the object.
                E.g. may be used to select only some assignments/inducements for a role.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="targetRef" type="c:ObjectReferenceType">
               <xsd:annotation>
                   <xsd:documentation>
                       Selects assignments that have this target reference.
                       (Target OID, type and relation is matched.)
                       Note: Filter in the reference is not yet supported.
                   </xsd:documentation>
                   <xsd:appinfo>
                       <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                   </xsd:appinfo>
               </xsd:annotation>
           </xsd:element>
           <xsd:element default="false" minOccurs="0" name="allowTransitive" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then transitive processing is enabled. E.g. transitive deputy
                        delegations (deputy of a deputy) will be processed.
                        If set to false then transitive processing is disabled. E.g. transitive
                        deputy delegations will be ignored.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="TenantSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects an object by comparing tenant information.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="false" minOccurs="0" name="sameAsSubject" type="xsd:boolean">
               <xsd:annotation>
                   <xsd:documentation>
                       Selects object/target if it has the same tenant as subject.
                       Subject must be part of the tenant (must have tenantRef set).
                       This authorization will not select any object if subject tenantRef is empty.
                   </xsd:documentation>
               </xsd:annotation>
           </xsd:element>
           <xsd:element default="false" minOccurs="0" name="includeTenantOrg" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then the tenant org (the one which the objects belongs to) is included
                        in the scope.
                        If set to false then the tenant org is excluded from the scope.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- allow empty tenant? -->
            <!-- TODO: add explicit tenantRef? -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="OtherPrivilegesLimitationType">
        <xsd:annotation>
            <xsd:documentation>
                Limitations related to other privileges, like the ability to complete work items.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="approvalWorkItems" type="c:WorkItemSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects approval work items access to which will be delegated. If not present, access to these work items is NOT delegated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated>true</a:deprecated>
                        <!-- Note: it was deprecated, but the midPoint still used it up to (excluding) 4.8 -->
                        <a:deprecatedSince>4.0</a:deprecatedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="certificationWorkItems" type="c:WorkItemSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects certification work items access to which will be delegated. If not present, access to these work items is NOT delegated.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="caseManagementWorkItems" type="c:WorkItemSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selects case management work items access to which will be delegated.
                        If not present, access to these work items is NOT delegated. Since midPoint 4.0
                        this covers all work items related to cases, i.e. both approval work items
                        and manual resource operation cases. (And others that come later.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="WorkItemSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects some work items from all the items (perhaps of a given type, like approval work items).
                E.g. may be used to delegate access to some work items only.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:description"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="all" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        True if all work items should be selected.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO finer specification of work items to allow access to -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="OrgRelationObjectSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of object with respect to subject membership in organizational hierarchy.
                Used to specify authorizations for all objects that belong to an org where the subject is a manager, etc.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="subjectRelation" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies the relation that the subject needs to have to the org for this condition to
                        trigger. This is usually null (member) relation or manager relation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="allDescendants" minOccurs="0" name="scope" type="tns:OrgScopeType">
                <xsd:annotation>
                    <xsd:documentation>
                        Scope of application that will be used to select objects relative to the reference node.
                        It determines which objects will be selected (those above or below the reference node, shallow or deep, etc.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="includeReferenceOrg" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then the reference org (the one which the subjects belongs to) is included
                        in the scope.
                        If set to false then the reference org is excluded from the scope.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="RoleRelationObjectSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Definition of object with respect to subject relation to a role.
                    Used to specify authorizations for role approvers, owners and so on.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="subjectRelation" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies the relation that the subject needs to have to the role for this condition to
                        trigger. This is usually approver or owner.
                        If not specified then any relation is accepted.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>RoleRelationObjectSpecificationType.subjectRelation</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="objectRelation" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies the relation that the target needs to have to the role for this condition to
                        trigger. This is usually default relation (member).
                        If not specified then any relation is accepted.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>RoleRelationObjectSpecificationType.objectRelation</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="includeMembers" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then the members of reference role (the one which the subjects belongs to)
                        are included in the scope (limited by objectRelation).
                        If set to false then the members of reference role is excluded from the scope
                        (objectRelation is not used in this case).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>RoleRelationObjectSpecificationType.includeMembers</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="includeReferenceRole" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then the reference role (the one which the subjects belongs to) is included
                        in the scope.
                        If set to false then the reference role is excluded from the scope.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>RoleRelationObjectSpecificationType.includeReferenceRole</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="OrgScopeType">
        <xsd:annotation>
            <xsd:documentation>
                Defines applicability scope in the organizational structures.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="directDescendants">
                <xsd:annotation>
                    <xsd:documentation>
                        Direct descendants of the reference node. I.e. all the nodes
                        that are exactly one level below.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DIRECT_DESCENDANTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="allDescendants">
                <xsd:annotation>
                    <xsd:documentation>
                        All descendants of the reference node, including descendants of descendants.
                        I.e. all the nodes that are one or more levels below.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL_DESCENDANTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="allAncestors">
                <xsd:annotation>
                    <xsd:documentation>
                        All ancestors of the reference node, including ancestors of ancestors.
                        I.e. all the nodes that are on any path between the reference node and the
                        root node.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL_ANCESTORS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        No objects belong to the scope. Used in conjunction with
                        includeReferenceOrg option to target only the reference node
                        and no other node in the hierarchy.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="SpecialObjectSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Specification used to select special cases that are usually context-relative.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="self">
                <xsd:annotation>
                    <xsd:appinfo>
                        <xsd:documentation>
                            Object that represents itself. This usually represents an
                            object that corresponds to a currently logged-in user.
                            E.g. it may be used to allow each user to change his own password.
                        </xsd:documentation>
                        <jaxb:typesafeEnumMember name="SELF"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="selfDeputyAssignment">
                <xsd:annotation>
                    <xsd:appinfo>
                        <xsd:documentation>
                            "Deputy" assignment that points to the subject.
                            May be replaced with something more general in the future.
                        </xsd:documentation>
                        <jaxb:typesafeEnumMember name="SELF_DEPUTY_ASSIGNMENT"/>
                        <a:since>4.8</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="selfDeputyRef">
                <xsd:annotation>
                    <xsd:appinfo>
                        <xsd:documentation>
                            "Deputy" reference that points to the subject.
                            May be replaced with something more general in the future.
                        </xsd:documentation>
                        <jaxb:typesafeEnumMember name="SELF_DEPUTY_REF"/>
                        <a:since>4.8</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="RoleType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    A role in the extended Role-Based Access Control (RBAC) sense.
                    The roles specify privileges that the user (or other object) should have.
                </p>
                <p>
                    The role may "grant" accounts on resources, attributes and
                    entitlements for such accounts. The role can also assign
                    organizational units, other roles or various IDM objects
                    that can be assigned directly to user. From this point of
                    view the role is in fact just a named set of assignments.
                </p>
                <p>
                    The roles form the basic building block of midPoint's extended
                    role-based access control (RBAC) mechanism. It defines what
                    rights (e.g. accounts) should be given to user, how they
                    should look like (attributes) and what groups or native
                    roles to assign to them (entitlements).
                </p>
                <p>
                    Roles can also specify user authorizations to access specific
                    parts of midPoint. This is used to implement fine-grained authorization
                    mechanism. When combined with organizational structure it forms a
                    delegated administration mechanism.
                </p>
                <p>
                    Roles can also be conditional, i.e. applicable only if a specific
                    condition is true. Roles can be parametric, e.g. the expressions
                    inside the role can use parameters that were specified at the time
                    when the role was assigned (as opposed to parameters defined when
                    the role was defined).
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:roleType</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractRoleType">
                <xsd:sequence>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="role" substitutionGroup="tns:object" type="tns:RoleType"/>

    <xsd:complexType name="PolicyType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Object containing elements of business or governance policy.
                    Policy objects usually contain policy rules.
                    However, they may also be used to build up policy structures, such as classifications and clearances.
                </p>
                <p>
                    Policy objects are usually used as meta-roles.
                    They contain inducements, usually high-order inducements, which are applied to roles, users, services and other objects using the RBAC mechanisms.
                    Policy objects technically act almost identically to roles.
                    However, they have very different meaning and usage.
                    Therefore, separate data type is created policy objects, to clearly distinguish them from ordinary roles.
                    Such division is very helpful for presentation (user interface), reporting and general understanding of policy structures.
                </p>
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractRoleType">
                <xsd:sequence>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="policy" substitutionGroup="tns:object" type="tns:PolicyType"/>

    <xsd:element name="approverRef" type="tns:ObjectReferenceType"/>

    <xsd:complexType abstract="true" name="AbstractConstructionType">
       <xsd:annotation>
               <xsd:documentation>
                   Abstract supertype for constructions.
               </xsd:documentation>
           <xsd:appinfo>
               <a:container/>
           </xsd:appinfo>
       </xsd:annotation>
        <xsd:sequence>
           <xsd:element minOccurs="0" name="description" type="xsd:string">
                   <xsd:annotation>
                   <xsd:appinfo>
                    <a:displayName>AbstractConstructionType.description</a:displayName>
                   </xsd:appinfo>
               </xsd:annotation>
           </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
           <xsd:element default="strong" minOccurs="0" name="strength" type="tns:ConstructionStrengthType">
               <xsd:annotation>
                   <xsd:documentation>
                       Strength of the construction defines how aggressively will
                        the construction be applied. Strong constructions are applied
                        all the time (relative changes, reconciliation, ...).
                        Weak constructions are applied only if there is another
                        strong construction.
                   </xsd:documentation>
                   <xsd:appinfo>
                    <a:since>3.5</a:since>
                    <a:displayName>AbstractConstructionType.strength</a:displayName>
                    <a:help>AbstractConstructionType.strength.help</a:help>
                   </xsd:appinfo>
               </xsd:annotation>
           </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ConstructionType">
       <xsd:annotation>
               <xsd:documentation>
                   Projection construction. This structure defines how a projection
                (e.g. account) should be constructed.
               </xsd:documentation>
           <xsd:appinfo>
               <a:container/>
               <a:schemaContext>
                   <a:algorithm>ShadowConstructionContextResolver</a:algorithm>
               </a:schemaContext>
           </xsd:appinfo>
       </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractConstructionType">
                <xsd:sequence>
                     <xsd:element minOccurs="0" ref="c:extension"/>
                     <xsd:element minOccurs="0" name="resourceRef" type="c:ObjectReferenceType">
                         <xsd:annotation>
                             <xsd:documentation>
                                 Reference to a resource that should host the implied account.
                             </xsd:documentation>
                             <xsd:appinfo>
                                 <a:objectReferenceTargetType>tns:ResourceType</a:objectReferenceTargetType>
                             </xsd:appinfo>
                         </xsd:annotation>
                     </xsd:element>
                     <xsd:element default="account" minOccurs="0" name="kind" type="tns:ShadowKindType">
                         <xsd:annotation>
                             <xsd:documentation>
                                 Kind of resource object that should be created on the resource.

                                 This element is optional. If not specified defaults to account kind.
                             </xsd:documentation>
                             <xsd:appinfo>
                                 <a:displayName>ConstructionType.kind</a:displayName>
                                 <a:help>ConstructionType.kind.help</a:help>
                             </xsd:appinfo>
                         </xsd:annotation>
                     </xsd:element>
                     <xsd:element minOccurs="0" name="intent" type="xsd:string">
                         <xsd:annotation>
                             <xsd:documentation>
                                 Intent of resource object that should be created on the resource.

                                 This must point to a valid definition in
                                 the resource object (in schemaHandling section).

                                 This element is optional. If not specified then the definition
                                 marked as default in the resource definition should be used.
                             </xsd:documentation>
                             <xsd:appinfo>
                                 <a:displayName>ConstructionType.intent</a:displayName>
                                 <a:help>ConstructionType.intent.help</a:help>
                             </xsd:appinfo>
                         </xsd:annotation>
                     </xsd:element>
                     <xsd:element maxOccurs="unbounded" minOccurs="0" name="attribute" type="tns:ResourceAttributeDefinitionType">
                         <xsd:annotation>
                             <xsd:documentation>
                                 Resource object attribute values implied by this role.
                                 When the role is assigned the attributes specified
                                 below should be assigned values specified below.
                             </xsd:documentation>
                             <xsd:appinfo>
                                <a:displayName>ConstructionType.attribute</a:displayName>
                            </xsd:appinfo>
                         </xsd:annotation>
                     </xsd:element>
                     <xsd:element maxOccurs="unbounded" minOccurs="0" name="association" type="tns:ResourceObjectAssociationType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>ConstructionType.association</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                     </xsd:element>
                     <xsd:element maxOccurs="unbounded" minOccurs="0" name="auxiliaryObjectClass" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                The reference to additional type definitions for this object. These auxiliary object
                                classes will be added to the resource object when the construction is provisioned.

                                The reference should
                                point to object class definition (complex type definition in resource schema) and
                                this definition should be marked as auxiliary.
                            </xsd:documentation>
                             <xsd:appinfo>
                                 <a:displayName>ConstructionType.auxiliaryObjectClass</a:displayName>
                                 <a:help>ConstructionType.auxiliaryObjectClass.help</a:help>
                             </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
               </xsd:sequence>
               </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="construction" type="tns:ConstructionType"/>

    <xsd:simpleType name="ConstructionStrengthType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Strength of the construction defines how aggressively will
                    the construction be applied. Strong constructions are applied
                    all the time (relative changes, reconciliation, ...).
                    Weak constructions are applied only if there is another
                    strong construction.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="strong">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Always applied, regardless of context.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STRONG"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="weak">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Construction is applied only if there is another
                            strong construction for the same project. I.e.
                            weak construction do not entitle the focus to anything
                            just by themselves. There must be another reason for the
                            projection to exist. If there is, then the weak construction
                            will be also applied. If it is not then the weak construction
                            is ignored.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WEAK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="PersonaConstructionType">
       <xsd:annotation>
               <xsd:documentation>
                   Persona construction. This structure defines how a persona
                (e.g. virtual identity) should be constructed.
               </xsd:documentation>
           <xsd:appinfo>
               <a:container/>
               <a:since>3.6</a:since>
           </xsd:appinfo>
       </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractConstructionType">
                <xsd:sequence>
                    <xsd:element name="targetType" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                Object type of the target persona (e.g. UserType).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.6</a:since>
                                </xsd:appinfo>
                            </xsd:annotation>
                        </xsd:element>
                        <xsd:element maxOccurs="unbounded" minOccurs="0" name="targetSubtype" type="xsd:string">
                            <xsd:annotation>
                                <xsd:documentation>
                                    Object subtype of the target persona.
                                    Constructions with the same type and subtype configuration are
                                    interpreted as if they describe the same persona.

                                    REMOVED, use archetypeRef instead
                                </xsd:documentation>
                                <xsd:appinfo>
                                    <a:since>3.6</a:since>
                                    <a:removed>true</a:removed>
                                    <a:deprecatedSince>4.4</a:deprecatedSince>
                                    <a:removedSince>4.8</a:removedSince>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="objectMappingRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the object template that will be used to map values
                                from the source object (e.g. physical user) to the persona
                                (e.g. virtual identity user).
                                Unlike ordinary object template that has the same object as input and
                                output, this object mapping will have one object as an input and the
                                other as an output.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="archetypeRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Archetype of the target persona.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                                <a:since>4.4</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ObjectTemplateType">
        <xsd:annotation>
            <xsd:documentation>
                TODO: update
                The user template used to create new users. It
                contains fixed values or expressions that can set up
                a new user object. It is used only during user creation in the
                synchronization code, but will be most likely used also
                on other places later.

                The goal is to make this a kind of "policy" how the use object
                should look like and check it on every user modification.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="includeRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Included template. All the contents of the included template is processed as if it
                                was directly placed in this template. Limitations: 1. This reference does not support dynamic
                                (run-time evaluated) filters. 2. There should be no overlapping item definitions nor mappings
                                in the child templates.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                                <a:displayName>ObjectTemplateType.includeRef</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="iterationSpecification" type="tns:IterationSpecificationType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>ObjectTemplateType.iterationSpecification</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="tns:ObjectTemplateItemDefinitionType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>ObjectTemplateType.item</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="mapping" type="tns:ObjectTemplateMappingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Generic mapping that defines how object properties should be constructed.
                                </p><p>
                                There is a major overlap of this mechanism with the "item" element of
                                object template. However, the overlap is not complete. The "item" functionality
                                can influence the presentation of the items, interpretation of schema and so on.
                                At the other hand this "mapping" mechanism can provide mappings that are not bound
                                to any specific target item. This can be useful for a variety of "validation" mappings
                                and other special-purpose configurations. Therefore both elements are needed.
                            </p><p>
                                However, it is STRONGLY RECOMMENDED to use the "item" mechanism whenever possible.
                                This "mapping" mechanism should be used only in situation when no other mechanism
                                would do the job.
                            </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectTemplateType.mapping</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="meta" type="tns:MetadataHandlingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Definition of handling of a metadata items.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="multiSource" type="tns:MultiSourceDataHandlingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Definition of handling of the data in "multi-source" mode.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.6</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="correlation" type="tns:ObjectTemplateCorrelationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Definition of correlation for the corresponding focus objects.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.6</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="objectTemplate" substitutionGroup="c:object" type="tns:ObjectTemplateType"/>

    <xsd:complexType name="ObjectTemplateItemDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO

                Description of the common item handling details, such as display name,
                read/write access and value and synchronization expressions.
                These are the parts that are common to both attributes and associations.

                This is supposed to be used in schemaHandling part and therefore
                describe the decisions of the system administrator about the
                way how that attribute or association is used in midPoint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:naturalKey>tns:ref</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ItemRefinedDefinitionType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="mapping" type="tns:ObjectTemplateMappingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defines how any of the object property value should
                                be constructed. It can contain fixed value or
                                an expression.

                                In case an expression is used following variables should be set:
                                $user - The user object being created.
                                $account - (optional) the account from which was the user created (if present)
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectTemplateItemDefinitionType.mapping</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="meta" type="tns:MetadataHandlingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Definition of handling of a metadata items for this particular item.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="indexing" type="tns:ItemIndexingDefinitionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defines "indexing" of item value or values, i.e. their transformation to a form suitable
                                for advanced - for example, fuzzy - searching.

                                Indexing is needed in two typical cases (often overlapping):

                                - Either when a special transformation is necessary (e.g., taking first N characters of
                                the normalized form; or a unique custom transformation)
                                - and/or when we need to index data that are not searchable by default (e.g. multi-provenance
                                properties, or properties not indexed by the repository).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.6</a:since>
                                <a:experimental>true</a:experimental>
                                <a:displayName>ObjectTemplateItemDefinitionType.indexing</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="multiSource" type="tns:MultiSourceItemDefinitionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Marks the item as the one with multiple sources. Such items are not stored directly in their
                                "main" place in the focus objects, but in $focus/identities/identity[x]/data object instead.
                                (Where identity[x] is the value assigned to the given source.) Then there may be special
                                mapping or mappings devoted to the selection of the value or values to be stored right
                                to the "main" place of the focus item.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.6</a:since>
                                <a:experimental>true</a:experimental>
                                <a:displayName>ObjectTemplateItemDefinitionType.multiSource</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="correlation" type="tns:ItemCorrelationDefinitionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies the correlation-related aspects of this item, for example, the search method to be used
                                by default.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.6</a:since>
                                <a:experimental>true</a:experimental>
                                <a:displayName>ObjectTemplateItemDefinitionType.correlation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
          </xsd:extension>
       </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ObjectTemplateMappingType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:MappingType">
                <xsd:sequence>
                    <xsd:element default="beforeAssignments" minOccurs="0" name="evaluationPhase" type="tns:ObjectTemplateMappingEvaluationPhaseType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>ObjectTemplateMappingType.evaluationPhase</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="ObjectTemplateMappingEvaluationPhaseType">
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="beforeAssignments">
                <xsd:annotation>
                    <xsd:documentation>
                        Evaluation of template mappings before assignments are evaluated.
                        This is the most common phase for template mappings.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BEFORE_ASSIGNMENTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="afterAssignments">
                <xsd:annotation>
                    <xsd:documentation>
                        Evaluation of template mappings after assignments are evaluated
                        but before uniqueness check is done and before projections are considered.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AFTER_ASSIGNMENTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="afterProjections">
                <xsd:annotation>
                    <xsd:documentation>
                        Evaluation of template mappings after activation and values of projections
                        are processed. So, it is possible to use e.g. hasLinkedAccount function call
                        here to determine the new state of a projection. On the other hand, results of
                        these mappings are not reflected in projection outbound mappings.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <a:since>4.2</a:since>
                        <jaxb:typesafeEnumMember name="AFTER_PROJECTIONS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="InboundMappingType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:MappingType">
                <xsd:sequence>
                    <xsd:choice>
                        <xsd:element minOccurs="0" name="evaluationPhases" type="tns:InboundMappingEvaluationPhasesType">
                            <xsd:annotation>
                                <xsd:documentation>
                                    Phase or phases in which the mapping should be evaluated.
                                    (Default evaluation phases for given object type are taken into account as well.)
                                    Mutually exclusive with "use" item.
                                </xsd:documentation>
                                <xsd:appinfo>
                                    <a:displayName>InboundMappingType.evaluationPhases</a:displayName>
                                </xsd:appinfo>
                            </xsd:annotation>
                        </xsd:element>
                        <xsd:element minOccurs="0" name="use" type="tns:InboundMappingUseType">
                            <xsd:annotation>
                                <xsd:documentation>
                                    What purpose or purposes does the inbound mapping serve?
                                    This is a simplified version of "evaluationPhases" item and is mutually exclusive with it.
                                    If present, it overrides any default evaluation phases.
                                </xsd:documentation>
                                <xsd:appinfo>
                                    <a:displayOrder>130</a:displayOrder>
                                    <a:displayName>InboundMappingType.use</a:displayName>
                                    <a:since>4.8</a:since>
                                </xsd:appinfo>
                            </xsd:annotation>
                        </xsd:element>
                    </xsd:choice>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="InboundMappingEvaluationPhasesType">
        <xsd:annotation>
            <xsd:documentation>
                Phase or phases in which the mapping should be evaluated.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="include" type="tns:InboundMappingEvaluationPhaseType">
                <xsd:annotation>
                    <xsd:documentation>
                        Phase(s) to include - in addition to the default ones.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="exclude" type="tns:InboundMappingEvaluationPhaseType">
                <xsd:annotation>
                    <xsd:documentation>
                        Phase(s) to exclude, assuming they are defined as default.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="DefaultInboundMappingEvaluationPhasesType">
        <xsd:annotation>
            <xsd:documentation>
                Default phase or phases for evaluation of inbound mappings.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="phase" type="tns:InboundMappingEvaluationPhaseType">
                <xsd:annotation>
                    <xsd:documentation>
                        Phase(s) in which mappings are evaluated by default.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="InboundMappingEvaluationPhaseType">
        <xsd:restriction base="xsd:string">
            <!-- TODO should we distinguish individual states of clockwork,
                  e.g. initial vs. after execution in secondary state? -->
            <xsd:enumeration value="clockwork">
                <xsd:annotation>
                    <xsd:documentation>
                        Evaluation of inbound mappings during clockwork execution.
                        This is the default. (And the only way of inbounds evaluation before midPoint 4.5.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLOCKWORK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- TODO are there any other uses of these mappings before clockwork run? -->
            <!-- One is "during correlation" when e.g. ID Match could transform referenceId from context to user,
                 and we could then correlate on the mapped value. But not today. -->
            <xsd:enumeration value="beforeCorrelation">
                <xsd:annotation>
                    <xsd:documentation>
                        Evaluation of inbound mappings during correlation - i.e. when looking for candidate owner(s).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BEFORE_CORRELATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="InboundMappingUseType">
        <xsd:annotation>
            <xsd:documentation>
                What purpose or purposes does the inbound mapping serve?
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="synchronization">
                <xsd:annotation>
                    <xsd:documentation>
                        The mapping is used for the synchronization, i.e. moves data from the resource objects to focus objects.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SYNCHRONIZATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="correlation">
                <xsd:annotation>
                    <xsd:documentation>
                        The mapping is used for the correlation. It prepares data for correlation rules, but does not
                        directly manipulate the content of the focus objects.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CORRELATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="all">
                <xsd:annotation>
                    <xsd:documentation>
                        The mapping is used for all purposes: currently, this means both correlation and data transfer.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="OrgType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Organizational unit, division, section, object group, team, project or any other form of
                    organizing things and/or people. The OrgType objects are designed to form a hierarchical
                    organizational structure (or rather several parallel organizational structures).
                </p>
                <p>
                    Orgs are designed for grouping of objects. Orgs usually group users, but they can group any kind
                    of objects (roles, policies, resources, etc.) This can be used to create a flexible delegated
                    administration setup.
                </p>
                <p>
                    See <a href="https://docs.evolveum.com/midpoint/reference/org/organizational-structure/">Organizational Structure</a>
                    in midPoint wiki for a general introduction to the concepts.
                </p>
                <p>
                    The OrgType is also used as a focal object for generic synchronization. In that case the Orgs can correspond
                    to LDAP OUs or groups or any similar resource objects.
                </p>
                <p>
                    OrgType is also a role (RoleType). This feature may not be used for majority of
                    OrgType instances. But it is very useful if membership in an org unit automatically
                    grants some accounts or roles. Although roles and orgs are very similar there is one principal
                    difference: Orgs are designed for grouping, roles are designed for flexible policy definition.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:passwordPolicyRef</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:orgType</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractRoleType">
                <xsd:sequence>

                    <xsd:element default="false" minOccurs="0" name="tenant" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Flag indicating whether this object is a tenant or not. Tenants are top-level
                                    organizational units of organizational structures that are designed to be independent
                                    of one another. It represents a "customer" is service provider environment.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>OrgType.isTenant</a:displayName>
                                <a:displayOrder>130</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="mailDomain" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Domain part of RFC822 e-mail address that applies to this organization.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>OrgType.mailDomain</a:displayName>
                                <a:displayOrder>220</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="displayOrder" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    The content of this property specifies an order in which the organization
                                    should be displayed relative to other organizations at the same level.
                                    Organizations will be displayed by sorting them by the values of displayOrder
                                    property (ascending). These that do not have any displayOrder annotation
                                    will be displayed last. Organizations with the same displayOrder
                                    are displayed in alphabetic order.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>OrgType.displayOrder</a:displayName>
                                <a:displayOrder>300</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="securityPolicyRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Reference to the security policy settings which will be used for this organization.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:SecurityPolicyType</a:objectReferenceTargetType>
                                <a:displayName>OrgType.securityPolicy</a:displayName>
                                <a:displayOrder>230</a:displayOrder>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="org" substitutionGroup="c:object" type="tns:OrgType"/>

    <xsd:complexType name="ServiceType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    This object type represents any kind of abstract or concrete services or devices such as servers, virtual machines,
                    printers, mobile devices, network nodes, application servers, applications or anything similar. The "service" is a
                    very abstract concept.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:serviceType</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractRoleType">
                <xsd:sequence>

                    <xsd:element minOccurs="0" name="displayOrder" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    The content of this property specifies an order in which the service
                                    should be displayed relative to other services at the same level.
                                    Services will be displayed by sorting them by the values of displayOrder
                                    property (ascending). These that do not have any displayOrder annotation
                                    will be displayed last. Services with the same displayOrder
                                    are displayed in alphabetic order.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ServiceType.displayOrder</a:displayName>
                                <a:displayOrder>300</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="url" type="xsd:anyURI">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    URL that points to the location of the service.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ServiceType.URL</a:displayName>
                                <a:displayOrder>150</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="service" substitutionGroup="c:object" type="tns:ServiceType"/>

    <xsd:complexType name="ArchetypeType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Archetype definition. Archetype defines custom object (sub)type. I.e. it defines specific behavior,
                    look and feel of objects of a particular type, such as "employee", "project", "application", "business role"
                    and so on.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractRoleType">
                <xsd:sequence>

                    <xsd:element minOccurs="0" name="archetypePolicy" type="tns:ArchetypePolicyType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Definition of archetype policies, such as object template, lifecycle, type display properties and so on.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ArchetypeType.archetypePolicy</a:displayName>
                                <a:displayOrder>120</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="superArchetypeRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Super archetype from which is extended with this archetype.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ArchetypeType.superArchetypeRef</a:displayName>
                                <a:help>AssignmentType.superArchetypeRef.help</a:help>
                                <a:objectReferenceTargetType>tns:ArchetypeType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="archetypeType" type="tns:ArchetypeTypeType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Type of the archetype determining how it can be assigned and used.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ArchetypeType.archetypeType</a:displayName>
                                <a:displayOrder>120</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="securityPolicyRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Reference to the security policy settings which will be applied to the objects
                                    with this archetype assigned. For now only structural archetypes can have a link to
                                    the security policy.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:SecurityPolicyType</a:objectReferenceTargetType>
                                <a:displayName>ArchetypeType.securityPolicy</a:displayName>
                                <a:since>4.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="archetype" substitutionGroup="c:object" type="tns:ArchetypeType"/>

    <xsd:complexType name="ArchetypePolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of archetype policies, such as object template, lifecycle, type display properties and so on.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:schemaMigration>
                    <a:element>tns:oidNameBoundMode</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="display" type="tns:DisplayType">
                <xsd:annotation>
                    <xsd:documentation>
                        Display properties of the archetyped objects.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ArchetypePolicyType.display</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="objectTemplateRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the template.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                        <a:displayName>ArchetypePolicyType.objectTemplateRef</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="itemConstraint" type="tns:ItemConstraintType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ObjectPolicyConfigurationType.itemConstraint</a:displayName>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="propertyConstraint" type="tns:ItemConstraintType">
                <xsd:annotation>
                    <xsd:documentation>
                        DEPRECATED. Use itemConstraint instead.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ObjectPolicyConfigurationType.propertyConstraint</a:displayName>
                        <a:removed>true</a:removed>
                        <a:deprecatedSince>4.1</a:deprecatedSince>
                        <a:removedSince>4.8</a:removedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="conflictResolution" type="tns:ConflictResolutionType">
                <xsd:annotation>
                    <xsd:documentation>
                        How to resolve write-write conflicts on focal objects, i.e. if two threads modify given objects at once.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6.1</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ArchetypePolicyType.conflictResolution</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lifecycleStateModel" type="tns:LifecycleStateModelType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of lifecycle states and state transitions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7.1</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>ArchetypePolicyType.lifecycleStateModel</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="applicablePolicies" type="tns:ApplicablePoliciesType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of policies that are applicable to this object type.
                        This should refer to all applicable policies, not just those that
                        are applied. The purpose is primarily for presentation purposes,
                        so the user interface can present choice of all policies to the
                        user.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                        <a:displayName>ArchetypePolicyType.applicablePolicies</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="expressionProfile" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Specifies a profile for expression execution.
                            The profile mostly specifies restrictions for execution of expressions
                            and scripts. This applies to expressions in archetyped objects.
                            Please note that no expression execution restriction means that all evaluators
                            and scripting languages are allowed and there are no restrictions for evaluation
                            of expressions.
                        </p>
                        <p>
                            Implementation note: implementation of those restriction in midPoint 4.0 is very
                            limited. There is no guarantee that this will work for archetypes at all.
                            The only supported option in 4.0 is application of the restrictions to reports
                            (ReportType) and only if it is configured in global system configuration.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>ArchetypePolicyType.expressionProfile</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="adminGuiConfiguration" type="tns:ArchetypeAdminGuiConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Definition of GUI-related configuration for the archetyped objects. This is using
                            principle similar to adminGuiConfiguration in system configuration.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>ArchetypePolicyType.adminGuiConfiguration</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="assignmentHolderRelationApproach" type="tns:AssignmentRelationApproachType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Configures overall assignmentRelation approach for archetyped objects (assignment holders).
                            This essentially means that it allows or disables the use of "generic" assignments for archetyped objects.
                            If the generic assignments are allowed (open approach), the archetyped object can be a holder
                            of any assignment that targets any assignable type with any relation.
                            (Note: this is still subject to authorizations.)
                            This essentially means that if this property is set to "open" then the GUI will show
                            "assign" button that can be used to add any assignment type.
                            If this property is set to "closed" then the GUI will not render that button. In that case
                            only those assignments that are explicitly allowed by assignmentRelation statements are possible.
                        </p>
                        <p>
                            This setting controls behavior of midPoint user interface.
                            E.g. setting the approach to "closed" will hide the button that controls generic assignment in user's "Assignments" tab.
                            But it will not disable similar button in the "Members" tab of the role.
                            This setting is only about controlling uni-directional behavior of GUI.
                            It does not constraint the entire assignment model.
                            That would be too complex to implement (at least for now).
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                        <a:displayName>ArchetypePolicyType.assignmentHolderRelationApproach</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="links" type="tns:LinkTypeDefinitionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Definitions of link types for objects having this archetype.
                            EXPERIMENTAL. UNSTABLE. DO NOT USE.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ArchetypeTypeType">
        <xsd:annotation>
            <xsd:documentation>
                Type of the archetype determining how it can be assigned and used.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="structural">
                <xsd:annotation>
                    <xsd:documentation>
                        Only one can be assigned to the object directly, can be extended, can extend other structural archetypes.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STRUCTURAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="auxiliary">
                <xsd:annotation>
                    <xsd:documentation>
                        Can be assigned to the object with structural archetype assigned, object can have more than one auxiliary archetypes assigned.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AUXILIARY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- TODO: abstract-->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="LinkTypeDefinitionsType">
        <xsd:annotation>
            <xsd:documentation>
                Definitions of link types for objects having this archetype.
                EXPERIMENTAL. UNSTABLE. DO NOT USE.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="sourceLink" type="c:LinkTypeDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of inbound link. Specifies source objects that can have this (archetyped) object assigned.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="targetLink" type="c:LinkTypeDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of outbound link. Specifies target objects that can be assigned to this (archetyped) object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LinkTypeDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definitions of a link type.
                EXPERIMENTAL. UNSTABLE. DO NOT USE.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the named link.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="selector" type="c:LinkedObjectSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of the objects on the other side of the link (sources or targets).
                        It can be also missing or empty.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LinkedObjectSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                Selects objects among linked ones (for this object).
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectSelectorType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="relation" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                Link matches if it has any of the relation specified.
                                (If no relation is specified, all links match.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="linkedObjectSelectorType" type="c:LinkedObjectSelectorType"/>

    <xsd:simpleType name="AssignmentRelationApproachType">
        <xsd:annotation>
            <xsd:documentation>
                Overall assignmentRelation approach for archetypes objects.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="open">
                <xsd:annotation>
                    <xsd:documentation>
                        Open assignmentRelation approach. Assignments with any target and relation (generic assignments)
                        are allowed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OPEN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="closed">
                <xsd:annotation>
                    <xsd:documentation>
                        Closed assignmentRelation approach. Assignments with any target and relation (generic assignments)
                        are not allowed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLOSED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ArchetypeAdminGuiConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of GUI-related configuration for the archetyped objects.
                This is similar to AdminGuiConfigurationType, but it is supposed to be
                applicable to a specific (archetyped) type. Therefore the elements that
                select a type are removed or they are simply ignored.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="objectDetails" type="tns:GuiObjectDetailsPageType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Specifies the look and feel of the pages for displaying object details and
                              editing of objects.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>AdminGuiConfigurationType.objectDetails</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: default view for archetyped objects? -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LookupTableType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    An object that represents lookup table. The lookup table can be used for two purposes:
                    value enumerations (e.g. for GUI or validation) and value mapping (translation).
                    The same lookup table can serve both purposes at the same time.
                </p>
                <p>
                    The content of the lookup table can be used as enumeration. E.g. the labels for each
                    table row can be displayed in the user interface. When a particular label is selected then
                    the associated key will be stored. Similar approach can be used for validation, e.g. when only
                    a selected set of values is legal for a certain property. In this case the "key" and "label"
                    columns are used.
                </p>
                <p>
                    The content of the lookup table can also be used for value mapping. E.g. in cases when
                    input value needs to be mapped to the output value. In this case the "key" and "value"
                    columns are used.
                </p>
                <p>
                    Even though the lookup table is represented as a prism object, it is designed to be
                    stored and queried efficiently. Therefore the contents of the lookup table will
                    be stored in a specialized table tuned for this purpose. This data type is not
                    designed to be used with the usual midPoint query mechanism (e.g. searchObjects operation).
                    Specialized operations are used to efficiently query the lookup tables. The prism
                    representation (e.g. XML) of the lookup tables is used only for backup, restore, migrations,
                    upgrades and similar purposes.
                </p>
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="row" type="tns:LookupTableRowType"/>
                    <!-- TODO: Maybe more settings describing the intended use of the lookup table. -->
                    <!-- TODO: Lookup table synchronization settings? (e.g. resourceRef) -->
                </xsd:sequence>
           </xsd:extension>
       </xsd:complexContent>
   </xsd:complexType>
   <xsd:element name="lookupTable" substitutionGroup="c:object" type="tns:LookupTableType"/>

    <xsd:complexType name="LookupTableRowType">
        <xsd:annotation>
            <xsd:documentation>
                Data structure that represents entire content of the lookup table, organized into table rows.
                The delta semantics has a slightly different meaning for the lookup tables. Each key must be unique and the key
                functions as an implicit identifier. E.g. adding a new row with a key that does not exist yet
                will insert a new row. Adding a new row with key that already exists will overwrite existing row.
                Replace operation on this property will efficiently clear the entire table and replace it with a new data.
                We do not recommend using this operation as it may be very inefficient. Add and delete operations are
                expected during normal operation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:relational>true</a:relational>
                <a:expensive>true</a:expensive>
                <a:naturalKey>tns:key</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="key" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Lookup table key column. This is the mandatory (non-null) column that usually
                        works as a mapping key. If the lookup table is used as an enumeration (there is no value column)
                        then the value of key column will be stored in the property when selected.
                        If the lookup table is used as a map, the value of key column will be matched to the
                        input variable.

                        The value of the key is limited to a usual size of a "database string". The actual size
                        constraint depends on the type of the database used as midPoint repository. It is
                        not recommended to use long values as keys.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="value" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Lookup table value column. This is optional column that represents mapping output.
                        The appropriate row will be selected by using the key. The corresponding value will be used
                        as output.

                        This column has no use if the lookup table is used as an enumeration.
                        The value of the key is limited to a usual size of a "database string". The actual size
                        constraint depends on the type of the database used as midPoint repository. We expect that
                        this column may contain quasi-structured data. But this column is not intended for a very rich
                        data structures, such as long XML snippets. If structured data must be stored in this column
                        then we recommend to use very tight "microformats" such as separating the values with colons.

                        A special-purpose CLOB column for richer data formats might be added in the future.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="label" type="t:PolyStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        Column that contains a user-friendly label for corresponding to the key.
                        This label will be displayed in user interface as a representation of the key.
                        The label has no meaning when the lookup table is used to map values.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="lastChangeTimestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        Timestamp of the last change of the row. This is automatically maintained by
                        the repository. It is updated every time the row is created or updated.
                        This row is intended to act as a "token" if the lookup table needs to be synchronized
                        with external resource.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <!-- OPERATIONAL SCHEMA -->

    <!-- The following clauses belong to the operation support. -->

    <xsd:complexType name="ValuePolicyType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:lifetime</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:minOccurs</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:maxOccurs</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element name="stringPolicy" type="tns:StringPolicyType"/>
                    <xsd:element minOccurs="0" name="prohibitedValues" type="tns:ProhibitedValuesType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="valuePolicy" substitutionGroup="c:object" type="tns:ValuePolicyType"/>

    <xsd:complexType name="PasswordLifeTimeType">
        <xsd:sequence>
            <xsd:element default="-1" minOccurs="0" name="expiration" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days before password expires
                        -1 : means password doesn't expire
                        0 : means password is expired
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="0" minOccurs="0" name="warnBeforeExpiration">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days before password expiration to
                        send warnings (0 means no warnings)
                    </xsd:documentation>
                </xsd:annotation>
                <xsd:simpleType>
                    <xsd:restriction base="xsd:int">
                        <xsd:minInclusive value="0"/>
                    </xsd:restriction>
                </xsd:simpleType>
            </xsd:element>
            <xsd:element default="0" minOccurs="0" name="lockAfterExpiration">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days after password after password
                        expiration the account will be locked (0 means never
                        will be locked)
                    </xsd:documentation>
                </xsd:annotation>
                <xsd:simpleType>
                    <xsd:restriction base="xsd:int">
                        <xsd:minInclusive value="0"/>
                    </xsd:restriction>
                </xsd:simpleType>
            </xsd:element>
            <xsd:element default="0" minOccurs="0" name="minPasswordAge" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days before password may be changed (0
                        means password can be changed immediately)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="0" minOccurs="0" name="passwordHistoryLength" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of unique passwords in history (0 - no
                        history)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="passwordLifeTime" type="tns:PasswordLifeTimeType"/>

    <xsd:complexType name="StringPolicyType">
         <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>

        <xsd:sequence>
            <xsd:element minOccurs="0" name="description" type="xsd:string"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="limitations" type="tns:LimitationsType"/>
            <xsd:element minOccurs="0" name="characterClass" type="tns:CharacterClassType"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LimitationsType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of complexity and string policy
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="0" minOccurs="0" name="minLength" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Minimal length of the string. If not specified, the string can be empty.

                        (When generating values, though, the default for minimal generated length
                        is situation-specific, e.g. 10 or 24 characters. It is used when both minLength
                        and minUniqueChars are unspecified or zero.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="-1" minOccurs="0" name="maxLength" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Maximal length of the string. If not specified or if negative,
                        the string can have arbitrary length.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="minUniqueChars" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                          Minimum number of unique characters in the string.
                          Defaults to minLength.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="checkAgainstDictionary" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Currently ignored.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="checkPattern" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Currently ignored.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="checkExpression" type="c:CheckExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Expression that is used to check the value whether it is acceptable
                            or not. If the expression returns true, then the value is accepted.
                            If the expression returns false value, then the value is rejected and
                            (in the case of value generation) it will be generated again.
                            Until the maximum number of attempts is reached.
                            If there are several expressions that all of them must pass for the value to
                            be accepted. However, each of them may produce a different failure message.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="10" minOccurs="0" name="maxAttempts" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Maximum number of attempts to generate an expression. Attempts are used
                            with limitations that cannot be incorporated directly into the generation
                            algorithm (check expression, pattern, dictionary). Any value less than 1
                            is interpreted as 1.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="limit" type="tns:StringLimitType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Limitations (e.g., minimum and maximum occurrences) related to individual character classes.

                            Important note: Generation of values is guaranteed to work if the character classes are disjunctive.

                            If they are not, there may be situations where the value cannot be generated entirely,
                            or their generation would require computationally intensive algorithms involving, e.g.,
                            approaches known from constraints programming area. This can be the case if requirements
                            for individual classes contradict each other - like A is subset of B, and minOccurs for A
                            is greater than maxOccurs of B - or if the current simple algorithm walks into a dead end
                            by randomly selected required characters from one class in such a way that there will be no
                            chance of fulfilling the requirements of other classes and the global requirements
                            at the same time.

                            Hence, you should either use disjunctive character classes or make sure that all the limitations
                            can be met even when selecting required amounts of characters from individual classes randomly
                            and independently of each other.

                            If there are no specific limitations, alphanumeric chars are used for value generation.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="StringLimitType">
        <xsd:annotation>
            <xsd:documentation>
                Limitations of a string value connected to given character class.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="t:PolyStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            User-understandable name of the limitations.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            User-understandable description of the limitations.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element default="0" minOccurs="0" name="minOccurs" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Minimal number of characters from this class that must be present in the string value.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="-1" minOccurs="0" name="maxOccurs" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Maximal number of characters from this class that can be present in the string value.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="mustBeFirst" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            If "true", the character from this class must be at the first place of the string value.
                            If more classes have this flag set to "true", all of them must conform to this rule.
                            (I.e., the first character must come from an intersection of these classes, which must
                            be, obviously, non-empty.)
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="ignoreWhenGenerating" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            If "true", this class is ignored when generating the value. This is to avoid generating passwords
                            or nonce values with trouble-making characters (problematic in the logs, in URIs, and so on),
                            like the space, '#', '&amp;', '*', apostrophe, or double quotes.

                            The value of "true" means that "minOccurs" must be 0. Otherwise, it's not possible to generate
                            a compliant value.

                            Note that if a character is present in multiple classes (which is not recommended), and some of them
                            are to be ignored when generating, while others are not, the specific character may still be used
                            for the generation.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="characterClass" type="tns:CharacterClassOrRefType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Specification of the character class for these limitations.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="CharacterClassType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of valid characters in a character class.
                Default value is ASCII printable characters (codes 0x20 to 0x7E).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="characterClass" type="tns:CharacterClassType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Embedded character class(es). Their content is included in the outer class.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="value" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Explicitly specified characters belonging to this class.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="name" type="xsd:QName">
            <xsd:annotation>
                <xsd:documentation>
                    <p>
                        Name of this character class (optional).
                    </p>
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
    </xsd:complexType>

    <xsd:complexType name="CharacterClassOrRefType">
        <xsd:annotation>
            <xsd:documentation>
                As a CharacterClassType, but it can contain a reference to a class defined elsewhere.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:CharacterClassType">
                <xsd:attribute name="ref" type="xsd:QName">
                    <xsd:annotation>
                        <xsd:documentation>
                            <p>
                                Name of existing character class that is to be used at this place.

                                If this value is present, no content ("characterClass" nor "value") must be provided.
                                The referenced classes are looked up in the list of classes provided in the "characterClass"
                                item within the StringPolicyType object. There must be exactly one class with the given
                                reference. Note that unlike at other places in midPoint, here both namespaces and local parts
                                of the names must match. Therefore, the use of unqualified names is suggested for simplicity.
                            </p>
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:attribute>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CheckExpressionType">
        <xsd:annotation>
            <xsd:documentation>
                Expression used to check the data and report a user-friendly message in case
                that the check fails.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="expression" type="c:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                          Expression that is used to check the resulting value whether it is acceptable
                          or not. If the expression returns true, then the value is accepted.
                          If the expression returns false value, then the value is rejected.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localizableFailureMessage" type="tns:LocalizableMessageType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Localizable message that will be displayed to user when the expression check fails.
                            This one takes precedence over (non-localizable) failureMessage.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="failureMessage" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                          Message that will be displayed to user when the expression check fails.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="display" type="tns:DisplayType">
                <xsd:annotation>
                    <xsd:documentation>
                        Display properties of the CheckExpressionType objects.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>CheckExpressionType.display</a:displayName>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: success message? -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ProhibitedValuesType">
         <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="tns:ProhibitedValueItemType"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ProhibitedValueItemType">
         <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="object" minOccurs="0" name="origin" type="tns:ValuePolicyOriginType"/>
            <xsd:element minOccurs="0" name="path" type="t:ItemPathType"/>
            <xsd:element minOccurs="0" name="projectionDiscriminator" type="tns:ShadowDiscriminatorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies which projection should be used in case that projection origin is selected.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: matching (exact, norm, case ignore, partial, ...), matching parameters ( 3 characters difference ) -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ValuePolicyOriginType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="object">
                <xsd:annotation>
                    <xsd:documentation>
                        Object is the origin. Object usually means the user.
                        E.g. in case of password policy, object is the user
                        who's password is changed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="persona">
                <xsd:annotation>
                    <xsd:documentation>
                        Object's persona is the origin.
                        E.g. in case of password policy all user personas
                        will be scanned.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PERSONA"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="owner">
                <xsd:annotation>
                    <xsd:documentation>
                        Object's owner is the origin.
                        E.g. in case of user password policy all personas that
                        point to this user will be scanned. In case of
                        account password policy the user who owns the
                        account is scanned.
                        Note: owner for accounts is not implemented yet
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OWNER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="projection">
                <xsd:annotation>
                    <xsd:documentation>
                        One of object's projection is the origin.
                        E.g. in case of user password specific projection
                        linked to the user will be scanned.
                        If this origin type is selected then also
                        the projectionDiscriminator must be specified.
                        Note: Currently the only supported value is
                        resource password.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PROJECTION"/>
                        <a:since>3.7.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="OperationResultType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:minor</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="operation" type="xsd:string"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="qualifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Something that more precisely defines (i.e. qualifies) the operation. For example, object type for
                        repository operations or clockwork state and wave for clockwork operations. It is used to be shown
                        e.g. in operation performance statistics.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="operationKind" type="tns:OperationKindType">
                <xsd:annotation>
                    <xsd:documentation>
                        Kind of operation (e.g. clockwork execution, mapping evaluation, repository access). To be used
                        for easy navigation, result filtering, and so on.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="status" type="tns:OperationResultStatusType"/>
            <xsd:element minOccurs="0" name="importance" type="tns:OperationResultImportanceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Importance of the operation result (major, normal, minor). The default is "normal".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="asynchronousOperationReference" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier (reference) of asynchronous operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="start" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        When the operation started.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="end" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        When the operation finished.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="microseconds" type="xsd:long">
                <xsd:annotation>
                    <xsd:documentation>
                        How long the operation took (if known).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="ownMicroseconds" type="xsd:long">
                <xsd:annotation>
                    <xsd:documentation>
                        How long the operation took, except for the children (if known).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.10</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="cpuMicroseconds" type="xsd:long">
                <xsd:annotation>
                    <xsd:documentation>
                        How much CPU time the operation took (if known).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="invocationId" type="xsd:long">
                <xsd:annotation>
                    <xsd:documentation>
                        ID of the operation invocation (if known).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- tracing is temporarily at the top -->
            <xsd:element minOccurs="0" name="traced" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Is the operation traced?
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="trace" type="tns:TraceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Tracing details (if known).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="1" minOccurs="0" name="count" type="xsd:int"/>
            <xsd:element default="0" minOccurs="0" name="hiddenRecordsCount" type="xsd:int"/>
            <xsd:element minOccurs="0" name="params" type="tns:ParamsType"/>
            <xsd:element minOccurs="0" name="context" type="tns:ParamsType"/>
            <xsd:element minOccurs="0" name="returns" type="tns:ParamsType"/>
            <xsd:element minOccurs="0" name="token" type="xsd:long"/>
            <xsd:element minOccurs="0" name="messageCode" type="xsd:string"/>
            <xsd:element minOccurs="0" name="message" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Error or warning message.
                        This is optional, as some types does not need a message (e.g. success).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="userFriendlyMessage" type="tns:LocalizableMessageType"/>
            <xsd:element minOccurs="0" name="details" type="xsd:string"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="log" type="tns:LogSegmentType">
                <xsd:annotation>
                    <xsd:documentation>
                        Log segments related to this operation result.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="monitoredOperations" type="tns:MonitoredOperationsStatisticsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Information (mainly counters and durations) about monitored operations. These are the operations
                        that are too small to be represented by OperationResult themselves, yet are important enough
                        to be monitored. Examples: object cloning, lens element delta or state recomputation, and so on.
                        The list depends on the current needs of midPoint performance improvement process.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <xsd:experimental>true</xsd:experimental>
                        <xsd:since>4.4</xsd:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="partialResults" type="tns:OperationResultType"/>
        </xsd:sequence>
        <xsd:attribute name="incomplete" type="xsd:boolean">
            <xsd:annotation>
                <xsd:documentation>
                    This is just to make XML parsers happy when they see a task with incomplete operation result.
                    (See MID-7023.) Not a particularly clean solution, but should do no harm. Please DO NOT USE this
                    attribute for any purpose!
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
    </xsd:complexType>
    <xsd:element name="operationResult" type="tns:OperationResultType"/>

    <xsd:complexType name="LogSegmentType">
        <xsd:annotation>
            <xsd:documentation>
                Segment of the logfile.
            </xsd:documentation>
            <xsd:appinfo>
                <a:experimental>true</a:experimental>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="sequenceNumber" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Sequence number - used to sort segments in correct order.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="entry" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Log entries.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="logSegment" type="tns:LogSegmentType"/>

    <xsd:complexType name="MonitoredOperationsStatisticsType">
        <xsd:annotation>
            <xsd:documentation>
                Information about selected monitored operations.
            </xsd:documentation>
            <xsd:appinfo>
                <a:experimental>true</a:experimental>
                <a:since>4.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="operation" type="tns:MonitoredOperationStatisticsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Information about a particular operation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="MonitoredOperationStatisticsType">
        <xsd:annotation>
            <xsd:documentation>
                Information about selected monitored operation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:experimental>true</a:experimental>
                <a:since>4.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="operation" type="tns:MonitoredOperationType">
                <xsd:annotation>
                    <xsd:documentation>
                        The operation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="count" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of invocations.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="nanos" type="xsd:long">
                <xsd:annotation>
                    <xsd:documentation>
                        Aggregated time spent in the invocations. (If measured.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="MonitoredOperationType">
        <xsd:annotation>
            <xsd:documentation>
                Monitored operation.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="clone">
                <xsd:annotation>
                    <xsd:documentation>
                        Prism object clone operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="objectSerialization">
                <xsd:annotation>
                    <xsd:documentation>
                        Prism object serialization operation (maybe not all of them, for now).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_SERIALIZATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="objectParsing">
                <xsd:annotation>
                    <xsd:documentation>
                        Prism object parsing operation (maybe not all of them, for now).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_PARSING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="currentDeltaComputation">
                <xsd:annotation>
                    <xsd:documentation>
                        Computation of lens element current delta.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CURRENT_DELTA_COMPUTATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="summaryDeltaComputation">
                <xsd:annotation>
                    <xsd:documentation>
                        Computation of lens element summary delta.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUMMARY_DELTA_COMPUTATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="newObjectComputation">
                <xsd:annotation>
                    <xsd:documentation>
                        Computation of lens element new object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NEW_OBJECT_COMPUTATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="OperationResultImportanceType">
        <xsd:annotation>
            <xsd:documentation>
                Level of importance of given OperationResult.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="major">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MAJOR"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        This result should be displayed/preserved in almost all situations.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="normal">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NORMAL"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        This result should be displayed/preserved in normal situations. It can be stripped out e.g.
                        if it's SUCCESS and we want to save space.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="minor">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MINOR"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        This result should usually be removed, if it's SUCCESS.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ParamsType">
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="entry" type="tns:EntryType"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="params" type="tns:ParamsType"/>

    <xsd:complexType name="EntryType">
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:entryValue"/>
<!--             <xsd:any processContents="lax" minOccurs="0"> -->
<!--                 <xsd:annotation> -->
<!--                     <xsd:documentation> -->
<!--                         Value of the entry. If there is a object that can native XML representation, such representation -->
<!--                         should -->
<!--                         be used. Otherwise the UnknownJavaObject can be used. -->
<!--                     </xsd:documentation> -->
<!--                 </xsd:annotation> -->
<!--             </xsd:any> -->
        </xsd:sequence>
        <xsd:attribute name="key" type="xsd:string" use="required"/>
    </xsd:complexType>

    <xsd:element abstract="true" name="entryValue"/>

    <xsd:element name="paramValue" nillable="true" substitutionGroup="tns:entryValue" type="xsd:anyType">
        <xsd:annotation>
            <xsd:documentation>
                Static value for the attribute or property.

                Static attribute values. The values in this element should be
                assigned to the account as-is.

                List of values for the attribute provided in an appropriate XML elements
                that specify attribute name. (as is usual for properties)

                Only one attribute may be specified here, although it may have multiple
                values. Multi-valued attributes are expressed by repeating the same XML
                element multiple times.
                Hence all the XML elements that match this xsd:any must have the same
                element names (may have different values of course).


                Please note that this is nillable and therefore it may be
                explicitly set to "nil" value. Doing this means that empty
                set of values should be constructed. E.g. setting
                this to "nil" and also setting "authoritative" flag
                may enforce removal of all attribute values (if used properly).
            </xsd:documentation>
            <xsd:appinfo>
                <a:rawType/>
            </xsd:appinfo>
        </xsd:annotation>
    </xsd:element>

    <xsd:simpleType name="OperationResultStatusType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="success">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUCCESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="warning">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WARNING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="partial_error">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PARTIAL_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="fatal_error">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FATAL_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="handled_error">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HANDLED_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="not_applicable">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NOT_APPLICABLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="in_progress">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN_PROGRESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unknown">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNKNOWN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="UnknownJavaObjectType">
        <xsd:annotation>
            <xsd:documentation>
                Type used to represent Java objects that are otherwise unknown to the system and cannot be
                represented in "canonical" XML form. This must be used only in diagnostics messages intended
                to be displayed to the human user. It must not be used in places intended for computer processing.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="class" type="xsd:string"/>
            <xsd:element name="toString" type="xsd:string"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:element name="unknownJavaObject" substitutionGroup="tns:entryValue" type="tns:UnknownJavaObjectType"/>

    <!-- Configuration types -->

    <xsd:element name="objectPolicyConfiguration" type="c:ObjectPolicyConfigurationType"/>
    <xsd:element name="classLoggerConfiguration" type="c:ClassLoggerConfigurationType"/>
    <xsd:element name="appenderConfigurationType" type="c:AppenderConfigurationType"/>
    <xsd:element name="globalPolicyRule" type="c:GlobalPolicyRuleType"/>

    <xsd:complexType name="SystemConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                System configuration object.

                Holds global system configuration setting. There will be just one object of
                this type in the system. It will have a well-known OID.
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:globalPasswordPolicyRef</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:defaultUserTemplateRef</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:objectTemplate</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:defaultHostname</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="globalAccountSynchronizationSettings" type="tns:ProjectionPolicyType">
                        <xsd:annotation>
                            <xsd:documentation>
                                System-global account synchronization settings. These will be used if there is no
                                specific settings
                                (e.g. per resource or per request).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.globalAccountSynchronizationSettings</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="globalSecurityPolicyRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the global security policy settings.

                                TODO: better documentation
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:SecurityPolicyType</a:objectReferenceTargetType>
                                <a:displayName>SystemConfigurationType.globalSecurityPolicyRef</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="modelHooks" type="tns:ModelHooksType"/>

                    <xsd:element minOccurs="0" name="logging" type="tns:LoggingConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Persistent configuration of logging levels, categories, etc.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.logging</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="defaultObjectPolicyConfiguration" type="tns:ObjectPolicyConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Definition of default object policy for an individual object type. The definition of this policy
                                contains object template and other similar settings. The policy will be used
                                "universally" during all operations with specified object types - unless it is overridden
                                in other definitions (e.g. in resource or org).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="connectorFramework" type="tns:ConnectorFrameworkType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Global configuration of connectors and connector frameworks.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="notificationConfiguration" type="tns:NotificationConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for user notifications.
                                In the future, it might be overridden e.g. at a level of a user.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.notificationConfiguration</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="messageTransportConfiguration" type="tns:MessageTransportConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for message transports, e.g. mail, sms, etc.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <!-- TODO add the displayName localization -->
                                <a:displayName>SystemConfigurationType.messageTransportConfiguration</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="workflowConfiguration" type="tns:WfConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for workflows. Some static aspects are stored in the system configuration file.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.workflowConfiguration</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="accessCertification" type="tns:AccessCertificationConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for access certifications.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.accessCertification</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="roleManagement" type="tns:RoleManagementConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for role management: role catalog, role assignments, etc.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.roleManagement</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="globalPolicyRule" type="tns:GlobalPolicyRuleType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Global policy rules that are applied to all (selected) objects in the system.
                                These rules specify compliance and governance constraints.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.5</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="providedService" type="tns:ProvidedServiceConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Global configuration for services provided by midPoint, such as admin GUI or REST service.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="profilingConfiguration" type="tns:ProfilingConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for profiling purposes. The first iteration of profiling integration has
                                only few configuration options, but profiling feature will grow in near future.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.profilingConfiguration</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="cleanupPolicy" type="tns:CleanupPoliciesType">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration of cleanup intervals and other parameters.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.cleanupPolicy</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="internals" type="tns:InternalsConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Various internals configuration.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.internals</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="adminGuiConfiguration" type="tns:AdminGuiConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Administration GUI configuration.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>AdminGuiConfigurationType.adminGuiConfiguration</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="mergeConfiguration" type="tns:MergeConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Configurations for object merging. E.g. for merging two users.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.5</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="deploymentInformation" type="tns:DeploymentInformationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Information about midPoint deployment: subscription information, deployment name,
                                description, color and so on.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.deploymentInformation</a:displayName>
                                <a:since>3.5.1</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="infrastructure" type="tns:InfrastructureConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Technical (infrastructure) configuration of midPoint deployment.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.infrastructure</a:displayName>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="fullTextSearch" type="tns:FullTextSearchConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Configuration of the full text search feature.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.fullTextSearch</a:displayName>
                                <a:since>3.6</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="expressions" type="tns:SystemConfigurationExpressionsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies profiles for expression evaluations, execution, restrictions, etc.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.expressions</a:displayName>
                                <a:since>4.0</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="audit" type="tns:SystemConfigurationAuditType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specifies details regarding creation and recording of audit events.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.audit</a:displayName>
                                <a:since>4.0</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="correlation" type="tns:SystemConfigurationCorrelationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Global settings related to correlation.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.correlation</a:displayName>
                                <a:since>4.5</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="simulation" type="tns:SystemConfigurationSimulationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Global settings related to simulation
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SystemConfigurationType.simulation</a:displayName>
                                <a:since>4.7</a:since>
                                <a:experimental>true</a:experimental>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="secretsProviders" type="tns:SecretsProvidersType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="systemConfiguration" type="tns:SystemConfigurationType"/>

    <xsd:complexType name="FullTextSearchConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the full text search feature.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="enabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether full text search indexing is enabled. The default is true, if there are any indexed entries defined.
                        (This property is to allow temporary disabling existing configuration.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>FullTextSearchConfigurationType.enabled</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="indexed" type="tns:FullTextSearchIndexedItemsConfigurationType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>FullTextSearchConfigurationType.indexed</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="FullTextSearchIndexedItemsConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                What items to index.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
                <a:container/>
                <a:displayName>FullTextSearchIndexedItemsConfigurationType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="objectType" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        To what object type(s) should this entry be applied.
                        Empty list means "all object types".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>FullTextSearchIndexedItemsConfigurationType.objectType</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        What items to index for the given object type(s).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>FullTextSearchIndexedItemsConfigurationType.item</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="SystemConfigurationAuditType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies details regarding creation and recording of audit events.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="eventRecording" type="tns:SystemConfigurationAuditEventRecordingType">
                <xsd:annotation>
                    <xsd:documentation>
                        Details about creation and recording of audit events.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationAuditType.eventRecording</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="changedItemPaths" type="tns:SystemConfigurationAuditChangedItemPathsType"/>
            <!-- TODO: recordRetentionPolicy -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="SystemConfigurationAuditChangedItemPathsType">
        <xsd:annotation>
            <xsd:documentation>
                This section allows fine‑tuning of how changed item paths are indexed for audit event records
                if underlying implementation supports it.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.10</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="false" minOccurs="0" name="indexAddObjectDeltaOperation" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        When set to true, the audit record will include the first‑level paths
                        extracted from add‑object deltas.

                        When false (the default), these paths are omitted from the audit record.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="indexAdditionalItemPath" type="tns:IndexAdditionalItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies additional item paths that should be examined in object
                        deltas and stored as changed item paths in the audit event record.

                        This applies for both add and modify object deltas.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="IndexAdditionalItemPathType">
        <xsd:sequence>
            <xsd:element name="path" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies additional item paths that should be examined in object
                        deltas and stored as changed item paths in the audit event record.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="all" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        When set to true all items that are in delta in container defined
                        by "path" will be stored as changed item paths.

                        When set to false (the default), object delta has to contain item
                        defined by "path" is evaluated and stored as changed item paths.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SystemConfigurationAuditEventRecordingType">
        <xsd:annotation>
            <xsd:documentation>
                Details about creation and recording of audit events.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="true" minOccurs="0" name="recordResourceStageChanges" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true, midPoint will record audit events for shadow changes on provisioning level.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationAuditEventRecordingType.recordResourceStageChanges</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="recordResourceOids" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true, the resource OIDs will be recorded in the audit event records.
                        Recording resource OIDs means additional (storage) overhead. Therefore it is turned off by default.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationAuditEventRecordingType.recordResourceOids</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="expression" type="c:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Optional expression to be executed to amend AuditEventRecord.
                        Expression must return the record, return null to skip auditing for this record.
                        Following variables are provided:
                        - auditRecord of type AuditEventRecord (this or null is to be returned)
                        - target (primary object), PrismObject, the type depends on the event
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="property" type="tns:SystemConfigurationAuditEventRecordingPropertyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies details how an audit event record property is created.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationAuditEventRecordingType.property</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="escapeIllegalCharacters" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Should illegal characters (like majority of 0x00-0x1F in XML 1.0) be escaped?
                        If they occur and are not escaped, audit operation will fail. If they are stored
                        in escaped form, audit operation will succeed but some parts of the audit records
                        will not be correctly machine processable in the future. So the default value is "false".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:displayName>SystemConfigurationAuditEventRecordingType.escapeIllegalCharacters</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="recordSessionlessAccess" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        There are services in midPoint that are not using concept of access session.
                        No session is created for such services.
                        Therefore there are no audit records about session creation or termination.
                        Access to such services is not recorded in the audit log by default.
                        Setting `recordSessionlessAccess` to `true` will force recording of session start/end events even for session-less services.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:displayName>SystemConfigurationAuditEventRecordingType.recordSessionlessAccess</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="deltaSuccessExecutionResult" type="tns:OperationResultDetailLevel">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies how the successful operation result from delta execution is stored in the repository.
                        Operation results from delta execution can take a lot of space and are often not that important
                        if the result status is `success`.
                        By default, the result is cleaned up from successful minor results, but there
                        is also option to store only the top level result (root) without any subresults
                        or even nothing at all.
                        Finally, there is also option to store the original full result.

                        [NOTE] This option only works for new Native repository audit.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.4</a:since>
                        <a:displayName>SystemConfigurationAuditEventRecordingType.deltaSuccessExecutionResult</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="OperationResultDetailLevel">
        <xsd:annotation>
            <xsd:documentation>
                Specifies what level of detail should be preserved in the operation result.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="full">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FULL"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Full operation result is preserved, no changes are made.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="cleanedUp">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLEANED_UP"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Operation result is cleaned up from minor successful subresults.
                        Only first level subresults are cleaned up this way.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="top">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TOP"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Only the top level result (root) is preserved, all subresults are removed.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Nothing is stored, just like no operation result (null) was provided.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="SystemConfigurationAuditEventRecordingPropertyType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies details how an audit event record property is created.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Audit event record property name.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationAuditEventRecordingPropertyType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="expression" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Expression that produces value of the property.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="targetSelector" type="tns:ObjectSelectorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Selector(s) for target objects to which this property derivation applies.
                        If multiple selectors are defined, at least one of them has to match.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="SystemConfigurationExpressionsType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies profile for expression evaluations, execution, restrictions, etc.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationExpressionsType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="expressionProfile" type="tns:ExpressionProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationExpressionsType.expressionProfile</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="permissionProfile" type="tns:ExpressionPermissionProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationExpressionsType.permissionProfile</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="bulkActionsProfile" type="tns:BulkActionsProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        Profiles concerning the use of actions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationExpressionsType.bulkActionsProfile</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="functionLibrariesProfile" type="tns:FunctionLibrariesProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        Profiles concerning the use of function libraries.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationExpressionsType.functionLibrariesProfile</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="defaults" type="tns:DefaultExpressionProfilesConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default expression profiles to be used in specific situations.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SystemConfigurationExpressionsType.defaults</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ExpressionProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions for execution of expressions and scripts.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
                <a:naturalKey>tns:identifier</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="identifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Profile identifier. Usually short string, essentially a simple profile name.
                        Custom profiles should consider using URIs instead of simple names to avoid
                        conflicts with built-in profiles that may be provided in later versions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionProfileType.identifier</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionProfileType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <!--
                TODO because of the symmetry reasons, we may consider putting the decision + evaluator items
                  into a separate type; this would also help with the clear interpretation of what "default decision" means,
                  see the comment below.
            -->
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for evaluators in this profile: this is the decision of those evaluators that
                        are not explicitly enumerated within it.

                        Currently, this property does NOT apply for other parts of the profile.

                        In particular, bulkActionsProfile and functionLibrariesProfile have their own defaults: If not
                        specified, the "allow all" values are applied for them.

                        Also, the "privilegeElevation" has a separate default of "allow".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="evaluator" type="tns:ExpressionEvaluatorProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        Detailed specification of expression evaluator profile.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionProfileType.evaluator</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="bulkActionsProfile" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        ID of the actions profile to be used with this expression profile.
                        If not specified, the "allow all" profile is assumed.
                        (TODO - or should we take the "decision" property into account? But what about backwards
                        compatibility? The same for `functionLibrariesProfile`.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionProfileType.bulkActionsProfile</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="functionLibrariesProfile" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        ID of the function libraries profile to be used with this expression profile.
                        If not specified, the "allow all" profile is assumed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionProfileType.functionLibraryProfile</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="allow" minOccurs="0" name="privilegeElevation" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Is the privilege elevation (runAsRef, runPrivileged) feature available?
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionProfileType.privilegeElevation</a:displayName>
                        <a:since>4.8</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ExpressionEvaluatorProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions for execution of specific expression evaluators.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
                <a:merger>ExpressionEvaluatorProfileType</a:merger>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="type" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Evaluator type. This should correspond to the name of evaluator element.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionEvaluatorProfileType.type</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionEvaluatorProfileType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for the evaluator. I.e. decision of those aspects of the evaluator use
                        (e.g. script languages) that are not explicitly enumerated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionEvaluatorProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="script" type="tns:ScriptLanguageExpressionProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        Detailed specification for script expressions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionEvaluatorProfileType.script</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: restrict runAs option -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ScriptLanguageExpressionProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions for execution of script expressions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
                <a:naturalKey>tns:language</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="language" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Language of the expression.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ScriptLanguageExpressionProfileType.language</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ScriptLanguageExpressionProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for the scripting language. I.e. decision whether the language can
                        be used at all.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ScriptLanguageExpressionProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="typeChecking" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Switch controlling whether strict type checking is enabled.
                        There is no global default for this. Each language may default to
                        a different value. Some languages may not support this switch at all.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ScriptLanguageExpressionProfileType.typeChecking</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="permissionProfile" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier of a permission profile that should be applied to this
                        script language. If no profile is specified, then no profile will be
                        applied and all language features will be allowed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ScriptLanguageExpressionProfileType.permissionProfile</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AbstractSecurityProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Abstract supertype for various expression and related profiles.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="identifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Profile identifier. Usually short string, essentially a simple profile name.
                        Custom profiles should consider using URIs instead of simple names to avoid
                        conflicts with built-in profiles that may be provided in later versions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>AbstractSecurityProfileType.identifier</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>AbstractSecurityProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for the profile. I.e. decision of those aspects of the profile
                        that are not explicitly enumerated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>AbstractSecurityProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ExpressionPermissionProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions and permissions for various evaluators, especially for
                scripting expressions.
                The permission profile configuration is a separate container with its own identifier
                as it is expected that the same setting will be applied to many evaluators and/or
                scripting languages. And the definition of a profile can be quite long and extensive.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
                <a:naturalKey>tns:identifier</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractSecurityProfileType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="package" type="tns:ExpressionPermissionPackageProfileType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Detailed specification for access to a class.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ExpressionPermissionProfileType.class</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="class" type="tns:ExpressionPermissionClassProfileType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Detailed specification for access to a class.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ExpressionPermissionProfileType.class</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO: later: sandboxing, allowed operations -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ExpressionPermissionPackageProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions and permissions for a package.
                For now package definitions MUST NOT OVERLAP. Therefore there must not be
                a definition of a superpackage and subpackage at the same time.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Full name of the class (including package).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionPackageProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionPackageProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for the profile. I.e. decision of those aspects of the profile
                        (e.g. classes, permissions) that are not explicitly enumerated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionPackageProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: classes within a package? -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ExpressionPermissionClassProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions and permissions for a specific class.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Full name of the class (including package).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionClassProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionClassProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for the profile. I.e. decision of those aspects of the profile
                        (e.g. classes, permissions) that are not explicitly enumerated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionClassProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="method" type="tns:ExpressionPermissionMethodProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        Detailed specification for access to a method.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionClassProfileType.method</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ExpressionPermissionMethodProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions and permissions for a specific method.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the method.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionMethodProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionMethodProfileType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for the profile. I.e. decision of those aspects of the profile
                        (e.g. classes, permissions) that are not explicitly enumerated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExpressionPermissionClassProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: later: parameter specification -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="DefaultExpressionProfilesConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Default expression profiles to be used in specific situations.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="bulkActions" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Expression profile for midPoint actions running under an unprivileged principal.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DefaultExpressionProfilesConfigurationType.bulkActions</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="privilegedBulkActions" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Expression profile for midPoint actions running under a privileged principal.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DefaultExpressionProfilesConfigurationType.privilegedBulkActions</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="customWorkflowNotifications" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Expression profile for custom workflow notifications, used e.g. for escalations.
                        Probably a temporary solution until expression profiles are implemented in full, or until
                        custom workflow notifications are removed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DefaultExpressionProfilesConfigurationType.customWorkflowNotifications</a:displayName>
                        <a:experimental>true</a:experimental>
                        <a:deprecated>true</a:deprecated>
                        <a:deprecatedSince>4.8</a:deprecatedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!--<xsd:element name="gui" type="xsd:string" minOccurs="0">-->
            <!--    <xsd:annotation>-->
            <!--        <xsd:documentation>-->
            <!--            Expression profile for expressions used in GUI customizations.-->
            <!--        </xsd:documentation>-->
            <!--        <xsd:appinfo>-->
            <!--            <a:displayName>ExpressionProfileType.gui</a:displayName>-->
            <!--        </xsd:appinfo>-->
            <!--    </xsd:annotation>-->
            <!--</xsd:element>-->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="BulkActionsProfileType">
        <xsd:annotation>
            <xsd:documentation>
                A profile concerning the use of actions.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractSecurityProfileType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="action" type="tns:BulkActionProfileType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Profiles regarding specific action (assign, unassign, execute-script, ...).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>BulkActionsProfileType.action</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO later: evaluators - search, select, filter-content; but these are generally harmless,
                          as they are processed authorization-wise -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="BulkActionProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions and permissions for a specific action.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <!-- TODO QName? maybe later -->
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the action (assign, unassign, ...)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>BulkActionProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>BulkActionProfileType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Decision for the action.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>BulkActionProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: later: parameter specification -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="FunctionLibrariesProfileType">
        <xsd:annotation>
            <xsd:documentation>
                What function libraries and their functions can be called?
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractSecurityProfileType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="library" type="tns:FunctionLibraryProfileType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Profiles regarding individual libraries.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FunctionLibrariesProfileType.library</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="FunctionLibraryProfileType">
        <xsd:annotation>
            <xsd:documentation>
                What functions in a given function library can be called?
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="ref" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference of the function library object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>FunctionLibraryProfileType.ref</a:displayName>
                        <a:objectReferenceTargetType>tns:FunctionLibraryType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>FunctionLibraryProfileType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default decision for the library.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>FunctionLibraryProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="function" type="tns:LibraryFunctionProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        Profiles regarding specific functions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>FunctionLibraryProfileType.function</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LibraryFunctionProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies restrictions and permissions for a specific library function.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the function. All functions with the given name are covered; currently, there is no possibility
                        to distinguish between them.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LibraryFunctionProfileType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LibraryFunctionProfileType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element name="decision" type="tns:AuthorizationDecisionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Decision for the function.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LibraryFunctionProfileType.decision</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: later: parameter specification -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="FunctionLibraryType">
        <xsd:annotation>
            <xsd:documentation>
                Define reusable functions
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
         <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="function" type="tns:ExpressionType"/>
                </xsd:sequence>
            </xsd:extension>
       </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="functionLibrary" substitutionGroup="c:object" type="tns:FunctionLibraryType"/>

    <xsd:complexType name="ObjectCollectionType">
        <xsd:annotation>
            <xsd:documentation>
                Object collection specification.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.9</a:since>
                <a:schemaContext>
                    <a:typePath>type</a:typePath>
                </a:schemaContext>
            </xsd:appinfo>
        </xsd:annotation>
         <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element name="type" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                Type of objects that belong to this collection.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectCollectionType.type</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="filter" type="q:SearchFilterType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Filter that is used to select objects which belong to this collection.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectCollectionType.filter</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="getOptions" type="c:SelectorQualifiedGetOptionsType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Options to use when executing the search.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:displayName>ObjectCollectionType.getOptions</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="baseCollection" type="tns:CollectionRefSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Collection used as a base for this collection. In this case this collection may be
                                    a "concretization" of another collection. E.g. to create "active employees" collection
                                    use base collection reference to "employees" archetype. And this collection adds a filer
                                    that selects only active user. The resulting collection will be a combination of those two.
                                </p>
                                <p>
                                    This mechanism may also be used without additional search filter to create a "named collection"
                                    for a collection that has quite a complex specification.
                                    E.g. "all managers in our company" or "owners of roles in role catalog".
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.0</a:since>
                                <a:displayName>ObjectCollectionType.baseCollection</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="domain" type="tns:CollectionRefSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Domain for this collection. Domain is a set of object that is "all the things" for this collection.
                                    For example collection of "active employees" will have a domain "all employees". Collection
                                    "failed resources" will have domain collection "all resources" and so on.
                                </p>
                                <p>
                                    The purpose of domain is mostly to evaluate percentages. E.g. what percentage of employees are active.
                                    Domain does not affect the collection itself. E.g. it has no meaning when collection is used in authorizations.
                                    Domain just adds some kind of perspective when collection is presented to the user.
                                    The domain may also be important for policy rules. E.g. policy rules that trigger a notification when percentage of
                                    active employees gets too low.
                                </p>
                                <p>
                                    No domain definition means that this collection does not have any domain.
                                    On the other hand, empty domain definition means that all objects of applicable type are part of the domain, e.g. all users or all roles.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.0</a:since>
                                <a:displayName>ObjectCollectionType.domain</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- Note: collection references such as domain or baseCollection may point to collection or archetype. Maybe even to org or role. -->

                    <xsd:element minOccurs="0" name="defaultView" type="tns:GuiObjectListViewType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies a default view of an object collection.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.0</a:since>
                                <a:displayName>ObjectCollectionType.defaultView</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="stats" type="tns:CollectionStatsType">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:since>4.0</a:since>
                                <a:experimental>true</a:experimental>
                                <a:displayName>ObjectCollectionType.stats</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="objectCollection" substitutionGroup="c:object" type="tns:ObjectCollectionType"/>

    <xsd:complexType name="CollectionStatsType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Stats (statistics) setting and entries. This contains stats entries for collections.
                    Simply speaking, it contains data about number of objects in collection.
                </p>
                <p>
                    While counting collections is usually quite easy, we do not want to do that every
                    millisecond. Therefore we count the collection and keep the data in this structure
                    for a while. The data may not necessarily be persistent. This may be purely virtual data
                    that never get stored in the repository. Ot it may be cached data. Or some combination.
                    We also may want to store historical data about the collection for informational purposes.
                </p>
                <p>
                    EXPERIMENTAL. Do not rely on this data structure.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <!-- TODO (later): configuration of stats collection: virtual/cached, caching freshness, number of stats, intervals, etc. -->
            <xsd:element minOccurs="0" name="statEntry" type="tns:IntegerStatType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Stat (statistic) entry. This entry contains stat value, together with domain value.
                            The purpose is that both absolute values and percentages can be determined.
                        </p>
                        <p>
                            Single-valued now. This represents the latest known value.
                            Will be changed to multi-valued later. Multi-valued stat entries
                            may contain historical values for informational purposes, e.g. displaying "trends"
                            in widgets and reports.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="IntegerStatType">
        <xsd:annotation>
            <xsd:documentation>
                Integer stat (statistic) entry. This entry contains stat value, together with domain value.
                The purpose is that both absolute values and percentages can be determined. The entry contains
                (optional) timestamp to determine freshness of the data and/or sort and plot them.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="value" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Primary (absolute) value of that stat. This is the value that we are interested in.
                            E.g. this is the number of objects in collection.
                        </p>
                        <p>
                            Even though this is a primary value, it is optional. There may be rare cases
                            when we do not have primary value, we only have percentage data.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="domain" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Size of the domain. This is the value of "all things" used to compute percentage.
                            E.g. this is the number of object in collection domain.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="percentage" type="xsd:float">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Percentage value. This is usually not present, as it may be easily computed
                            from value and domain. But for rare cases there may be just the percentage and
                            the primary value may be missing.
                        </p>
                        <p>
                            Implementation note: Having percentage here also makes it easier for implementation.
                            The code can use the same data structure to store intermediate values, e.g.
                            stat with computed percentage. The collection-processing code can also fill
                            in the percentage value automatically, even if it is not stored in repository.
                            This is somehow similar to the way provisioning code fills in the attributes
                            into the shadow.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Sampling timestamp. The timestamp of the moment when the value was
                            retrieved or computed.
                        </p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="PrismConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Prism specific configuration, mainly for performance optimizations and tuning
            </xsd:documentation>
            <xsd:appinfo>
              <a:container/>
              <a:since>4.4</a:since>
              <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="false" minOccurs="0" name="useSerializationProxies" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Enables use of serialization proxies for java serialization of Prism definitions
                        loaded from static schema.

                        This should decrease memory footprint in serialized form (mainly gui sessions).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="indexPropertyValues" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Enables in-memory indexing of property values.

                        This speedups processing of multivalue properties with large number of values, since
                        it uses more memory for indexing.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="50" minOccurs="0" name="propertyValuesIndexThreshold" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Threshold after which property value indexing is enabled. Small values of threshold (eg. 10 or less)
                        does not provide any significant benefit, so it is better to enable value indexing
                        only for larger properties.

                        Default value is 50.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ValueMetadataConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Value Metadata specific internals configuration, mainly for performance optimizations and tuning
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.9.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="false" minOccurs="0" name="disableDefaultMultivalueProvenance" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Disables use of provenance metadata by default for multivalue properties.

                        Provenance metadata for multivalue properties are necessary for out-of-the-box support of default ranges, but
                        are not necessary if such custom ranges / target sets are defined by mappings.

                        This should decrease object size and computation footprint in heavy use of multivalue mapping and extensions.

                        Disabling this feature, does not delete already existing provenance metadata for multivalues. Reenabling this
                        feature requires recomputation of such multivalues for correct value metadata to by computed.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="InternalsConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Various internals configuration elements.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:subresultStripThreshold</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="false" minOccurs="0" name="enableExperimentalCode" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether experimental parts of midPoint code should be enabled.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>InternalsConfigurationType.enableExperimentalCode</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="maxModelClicks" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        How many clicks are allowed for the clockwork to make in one operation.
                        (Default: 200.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>InternalsConfigurationType.maxModelClicks</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="polyStringNormalizer" type="t:PolyStringNormalizerConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration of PolyString normalizer.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.8</a:since>
                        <a:displayName>InternalsConfigurationType.polyStringNormalizer</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="operationResultHandlingStrategy" type="tns:OperationResultHandlingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Strategies for operation result aggregation. In the future, midPoint will provide options to select
                        appropriate strategy e.g. for given task execution. But now only one can be selected as the default.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>InternalsConfigurationType.operationResultHandlingStrategy</a:displayName>
                        <a:sice>4.0</a:sice>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="caching" type="tns:CachingConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Profiles for various kind of caching. Used to balance performance with the accuracy/timeliness of data.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>InternalsConfigurationType.caching</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="shadowCaching" type="tns:ShadowCachingConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Global settings for the "shadow caching" feature.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                        <a:displayName>InternalsConfigurationType.shadowCaching</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tracing" type="tns:TracingConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Tracing configuration, including profiles to be selected from.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>InternalsConfigurationType.tracing</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="repository" type="tns:RepositoryConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuring various aspects of the repository - in addition to those that are configured statically
                        using config.xml file.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>InternalsConfigurationType.repository</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="focusConstraintsChecking" type="tns:ConstraintsCheckingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        How focus constraints checking should be done.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>InternalsConfigurationType.focusConstraintsChecking</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="projectionConstraintsChecking" type="tns:ConstraintsCheckingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        How projection constraints checking should be done.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>InternalsConfigurationType.projectionConstraintsChecking</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="synchronizationSituationUpdating" type="tns:SynchronizationSituationUpdatingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        How synchronization situation in shadows should be updated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>InternalsConfigurationType.synchronizationSituationUpdating</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="shadowMetadataRecording" type="tns:MetadataRecordingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        How metadata in shadows should be recorded/updated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>InternalsConfigurationType.shadowMetadataRecording</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="operationExecutionRecording" type="tns:OperationExecutionRecordingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        How operationExecution records should be updated. This is the default to be used
                        if simpleOperationExecutionRecording or complexOperationExecutionRecording is not set.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.0</a:since>
                        <a:displayName>InternalsConfigurationType.operationExecutionRecording</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="simpleOperationExecutionRecording" type="tns:OperationExecutionRecordingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        How simple operationExecution records should be updated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.3</a:since>
                        <a:displayName>InternalsConfigurationType.simpleOperationExecutionRecording</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="complexOperationExecutionRecording" type="tns:OperationExecutionRecordingStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        How complex operationExecution records should be updated.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.3</a:since>
                        <a:displayName>InternalsConfigurationType.complexOperationExecutionRecording</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="memoryDiagnostics" type="tns:MemoryDiagnosticsConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration of memory diagnostics features.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>InternalsConfigurationType.memoryDiagnostics</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="prism" type="tns:PrismConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration of Prism features.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.4</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="valueMetadata" type="tns:ValueMetadataConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration of default value metadata processing features.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="internalsConfiguration" type="tns:InternalsConfigurationType"/>

    <xsd:complexType name="MemoryDiagnosticsConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of memory diagnostics features.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="heapInfoCommand" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Command that provides heap information. Can use $jhsdb, $jmap, and $pid variables.
                        Default value is "${jhsdb} jmap --heap --pid ${pid}".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MemoryDiagnosticsConfigurationType.heapInfoCommand</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="heapObjectsHistogramCommand" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Command that provides heap objects' histogram. Can use $jhsdb, $jmap, and $pid variables.
                        Default value is "${jmap} -histo:live ${pid}".
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>MemoryDiagnosticsConfigurationType.heapObjectsHistogramCommand</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="memoryDiagnosticsConfiguration" type="tns:MemoryDiagnosticsConfigurationType"/>

    <xsd:complexType name="OperationResultHandlingStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                Strategy for operation result aggregation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the strategy. Useful when referencing e.g. from tasks.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>OperationResultHandlingStrategyType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="global" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        This is a strategy that is to be used globally. (If there is only one strategy defined, it is used
                        implicitly.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>OperationResultHandlingStrategyType.global</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="subresultStripThreshold" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        When aggregation of the same subresults (same operation and status) is to be applied,
                        during operation result "summarize" operation.
                        (Default: 10.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>OperationResultHandlingStrategyType.subresultStripThreshold</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="preserveDuringCleanup" type="tns:OperationResultImportanceType">
                <xsd:annotation>
                    <xsd:documentation>
                        What (minimal) importance is to be preserved during result cleanup? The default is "normal",
                        i.e. successful results of minor importance are cleaned up.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>OperationResultHandlingStrategyType.preserveDuringCleanup</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="operationResultHandlingStrategy" type="tns:OperationResultHandlingStrategyType"/>

    <xsd:complexType name="SynchronizationSituationUpdatingStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                How synchronization situation in shadows should be updated.
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <!-- TODO we could perhaps skip also object read operation in updateSituationInShadow method -->
            <xsd:element minOccurs="0" name="skipWhenNoChange" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Situation update is skipped if there's no change. The default is false.
                        (This will be probably replaced by more sophisticated condition.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="synchronizationSituationUpdatingStrategy" type="tns:SynchronizationSituationUpdatingStrategyType"/>

    <xsd:complexType name="OperationExecutionRecordingStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                How operationExecution records should be updated.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="skipWhenSuccess" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Operation execution records are not updated if the operation result is success. (The default is false.)
                        This setting can be used to improve performance.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="skip" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Operation execution records are not updated at all. (The default is false.)
                        This is to be used only in exceptional cases.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="10" minOccurs="0" name="maxRecords">
                <xsd:annotation>
                    <xsd:documentation>

                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="7" minOccurs="0" name="maxRecordsPerTask">
                <xsd:annotation>
                    <xsd:documentation>

                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="operationExecutionRecordingStrategy" type="tns:OperationExecutionRecordingStrategyType"/>

    <xsd:complexType name="MetadataRecordingStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                How object metadata should be recorded or updated.
                EXPERIMENTAL
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="skipOnModify" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Metadata are not updated when modifying an object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="metadataRecordingStrategy" type="tns:MetadataRecordingStrategyType"/>

    <xsd:complexType name="ConstraintsCheckingStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                How constraints checking (for focus and projections) should be done.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="skipWhenNoChange" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Constraints check is skipped if there was no change in respective properties (name for focus,
                        identifiers for projection). The default is false.
                    </xsd:documentation>
                                        <xsd:appinfo>
                        <a:displayName>ConstraintsCheckingStrategyType.skipWhenNoChange</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="skipWhenNoIteration" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Constraints check is skipped if there is no iteration defined. So we rely on the repository
                        (for focus) or the resource (for projection) to report any constraints violations. The default is false.
                    </xsd:documentation>
                                        <xsd:appinfo>
                        <a:displayName>ConstraintsCheckingStrategyType.skipWhenNoIteration</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="constraintsCheckingStrategy" type="tns:ConstraintsCheckingStrategyType"/>

    <xsd:complexType name="RepositoryConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuring various aspects of the repository - in addition to those that are configured statically
                using config.xml file.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="statistics" type="tns:RepositoryStatisticsReportingConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How repository statistics are collected and reported.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="autoCreatePartitionsOnAdd" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If database partitions should be automatically created on object add / reindex.
                        Currently, this is only supported for Shadow Type.

                        Default value is false.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="repositoryConfiguration" type="tns:RepositoryConfigurationType"/>

    <xsd:complexType name="RepositoryStatisticsReportingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                How repository statistics are collected and reported.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="collection" type="tns:RepositoryStatisticsCollectionStyleType">
                <xsd:annotation>
                    <xsd:documentation>
                        How to collect resource statistics.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="classification" type="tns:RepositoryStatisticsClassificationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How to collect resource statistics.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="repositoryStatisticsReportingConfiguration" type="tns:RepositoryStatisticsReportingConfigurationType"/>

    <xsd:simpleType name="RepositoryStatisticsClassificationType">
        <xsd:annotation>
            <xsd:documentation>
                Level of details when reporting repository performance statistics.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="perOperationType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PER_OPERATION_TYPE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for the repository are collected per operation type (getObject, modifyObject, etc).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="perOperationAndObjectType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PER_OPERATION_AND_OBJECT_TYPE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for the repository are collected per operation and object type (e.g. getObject.UserType, modifyObject.ShadowType, etc).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="RepositoryStatisticsCollectionStyleType">
        <xsd:annotation>
            <xsd:documentation>
                How are repository statistics collected. (TODO find better name for this)
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for the repository are not collected nor reported.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="globally">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GLOBALLY"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for the repository are collected globally (system-wide), not for individual threads.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="globallyAndLocally">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GLOBALLY_AND_LOCALLY"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for the repository are collected both system-wide and for individual threads.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="operations">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OPERATIONS"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for the repository are collected individually for each operation. (This is usually a level
                        that is too deep; useful mainly within tests or for detailed performance analysis.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="TracingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Tracing configuration, including profiles to be selected from.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="profile" type="tns:TracingProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        List of tracing profiles.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="tracingConfiguration" type="tns:TracingConfigurationType"/>

    <xsd:complexType name="CachingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Profiles for various kind of caching. Used to balance performance with the accuracy/timeliness of data.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="traceConfiguration" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to trace cache configuration information.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="profile" type="tns:CachingProfileType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specific caching profile that can be used system-wide or for individual threads.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="cachingConfiguration" type="tns:CachingConfigurationType"/>

    <xsd:complexType name="CachingProfileType">
        <xsd:annotation>
            <xsd:documentation>
                Specific caching profile that can be used system-wide or for individual threads.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Caching profile name: used to describe the profile and to refer to it e.g. from specific tasks.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="order" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Order in which this profile is to be evaluated. (Related to other profiles.) Smaller numbers
                        go first. Entries with no order go last.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="enabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        This property can be used to temporarily disable the profile. Default is "false".
                        Disabled profile means that the profile as such is invisible. It does not necessarily mean
                        that the specified caches are disabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="global" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If enabled, this profile is applied system-wide. Default is "false".
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localRepoObjectCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for thread- and operation-local cache for repository objects. By default it is enabled
                        for everything except TaskType.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localRepoVersionCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for thread- and operation-local cache for repository objects versions. By default it is enabled
                        for everything except TaskType.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localRepoQueryCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for thread- and operation-local cache for repository queries. By default it is enabled
                        for everything except TaskType.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localRepoCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for thread- and operation-local cache for repository objects and queries. This is a shortcut
                        for "localRepoObjectCache" and "localRepoQueryCache" and cannot be used with any of them.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="globalRepoObjectCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for global cache for repository objects. By default it is disabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="globalRepoVersionCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for global cache for repository objects versions. By default it is disabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="globalRepoQueryCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for global cache for repository queries. By default it is disabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="globalRepoCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for global cache for repository objects and queries. This is a shortcut
                        for "globalRepoObjectCache" and "globalRepoQueryCache" and cannot be used with any of them.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localFocusConstraintCheckerCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for thread- and operation-local cache for focus constraint checking. By default it is enabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localShadowConstraintCheckerCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for thread- and operation-local cache for resource objects (and their shadows) constraint checking. By default it is enabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="localAssociationTargetSearchEvaluatorCache" type="tns:CacheSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Settings for thread- and operation-local cache for associationTargetSearch evaluator cache. By default it is enabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
<!--            <xsd:element name="localDefaultSearchEvaluatorCache" type="tns:CacheSettingsType" minOccurs="0">-->
<!--                <xsd:annotation>-->
<!--                    <xsd:documentation>-->
<!--                        Settings for thread- and operation-local cache for other search evaluator cache. By default it is disabled. (It is not suitable for production use!)-->
<!--                    </xsd:documentation>-->
<!--                </xsd:annotation>-->
<!--            </xsd:element>-->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="cachingProfile" type="tns:CachingProfileType"/>

    <xsd:complexType name="CacheSettingsType">
        <xsd:annotation>
            <xsd:documentation>
                Settings for a given cache. Not all items are applicable for each cache.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
                <a:container>true</a:container>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="append" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to append these settings to other (e.g. global) settings, or to override any existing settings.
                        Default is "true" (i.e. to append).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="maxSize" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        How many entries could be present in this cache? The default is "unlimited". Zero means the cache is disabled.
                        Note that this property is currently supported for global repo caches only.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timeToLive" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        How long (in seconds) should objects live in the cache. The default is 1 minute for global caches, and
                        cache lifetime for local ones. Value of 0 means that the specified cache is disabled.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="traceMiss" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to trace cache "miss" events.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tracePass" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to trace cache "pass" events.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="statistics" type="tns:CacheStatisticsReportingConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How detailed statistics are provided for this cache.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="invalidation" type="tns:CacheInvalidationConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How is the cache invalidated?
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="objectTypeSettings" type="tns:CacheObjectTypeSettingsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration for specific object type(s).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="cacheSettings" type="tns:CacheSettingsType"/>

    <xsd:complexType name="CacheObjectTypeSettingsType">
        <xsd:annotation>
            <xsd:documentation>
                Settings for a given cache and object type(s). Not all items are applicable for each cache.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="objectType" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Object type(s) to which this settings are to be applied. If not specified, these apply either to all
                        object types currently supported by the cache. (If this configuration is appending to a previous one,
                        this affects all object types configured in that configuration. If this configuration is the first
                        one, then this affects all object types supported by default by given cache.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timeToLive" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        How long (in seconds) should given object type(s) live in the cache. The default is the same
                        as timeToLive for the cache itself.

                        This is currently supported only for global objects and queries cache.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timeToVersionCheck" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        How long could an object live in the cache without checking its version (in seconds).
                        This is currently supported only for global objects cache.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="traceMiss" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to trace cache "miss" events.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tracePass" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to trace cache "pass" events.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="statistics" type="tns:CacheStatisticsReportingConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How detailed statistics are provided for this object type in this cache.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="invalidation" type="tns:CacheInvalidationConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How is the cache invalidated?
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="cacheObjectTypeSettings" type="tns:CacheObjectTypeSettingsType"/>

    <xsd:complexType name="CacheInvalidationConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                How is the cache invalidated? Currently applicable only to global repo cache objects.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="clusterwide" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to do clusterwide invalidation. Default is true.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="approximation" type="tns:CacheInvalidationApproximationType">
                <xsd:annotation>
                    <xsd:documentation>
                        When doing clusterwide invalidation, operation details (for add/modify/delete operation) are currently
                        not available. This parameter controls how to deal with this situation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="cacheInvalidationConfiguration" type="tns:CacheInvalidationConfigurationType"/>

    <xsd:simpleType name="CacheInvalidationApproximationType">
        <xsd:annotation>
            <xsd:documentation>
                How to deal with remote cache invalidation uncertainty.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="safe">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SAFE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Queries are invalidated safely i.e. when there's a theoretical possibility of matching.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="minimal">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MINIMAL"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Query results are invalidated only when exact OID-match is detected.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="CacheStatisticsReportingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                How cache statistics are collected and reported.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="collection" type="tns:CacheStatisticsCollectionStyleType">
                <xsd:annotation>
                    <xsd:documentation>
                        How to collect resource statistics.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="classification" type="tns:CacheStatisticsClassificationType">
                <xsd:annotation>
                    <xsd:documentation>
                        How to collect resource statistics.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="cacheStatisticsReportingConfiguration" type="tns:CacheStatisticsReportingConfigurationType"/>

    <xsd:simpleType name="CacheStatisticsClassificationType">
        <xsd:annotation>
            <xsd:documentation>
                Level of details when reporting cache performance statistics.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="perCache">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PER_CACHE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics are collected per cache type (local repository object cache, local repository query cache, etc).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="perCacheAndObjectType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PER_CACHE_AND_OBJECT_TYPE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics are collected per cache and object type (e.g. local repository object cache.UserType, etc).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="CacheStatisticsCollectionStyleType">
        <xsd:annotation>
            <xsd:documentation>
                How are cache statistics collected. (TODO find better name for this)
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for this cache are not collected nor reported.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="globallyAndLocally">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GLOBALLY_AND_LOCALLY"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for this cache are collected both system-wide and for individual threads.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="CacheStatisticsConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Level of details when reporting cache performance statistics.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.0</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="skip">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SKIP"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for this cache or object type are not collected.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="perCache">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PER_CACHE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for this cache or object type are collected "per cache" i.e. one number for the whole cache.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="perObjectType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PER_OBJECT_TYPE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Statistics for this cache or object type are collected "per object type" i.e. one number for each object type.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ObjectPolicyConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of policy for a specific object type. It defines object template
                and similar settings that apply to the object alone. This policy settings
                apply to the object internal structure without regard to other objects.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>ObjectPolicyConfigurationType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ArchetypePolicyType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="type" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of the type (class) of the object to apply this definition to.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectPolicyConfigurationType.type</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="subtype" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of the subtype of the object to apply this template to.
                                If no subtype is specified then this definition will be applied to all subtypes.
                                The subtype is compared against the subtype property but it is also compared to the
                                deprecated employeeType, roleType, orgType and serviceType properties.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectPolicyConfigurationType.subtype</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ApplicablePoliciesType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of policies that are applicable to this object type.
                This should refer to all applicable policies, not just those that
                are applied. The purpose is primarily for presentation purposes,
                so the user interface can present choice of all policies to the
                user.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.8</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="policyGroupRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to org that acts as a policy group.
                        The org itself will be presented as a groups of policies,
                        e.g. the org displayName will be used as a label of the section
                        where individual policies are presented.
                        Any meta-roles that are members of the org will be presented as
                        policies, e.g. with a checkbox for each meta-role to apply or
                        not apply that policy.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>ApplicablePoliciesType.policyGroupRef</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="FetchErrorHandlingType">
        <xsd:annotation>
            <xsd:documentation>
                How should be errors during object fetch process handled and reported.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.3</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="reportingMethod" type="tns:FetchErrorReportingMethodType">
                <xsd:annotation>
                    <xsd:documentation>
                        How should be errors during object fetch process reported.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="fetchErrorHandling" type="tns:FetchErrorHandlingType"/>

    <xsd:simpleType name="FetchErrorReportingMethodType">
        <xsd:annotation>
            <xsd:documentation>
                How should be errors during object fetch process reported.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.3</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="default">
                <xsd:annotation>
                    <xsd:documentation>
                        Default behavior, depending on the kind of operation.
                        It is the same that was present in midPoint 4.2.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DEFAULT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="exception">
                <xsd:annotation>
                    <xsd:documentation>
                        Errors are indicated as exceptions. (Unless handled by an error handler.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXCEPTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="forcedException">
                <xsd:annotation>
                    <xsd:documentation>
                        Errors are indicated as exceptions. "Object not found" error handler is disabled.
                        Currently all the other ones are kept enabled. This is because we always need the
                        processing of e.g. communication exceptions. We are only interested in skipping handling
                        "object not found" cases. (Maybe the name of this option should be changed.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FORCED_EXCEPTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="fetchResult">
                <xsd:annotation>
                    <xsd:documentation>
                        Errors are indicated as values in fetchResult property.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FETCH_RESULT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- Maybe also something like ignore (i.e. just skip erroneous objects),
            or ignore-and-stop (skip first erroneous object and stop the search). -->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ShadowClassificationModeType">
        <xsd:annotation>
            <xsd:documentation>
                How should be shadows classified?
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.9</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="normal">
                <xsd:annotation>
                    <xsd:documentation>
                        Default classification behavior. Basically, the classification will be done only for unclassified shadows,
                        with some exceptions regarding simulation mode working with development configuration.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NORMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="forced">
                <xsd:annotation>
                    <xsd:documentation>
                        All shadows touched by given get/search operation (including the associated ones) will be reclassified.
                        Primarily useful for shadow management simulation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FORCED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- Maybe also "forcedLimited" and "skip" -->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ConflictResolutionType">
        <xsd:annotation>
            <xsd:documentation>
                How to resolve write-write conflicts on focal objects, i.e. if two threads modify given objects at once.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.6.1</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="action" type="tns:ConflictResolutionActionType">
                <xsd:annotation>
                    <xsd:documentation>
                        What action to take.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ConflictResolutionType.action</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="1" minOccurs="0" name="maxAttempts" type="xsd:int">    <!-- synchronize with Clockwork.java -->
                <xsd:annotation>
                    <xsd:documentation>
                        How many attempts to undertake at most.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ConflictResolutionType.maxAttempts</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="5000" minOccurs="0" name="delayUnit" type="xsd:int">    <!-- synchronize with Clockwork.java -->
                <xsd:annotation>
                    <xsd:documentation>
                        What delay (in milliseconds) to introduce between attempts. Actual delay is taken as
                        a random number between 0 and delayUnit*(2^(n-1)), where n is the number of conflict resolution attempt,
                        starting at 1. (In other words, the potential delay is multiplied by two after each unsuccessful
                        resolution attempt.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ConflictResolutionType.delayUnit</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ConflictResolutionActionType">
        <xsd:annotation>
            <xsd:documentation>
                What to do in the case of modify-modify conflict during model (clockwork) operation.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.6.1</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        Nothing should be done. This is the default behavior.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="log">
                <xsd:annotation>
                    <xsd:documentation>
                        Warning should be issued into the log file.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOG"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="error">
                <xsd:annotation>
                    <xsd:documentation>
                        Operation should be end with an error.
                        This is a recoverable error (precondition failed).
                        TODO: align with "fail"
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="restart">
                <xsd:annotation>
                    <xsd:documentation>
                        Operation should be restarted.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESTART"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="recompute">
                <xsd:annotation>
                    <xsd:documentation>
                        The focus object should be recomputed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RECOMPUTE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="reconcile">
                <xsd:annotation>
                    <xsd:documentation>
                        The focus object should be recomputed and all projections reconciled.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RECONCILE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="fail">
                <xsd:annotation>
                    <xsd:documentation>
                        The whole operation should fail. This is to be used mainly for testing purposes,
                        to check if conflict detection algorithm does not yield false positive results.
                        This fails with a system error. This is a definitive, non-recoverable failure.
                        TODO: align with "error"
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FAIL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ItemConstraintType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of a property constraints.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>ItemConstraintType.details</a:displayName>
                <a:naturalKey>tns:path</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="path" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ItemConstraintType.path</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="visibility" type="tns:UserInterfaceElementVisibilityType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ItemConstraintType.visibility</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: uniqueness constraint -->
             <xsd:element default="false" minOccurs="0" name="oidBound" type="xsd:boolean">
                 <xsd:annotation>
                     <xsd:documentation>
                         The property value will be bound to OID. This property will be set to the value
                         of OID and it cannot be changed.

                         DEPRECATED since 3.0.
                         NOT SUPPORTED since 4.8.

                         Migration: Since 4.8, focus OID is known right at the operation start. Hence, it can be used in mappings
                         just like any other focus property.
                     </xsd:documentation>
                     <xsd:appinfo>
                         <a:deprecated>true</a:deprecated>
                         <a:deprecatedSince>3.0</a:deprecatedSince>
                         <a:plannedRemoval>4.9</a:plannedRemoval>
                     </xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ProjectionPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of the way how projections are handled on the resource. This defines the ways how
                assignments are enforced and so on.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="assignmentPolicyEnforcement" type="tns:AssignmentPolicyEnforcementType">
                <xsd:annotation>
                    <xsd:documentation>
                        Relative enforcement is the default setting.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ProjectionPolicyType.assignmentPolicyEnforcement</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="legalize" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then the illegal resource objects (e.g. accounts) will be made legal.
                        Illegal resource object is a linked resource object for which there is no assignment.
                        If this option is set to true then it will automatically add a (direct) assignment for
                        this object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ProjectionPolicyType.legalize</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="AssignmentPolicyEnforcementType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        No enforcement. Assignments will be ignored.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="positive">
                <xsd:annotation>
                    <xsd:documentation>
                        Assignments will be enforced only in a positive manner.
                        E.i. If a non-existing account is assigned it will be created.
                        If existing account is not assigned it will NOT be removed.

                        This is the default policy of no other policy is set.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POSITIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="full">
                <xsd:annotation>
                    <xsd:documentation>
                        Full enforcement
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FULL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="relative">
                <xsd:annotation>
                    <xsd:documentation>
                        Relative enforcement
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RELATIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ModelHooksType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="change" type="tns:HookListType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="HookListType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="hook" type="tns:HookType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="HookType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form hook name. Used for diagnostic purposed (e.g. in log files)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element default="true" minOccurs="0" name="enabled" type="xsd:boolean"/>
            <xsd:element minOccurs="0" name="state" type="tns:ModelStateType"/>
            <xsd:element minOccurs="0" name="focusType" type="xsd:QName"/>
            <xsd:element minOccurs="0" name="ref" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        URL of hook handler.
                        Exactly one of "ref" or "script" has to be specified.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="script" type="tns:ScriptExpressionEvaluatorType">
                <xsd:annotation>
                    <xsd:documentation>
                        Script that will be executed instead of hook handler.
                        Exactly one of "ref" or "script" has to be specified.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LoggingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of logging levels, categories, log
                files, etc.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="subSystemLogger" type="tns:SubSystemLoggerConfigurationType"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="classLogger" type="tns:ClassLoggerConfigurationType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>LoggingConfigurationType.classLogger</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="appender" type="tns:AppenderConfigurationType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>LoggingConfigurationType.appender</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="rootLoggerAppender" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>LoggingConfigurationType.rootLoggerAppender</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="rootLoggerLevel" type="tns:LoggingLevelType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>LoggingConfigurationType.rootLoggerLevel</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="auditing" type="tns:LoggingAuditingConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Persistent auditing configuration. It is placed in "logging" for practical reasons as the only
                        available auditing option is to use logging.
                        THIS WILL CHANGE IN THE FUTURE.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>LoggingConfigurationType.auditing</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="advanced" type="tns:AdvancedLoggingConfigurationType"/>
            <xsd:element minOccurs="0" name="debug" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to include 'debug=true' in generated logback configuration file.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="LoggingAuditingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Auditing configuration for auditing by using the logging subsystem.

                This configuration applies only to auditing aspects that go through the logging subsystem.
                The entire auditing subsystem is configured separately at several places.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="true" minOccurs="0" name="enabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AuditingConfigurationType.enabled</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="details" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AuditingConfigurationType.details</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="appender" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AuditingConfigurationType.appender</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType mixed="true" name="AdvancedLoggingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Contains free form logging configuration.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any maxOccurs="unbounded"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType abstract="true" name="AbstractLoggerConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the logger: the facility that
                collects log messages from the code.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="level" type="tns:LoggingLevelType">
                <xsd:annotation>
                    <xsd:documentation>
                        Logger level
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="appender" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Appender name defined in appenders section in
                        logging configuration
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>AbstractLoggerConfigurationType.appender</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ClassLoggerConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the logger: the facility that
                collects log messages from the code.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:naturalKey>tns:package</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractLoggerConfigurationType">
                <xsd:sequence>
                    <xsd:element name="package" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                TODO: packages are OR-ed
                                TODO: string, wildcards
                                allowed (* as in java)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
             </xsd:extension>
         </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SubSystemLoggerConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the logger: the facility that
                collects log messages from subsystem code.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:naturalKey>tns:component</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractLoggerConfigurationType">
                <xsd:sequence>
                    <xsd:element name="component" type="c:LoggingComponentType">
                        <xsd:annotation>
                            <xsd:documentation>
                                TODO: components are OR-ed
                                TODO: string, but there should be a way how to determine
                                list of valid categories. Maybe switch to enum later.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="LoggingLevelType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="ALL">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="OFF">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OFF"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ERROR">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="WARN">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WARN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="INFO">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INFO"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="DEBUG">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DEBUG"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="TRACE">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TRACE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="LoggingComponentType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="ALL">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="MODEL">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODEL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="PROVISIONING">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PROVISIONING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="REPOSITORY">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPOSITORY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="WEB">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WEB"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="GUI">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GUI"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="TASKMANAGER">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASKMANAGER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="RESOURCEOBJECTCHANGELISTENER">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCEOBJECTCHANGELISTENER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="WORKFLOWS">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WORKFLOWS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="NOTIFICATIONS">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NOTIFICATIONS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="TRANSPORT">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TRANSPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ACCESS_CERTIFICATION">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ACCESS_CERTIFICATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="SECURITY">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SECURITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AppenderConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the logger: the facility that
                collects log messages from the code.

                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="pattern" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AppenderConfigurationType.pattern</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
            <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>AppenderConfigurationType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <!-- <xsd:attribute name="name" type="xsd:string"/> -->
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="FileAppenderConfigurationType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:displayName>FileAppenderConfigurationType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AppenderConfigurationType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="fileName" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>FileAppenderConfigurationType.fileName</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="filePattern" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>FileAppenderConfigurationType.filePattern</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="maxHistory" type="xsd:int">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>FileAppenderConfigurationType.maxHistory</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="totalSizeCap" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>FileAppenderConfigurationType.totalSizeCap</a:displayName>
                                <a:since>4.0</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="maxFileSize" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>FileAppenderConfigurationType.maxFileSize</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="append" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>FileAppenderConfigurationType.append</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="prudent" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Prudent mode allows remote and shared file destinations (see https://logback.qos.ch/manual/appenders.html#prudentWithRolling )
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>FileAppenderConfigurationType.prudent</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SyslogAppenderConfigurationType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:displayName>SyslogAppenderConfigurationType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AppenderConfigurationType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="syslogHost" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>SyslogAppenderConfigurationType.syslogHost</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="port" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>SyslogAppenderConfigurationType.port</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="facility" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>SyslogAppenderConfigurationType.facility</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="suffixPattern" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>SyslogAppenderConfigurationType.suffixPattern</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="stackTracePattern" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>SyslogAppenderConfigurationType.stackTracePattern</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="throwableExcluded" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>SyslogAppenderConfigurationType.throwableExcluded</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="RoleManagementConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                A configuration for role management: role catalog, role assignments, etc.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>RoleManagementConfigurationType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="roleCatalogRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the root object of the role catalog.

                        REMOVED: Configuration was moved to adminGuiConfiguration/accessRequest/roleCatalog
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>RoleManagementConfigurationType.roleCatalogRef</a:displayName>
                        <a:removed>true</a:removed>
                        <a:deprecatedSince>4.6</a:deprecatedSince>
                        <a:removedSince>4.8</a:removedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="roleCatalogCollections" type="tns:ObjectCollectionsUseType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies the set of object collections ("role catalog views") to display in role
                        catalog. If this element is not specified then the default (hardcoded) collections
                        will be displayed. If this element is specified then only those collections specified
                        in this element are displayed.

                        REMOVED:
                        Configuration was moved to adminGuiConfiguration/accessRequest/roleCatalog
                        Requires value converting (roleCatalogCollections.collection.collectionUri -&gt; collection.identifier)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>RoleManagementConfigurationType.roleCatalogCollections</a:displayName>
                        <a:removed>true</a:removed>
                        <a:deprecatedSince>4.6</a:deprecatedSince>
                        <a:removedSince>4.8</a:removedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="defaultCollection" type="tns:ObjectCollectionUseType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies the default object collections ("role catalog view") to display in role
                        catalog.

                        REMOVED:
                        Configuration was moved to adminGuiConfiguration/accessRequest/roleCatalog
                        Requires value converting (roleCatalogCollections.collection.collectionUri -&gt; collection.identifier;
                        collection.default should be set to true)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>RoleManagementConfigurationType.defaultCollection</a:displayName>
                        <a:removed>true</a:removed>
                        <a:deprecatedSince>4.6</a:deprecatedSince>
                        <a:removedSince>4.8</a:removedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="defaultAssignmentConstraints" type="tns:AssignmentConstraintsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default assignment constraints. These constraints are applied globally to
                        the entire system.
                        This value defines whether the same
                        abstract role may be assigned only once or multiple times to the same focus.
                        This is the system-wide default value.
                        It will be possible to override this value for each individual role using the
                        policy rules in the future midPoint versions.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>RoleManagementConfigurationType.defaultAssignmentConstraints</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="defaultExecuteAfterAllApprovals" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Default value for "Execute after all approvals" flag.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>RoleManagementConfigurationType.defaultExecuteAfterAllApprovals</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="autoassignEnabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Global switch that enables autoassign functionality for roles.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                        <a:displayName>RoleManagementConfigurationType.autoassignEnabled</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="accessesMetadataEnabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Global switch that enables/disables accesses metadata processing for assignment holders.
                        When enabled assignment holder object stores not only indirect assignments (roleMembershipRef)
                        but also the details how it appeared on the object.

                        This is enabled by default.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.7</a:since>
                        <a:displayName>RoleManagementConfigurationType.accessesMetadataEnabled</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="relations" type="tns:RelationsDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of (custom) relations. This is system-global definition.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RoleManagementConfigurationType.relations</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AssignmentConstraintsType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies constraints on assignments that are placed in the same focus. It can be used
                to prohibit multiple assignment of the same role and for similar cases.
                There are several individual constraints in the type. There is a logical AND between them.
                This means that if no constraint can be violated. All active constraints must be satisfied
                at the same time.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="description" type="xsd:string"/>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element default="true" minOccurs="0" name="allowSameTarget" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Constraint all assignments that have the same target. I.e. multiple assignments
                        of the same (abstract) role.
                        If allowSameTarget=true then multiple assignments of the same role are allowed.
                        If allowSameTarget=false then multiple assignments of the same role are prohibited.
                        (but see also other constraints in this type)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="allowSameRelation" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Constraint all assignments that have the same relation.
                        E.g. if allowSameTarget=true and allowSameRelation=false then multiple assignments
                        of the same role are allowed as long as they have different relation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: prohibitSameOrg, prohibitSameTenant, parameter prohibitions -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="RelationsDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of (custom) relations.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>3.9</a:since>
                <a:displayName>RelationsDefinitionType.details</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="relation" type="tns:RelationDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of a single (custom) relation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="includeDefaultRelations" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then default (hardcoded, statically defined) relations will be included in addition
                        to those relations that are defined above. If set to false then only those relations that are defined
                        above will be used in the system.
                        EXPERIMENTAL: only partially supported
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:experimental>true</a:experimental>
                        <a:displayName>RelationsDefinitionType.includeDefaultRelations</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="RelationDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of a single (custom) relation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>3.9</a:since>
                <a:displayName>RelationDefinitionType.relation</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="ref" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Relations identifier (QName)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.ref</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description of relation purpose. This field can be used as a comment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="display" type="tns:DisplayType">
                <xsd:annotation>
                    <xsd:documentation>
                        Display properties of the relation. It is used to display the relation in
                        drop-down lists, buttons, etc..
                         Only label is used now. E.g. the CSS properties are ignored.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.display</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="category" type="tns:AreaCategoryType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies category or "area" for the relation. This may indicate that the relation
                        is used for identity governance, organizational management and so on. The category
                        is used to display the relations in appropriate parts of user interface.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.category</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="defaultFor" type="tns:RelationKindType">
                <xsd:annotation>
                    <xsd:documentation>
                        If this relation is a default for a relation kind, specify the kind here.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.defaultFor</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="kind" type="tns:RelationKindType">
                <xsd:annotation>
                    <xsd:documentation>
                        Kind(s) of which this relation is. A value of "defaultFor", if present, is automatically considered
                        to be a kind for this relation, so it is not necessary to list it here.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.kind</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="processedOnLogin" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether this relation is processed during login. The default value is true for member, meta and delegation
                        kinds, false otherwise. EXPERIMENTAL.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.processedOnLogin</a:displayName>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="processedOnRecompute" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether this relation is (by default) processed during recomputation. The default value is true
                        for member, meta, manager and delegation kinds, false otherwise. EXPERIMENTAL.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.processedOnRecompute</a:displayName>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="storedIntoParentOrgRef" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether this relation is stored into parentOrgRef item. The default value is true
                        for member kind, false otherwise. EXPERIMENTAL.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.storedIntoParentOrgRef</a:displayName>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="automaticallyMatched" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether this relation is automatically matched by order constraints (without the need to explicitly
                        list them). The default value is true for member, meta and delegation kinds, false otherwise.
                        EXPERIMENTAL.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:displayName>RelationDefinitionType.automaticallyMatched</a:displayName>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="staticallyDefined" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether this relation was statically defined in midPoint code. Do not set this flag explicitly,
                        it is filled-in when relations are parsed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.9</a:since>
                        <a:operational>true</a:operational>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="RelationKindType">
        <xsd:annotation>
            <xsd:documentation>
                Denotes a set of relations serving a single purpose.

                Until midPoint 3.9, there were fixed relations denoting e.g. manager of an organization (org:manager) or an approver
                of a role (org:approver). Starting with 3.9, relations are configurable, and each relation is characterized by its kind
                or sometimes a set of kinds.

                So we can have e.g. three approver relations (e:securityApprover, e:technicalApprover, e:businessApprover),
                a set of membership relations (org:default, e:assistant, e:external), etc. Note that here 'e' is a prefix for a custom
                namespace used to define these custom (extension) relations.

                Each relation has 0, 1 or more kinds. For example, the default org:manager relation is of MANAGER and MEMBERSHIP kinds.

                For each kind, there should be a single relation marked as the default one.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="member">
                <xsd:annotation>
                    <xsd:documentation>
                        Membership relation, usually meaning "has" or "is member of".
                        Specifies that the subject is a member of organization, or that the subject
                        has been assigned a role in a way that he gets authorizations and other content
                        provided by that role.

                        Default relation of MEMBERSHIP kind is also considered to be the overall default relation (i.e. used when
                        ref.relation is null).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MEMBER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="manager">
                <xsd:annotation>
                    <xsd:documentation>
                        Relations of "is manager of" kind. Specifies that the subject is a manager of organizational unit.
                        Relations of this kind are usually also of MEMBERSHIP kind.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MANAGER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="meta">
                <xsd:annotation>
                    <xsd:documentation>
                        Relations used for metarole assignments. Sometimes it is important to
                        distinguish metarole and member assignments. This kind of relation is used
                        for that purpose.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="META"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delegation">
                <xsd:annotation>
                    <xsd:documentation>
                        Relation "is deputy of" kind. Specifies that the subject is a deputy of another user.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELEGATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="approver">
                <xsd:annotation>
                    <xsd:documentation>
                        Relation "is approver of" kind.

                        Specifies that the subject is a (general) approver of specified (abstract) role.
                        The approver will be asked for decision if the role is assigned, if there is
                        a rule conflict during assignment (e.g. SoD conflict) or if there is any similar
                        situation.

                        This approver is responsible for the use of the role, which mostly means
                        that he decides about role assignment. It is NOT meant to approve role changes.
                        Role owner is meant for that purpose.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="APPROVER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="owner">
                <xsd:annotation>
                    <xsd:documentation>
                        Relation "is owner of" kind.

                        Specifies that the subject is a (business) owner of specified (abstract) role.
                        The owner will be asked for decision if the role is modified, when the associated
                        policy changes and so on.

                        This owner is responsible for maintaining role definition and policies. It is
                        NOT necessarily concerned with role use (e.g. assignment). The approver relation kind
                        is meant for that purpose.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OWNER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="consent">
                <xsd:annotation>
                    <xsd:documentation>
                        Relation "is consent for" kind.

                        Specifies that the subject gave a consent for using personnel information related to this role.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CONSENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="related">
                <xsd:annotation>
                    <xsd:documentation>
                        Relation "is related to" kind.

                        Specifies that the subject is somewhat related to the owner, but this relation does not bring any
                        specific privileges or entitlements or whatever to it. It is just a descriptive information, with
                        no tangible effect.

                        Currently used to link shadow owners to their dead shadows. We want to maintain such link but
                        we do not want to show them e.g. in links counts etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RELATED"/>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="AreaCategoryType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies category or "area" of a particular concept. Such category can be used
                to display the concepts in appropriate parts of user interface. For example the
                category may be used to display only governance-related relations in the governance
                UI panels.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="administration">
                <xsd:annotation>
                    <xsd:documentation>
                        General identity administration (IDM). Functionality available to
                        a common identity administrator.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADMINISTRATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="organization">
                <xsd:annotation>
                    <xsd:documentation>
                        Organizational management category: management of organizational trees,
                        organizational unit membership, unit managers, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ORGANIZATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="governance">
                <xsd:annotation>
                    <xsd:documentation>
                        Identity governance: approvers, owners, governance policies, remediation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GOVERNANCE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="policy">
                <xsd:annotation>
                    <xsd:documentation>
                        General policy management: RBAC, provisioning policies, policy rules, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POLICY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="selfService">
                <xsd:annotation>
                    <xsd:documentation>
                        End-user self service: profile update, password change, role request, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SELF_SERVICE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="dataProtection">
                <xsd:annotation>
                    <xsd:documentation>
                        Data protection: management of consent, lawful bases, data regulation compliance, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DATA_PROTECTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- TODO: system management? administration? compliance? -->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ObjectCollectionsUseType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies a set of object collections ("views") to be displayed (used) at
                a specific location in the system.
                This is generic type that can be used to specify collections to display
                in role catalog, menu, dashboard and so on.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="collection" type="tns:ObjectCollectionUseType">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the collection, its visibility, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: other elements that influence the way how the whole collection set
                       is displayed or how the collection sets configuration is merged. -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ObjectCollectionUseType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies how a specific collection ("view") is to be displayed (used) at
                a specific location in the system.
                This is generic type that can be used to specify collection to display
                in role catalog, menu, dashboard and so on.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="collectionUri" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the built-in collection.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: visibility, ordering, etc. -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="PolicyRuleType">
        <xsd:annotation>
            <xsd:documentation>
                These rules specify compliance and governance constraints.
                E.g. role exclusion (SoD), number of assignees,
                approvals, remediation, etc.

                This is the form suitable for use in assignments/inducements.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.5</a:since>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the rule. It is used to record processing of the rule
                        in the log files and for similar diagnostic reasons.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyRuleType.name</a:displayName>
                        <a:help>PolicyRuleType.name.help</a:help>
                       </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form description of the rule (comment).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyRuleType.description</a:displayName>
                        <a:help>PolicyRuleType.description.help</a:help>
                       </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
             <xsd:element name="policyConstraints" type="tns:PolicyConstraintsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Constraints to be applied to selected objects.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyRuleType.policyConstraints</a:displayName>
                        <a:help>PolicyRuleType.policyConstraints.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="markRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        Mark(s) that are the result when this policy rule is triggered.
                        These may be implicit if the policy rule is defined as part of mark definition.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>c:MarkType</a:objectReferenceTargetType>
                        <a:displayName>PolicyRuleType.mark</a:displayName>
                        <a:help>PolicyRuleType.mark.help</a:help>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="policySituation" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Policy situation that is the result when this policy rule is
                        triggered. If the situation is not explicitly stated then
                        default situation will be selected instead. The situation
                        is determined by the constraint that triggered the rule.

                        Will be eventually replaced by markRef.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyRuleType.policySituation</a:displayName>
                        <a:help>PolicyRuleType.policySituation.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="policyThreshold" type="tns:PolicyThresholdType">
                <xsd:annotation>
                    <xsd:documentation>
                        Policy threshold specification. It determines thresholds settings
                        such as count after which the action is being executed, refresh
                        interval for counter, ...
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyRuleType.policySituation</a:displayName>
                        <a:help>PolicyRuleType.policySituation.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="policyActions" type="tns:PolicyActionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Action(s) that has to be taken as a reaction to this rule being
                        triggered.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>PolicyRuleType.policyActions</a:displayName>
                        <a:help>PolicyRuleType.policyActions.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="evaluationTarget" type="tns:PolicyRuleEvaluationTargetType">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether this rule has to be applied on an object or an assignment. Normally this is determined
                        by looking at policy constraints. But this setting can be used to override that.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.7</a:since>
                        <a:displayName>PolicyRuleType.evaluationTarget</a:displayName>
                        <a:help>PolicyRuleType.evaluationTarget.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="PolicyRuleEvaluationTargetType">
        <xsd:annotation>
            <xsd:documentation>
                On what target is the policy rule intended to be evaluated.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="object">
                <xsd:annotation>
                    <xsd:documentation>
                        The rule is to be evaluated against a focus object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="assignment">
                <xsd:annotation>
                    <xsd:documentation>
                        The rule is to be evaluated against an assignment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ASSIGNMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="projection">
                <xsd:annotation>
                    <xsd:documentation>
                        The rule is to be evaluated against a projection (i.e. a resource object shadow).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.7</a:since>
                        <jaxb:typesafeEnumMember name="PROJECTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="GlobalPolicyRuleType">
        <xsd:annotation>
            <xsd:documentation>
                Policy rule for use in global configuration.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.5</a:since>
                <a:container>true</a:container>
                <a:displayName>GlobalPolicyRuleType.details</a:displayName>
                <a:naturalKey>tns:name</a:naturalKey>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:PolicyRuleType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="focusSelector" type="tns:ObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Selector for focus object. This is the object that is being changed
                                (in object modification situations) or the focus object that contains
                                the assignments (in assignment/inducement situations).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>GlobalPolicyRuleType.focusSelector</a:displayName>
                                <a:schemaContext>
                                    <a:type>tns:FocusType</a:type>
                                </a:schemaContext>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="targetSelector" type="tns:ObjectSelectorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Selector for assignment/inducement target object. It is used only in
                                assignment situations.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>GlobalPolicyRuleType.targetSelector</a:displayName>
                                <a:schemaContext>
                                    <a:type>tns:AssignmentHolderType</a:type>
                                </a:schemaContext>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                     <xsd:element minOccurs="0" name="condition" type="tns:MappingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The rule is applied only if the condition is evaluated to true.
                                If condition is not present, it is assumed to be always true.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>GlobalPolicyRuleType.condition</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="PolicyConstraintKindType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="exclusion">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXCLUSION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="requirement">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REQUIREMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="minAssigneesViolation">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MIN_ASSIGNEES_VIOLATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="maxAssigneesViolation">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MAX_ASSIGNEES_VIOLATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="objectModification">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_MODIFICATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="assignmentModification">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ASSIGNMENT_MODIFICATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="hasAssignment">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HAS_ASSIGNMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="hasNoAssignment">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HAS_NO_ASSIGNMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="objectTimeValidity">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_TIME_VALIDITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="assignmentTimeValidity">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ASSIGNMENT_TIME_VALIDITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="objectState">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_STATE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="alwaysTrue">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALWAYS_TRUE"/>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="orphaned">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ORPHANED"/>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="assignmentState">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ASSIGNMENT_STATE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="situation">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SITUATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="custom">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CUSTOM"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="transition">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TRANSITION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="collectionStats">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="COLLECTION_STATS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="and">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AND"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="or">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="not">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NOT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
       </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="SystemObjectsType">
        <xsd:annotation>
            <xsd:documentation>
                OID constants for system objects
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="00000000-0000-0000-0000-000000000001">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SYSTEM_CONFIGURATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000002">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="USER_ADMINISTRATOR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000003">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PASSWORD_POLICY_DEFAULT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000004">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ROLE_SUPERUSER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000005">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASK_CLEANUP"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000006">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASK_VALIDITY_SCANNER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000007">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASK_TRIGGER_SCANNER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000008">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ROLE_END_USER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000009">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT_AUDIT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-00000000000a">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ROLE_APPROVER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-00000000000b">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ROLE_REVIEWER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-00000000000c">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ROLE_DELEGATOR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000100">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT_RECONCILIATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000107">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT_USER_ACCOUNTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000108">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT_USER_ORGS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000109">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT_USER_ROLES"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000110">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT_USERS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000111">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT_SHADOW_OWNER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000120">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SECURITY_POLICY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000200">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOOKUP_LANGUAGES"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000210">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOOKUP_LOCALES"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000220">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOOKUP_TIMEZONES"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000230">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOOKUP_LIFECYCLE_STATES"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000300">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SYSTEM_USER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000320">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SYSTEM_ROLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000321">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_BUSINESS_ROLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000329">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_APPLICATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000340">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_MANUAL_CASE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000341">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_OPERATION_REQUEST"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000342">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_APPROVAL_CASE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000343">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_TRACE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000345">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CORRELATION_CASE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000328">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_APPLICATION_ROLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000329">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_APPLICATIONS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000330">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CLASSIFICATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000331">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CLEARANCE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000332">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLASSIFICATION_PRIVILEGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
<!--            <xsd:enumeration value="00000000-0000-0000-0000-000000000333">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLASSIFICATION_INFORMATION_SECURITY_RESPONSIBILITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration> -->
            <xsd:enumeration value="00000000-0000-0000-0000-000000000501">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_RECONCILIATION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000502">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_RECOMPUTATION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000503">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_IMPORT_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000504">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_LIVE_SYNC_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000505">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_ASYNC_UPDATE_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000506">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CLEANUP_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000507">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_REPORT_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000508">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SINGLE_BULK_ACTION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000509">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_ITERATIVE_BULK_ACTION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000510">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_REPORT_IMPORT_CLASSIC_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000511">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_REPORT_EXPORT_CLASSIC_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000512">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_REPORT_EXPORT_DISTRIBUTED_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000513">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SHADOW_INTEGRITY_CHECK_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000514">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SHADOWS_REFRESH_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000515">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_OBJECTS_DELETE_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000516">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SHADOWS_DELETE_LONG_TIME_NOT_UPDATED_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000517">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_EXECUTE_CHANGE_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000518">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_EXECUTE_DELTAS_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000519">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_REINDEX_REPOSITORY_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000520">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CERTIFICATION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000521">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_APPROVAL_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000522">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_OBJECT_INTEGRITY_CHECK_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000523">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SHADOW_RECLASSIFICATION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000528">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_UTILITY_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000529">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SYSTEM_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000530">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_VALIDITY_SCANNER_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000531">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_TRIGGER_SCANNER_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000532">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_PROPAGATION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000533">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_MULTI_PROPAGATION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000534">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CERTIFICATION_OPEN_NEXT_STAGE_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000535">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CERTIFICATION_REMEDIATION_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000536">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CERTIFICATION_START_CAMPAIGN_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000537">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CERTIFICATION_CLOSE_CURRENT_STAGE_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000538">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_CERTIFICATION_REITERATE_CAMPAIGN_TASK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000170">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_DASHBOARD_REPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000171">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_COLLECTION_REPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000172">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_REPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000600">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ORIGIN_INTERNAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000601">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ORIGIN_USER_ENTRY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000700">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_EVENT_MARK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000701">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_OBJECT_MARK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000705">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHETYPE_SHADOW_POLICY_MARK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000710">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_FOCUS_ACTIVATED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000711">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_FOCUS_DEACTIVATED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000712">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_FOCUS_RENAMED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000713">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_FOCUS_ASSIGNMENT_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000714">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_FOCUS_ARCHETYPE_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000715">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_FOCUS_PARENT_ORG_REFERENCE_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000716">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_FOCUS_ROLE_MEMBERSHIP_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000730">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROJECTION_ACTIVATED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000731">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROJECTION_DEACTIVATED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000732">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROJECTION_RENAMED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000733">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROJECTION_IDENTIFIER_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000734">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROJECTION_ENTITLEMENT_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000735">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROJECTION_PASSWORD_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000736">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_SHADOW_CLASSIFICATION_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000737">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_SHADOW_CORRELATION_STATE_CHANGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000738">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROJECTION_RESOURCE_OBJECT_AFFECTED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000800">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_PROTECTED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000801">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_DECOMMISSION_LATER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000802">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_CORRELATE_LATER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000803">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_DO_NOT_TOUCH"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000804">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_INVALID_DATA"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000805">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_UNMANAGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000806">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_MANAGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000811">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_EXCLUSION_VIOLATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000812">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_REQUIREMENT_VIOLATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000813">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_UNDERASSIGNED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000814">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_OVERASSIGNED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000815">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_OBJECT_MODIFIED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000816">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_ASSIGNMENT_MODIFIED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000817">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_HAS_ASSIGNMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000818">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_HAS_NO_ASSIGNMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000819">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_OBJECT_STATE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000820">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_ASSIGNMENT_STATE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000821">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_OBJECT_TIME_VALIDITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000822">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_ASSIGNMENT_TIME_VALIDITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000830">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_SUSPICIOUS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
<!--            <xsd:enumeration value="00000000-0000-0000-0000-000000000831">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_UNDERSTAFFED_SECURITY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000832">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_ORPHANED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000833">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MARK_NEGLECTED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration> -->
            <xsd:enumeration value="00000000-0000-0000-0001-000000000001">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DASHBOARD_ADMIN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
<!--            <xsd:enumeration value="00000000-0000-0000-0001-000000000350">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_COLLECTION_ALL_INFORMATION_SECURITY_RESPONSIBILITIES"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0001-000000000351">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_COLLECTION_SECURITY_UNDERSTAFFING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration> -->
            <xsd:enumeration value="00000000-0000-0000-0001-000000000352">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_COLLECTION_SUSPICIOUS_OBJECTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0001-000000000353">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_COLLECTION_USERS_WITH_SOD_VIOLATIONS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0001-000000000354">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_COLLECTION_ROLES_PRIVILEGED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
<!--            <xsd:enumeration value="00000000-0000-0000-0001-000000001001">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DASHBOARD_COMPLIANCE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration> -->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="FailedOperationTypeType">
        <xsd:annotation>
            <xsd:documentation>
                The enum describes the operation during the account was processed.
                But the operation failed and the account was not successfully treated
                so the account should have the information about the type of failed operation.
                E.g. the account should be deleted, but it fails. The account needs to be
                assigned with the tombstone to be deleted later.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="get">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GET"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="modify">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODIFY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="CleanupPoliciesType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of cleanup intervals and policies for various midPoint subsystems.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="auditRecords" type="tns:CleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.auditRecords</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="closedTasks" type="tns:CleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.closedTasks</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="closedCases" type="tns:CleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.closedCases</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="closedCertificationCampaigns" type="tns:CleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.closedCertificationCampaigns</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="outputReports" type="tns:CleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.outputReports</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="objectResults" type="tns:CleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.objectResults</a:displayName>
                        <a:removed>true</a:removed>
                        <a:deprecatedSince>4.3</a:deprecatedSince>
                        <a:removedSince>4.8</a:removedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="simpleOperationExecutions" type="tns:OperationExecutionCleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.simpleOperationExecutions</a:displayName>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="complexOperationExecutions" type="tns:OperationExecutionCleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.complexOperationExecutions</a:displayName>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="deadNodes" type="tns:DeadNodeCleanupPolicyType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPoliciesType.deadNodes</a:displayName>
                        <a:since>4.1</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="OperationExecutionCleanupPolicyType">
        <xsd:complexContent>
            <xsd:extension base="tns:CleanupPolicyType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="maxRecordsPerTask" type="xsd:int"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="CleanupPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of cleanup intervals and policies for a specific subsystem or feature.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="maxAge" type="xsd:duration">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPolicyType.maxAge</a:displayName>
                        <a:help>CleanupPolicyType.maxAge.help</a:help>

                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="maxRecords" type="xsd:int">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>CleanupPolicyType.maxRecords</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="DeadNodeCleanupPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Cleanup policy for dead nodes.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="maxAge" type="xsd:duration">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>DeadNodeCleanupPolicyType.maxAge</a:displayName>
                        <a:help>DeadNodeCleanupPolicyType.maxAge.help</a:help>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <!-- Things relevant to model context serialization - more precisely, those parts that are publicly visible
(i.e. their java counterparts are - or could be - contained in model-api) -->

    <xsd:simpleType name="ModelStateType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="initial">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INITIAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="primary">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PRIMARY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="secondary">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SECONDARY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="execution">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXECUTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="postexecution">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POSTEXECUTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="final">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FINAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="SelectorQualifiedGetOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                Selector-qualified options for a get-like operation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="option" type="tns:SelectorQualifiedGetOptionType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>SelectorQualifiedGetOptionsType.option</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="SelectorQualifiedGetOptionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:merger>SelectorQualifiedGetOptionType</a:merger>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="selector" type="tns:OptionObjectSelectorType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>SelectorQualifiedGetOptionType.selector</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="options" type="tns:GetOperationOptionsType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>SelectorQualifiedGetOptionType.options</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="OptionObjectSelectorType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="path" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>OptionObjectSelectorType.path</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="GetOperationOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                See GetOperationOptions for a description.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="retrieve" type="tns:RetrieveOptionType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.retrieve</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="resolve" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.resolve</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="resolveNames" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.resolveNames</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="noFetch" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.noFetch</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="raw" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.raw</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tolerateRawData" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.tolerateRawData</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="noDiscovery" type="xsd:boolean">        <!-- should be named 'doNotDiscovery' -->
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.noDiscovery</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="allowNotFound" type="xsd:boolean">
            <!-- readOnly is quite an internal flag, doesn't make sense to externalize it -->
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.allowNotFound</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="pointInTimeType" type="tns:PointInTimeTypeType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.pointInTimeType</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="staleness" type="xsd:long">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.staleness</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="distinct" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.distinct</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="definitionProcessing" type="tns:DefinitionProcessingOptionType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.definitionProcessing</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="iterationMethod" type="tns:IterationMethodType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.iterationMethod</a:displayName>
                        <a:since>4.4</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="iterationPageSize" type="xsd:int">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.iterationPageSize</a:displayName>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="errorHandling" type="tns:FetchErrorHandlingType">
                <xsd:annotation>
                    <xsd:documentation>
                        How should the errors be handled and reported. Currently supported only for
                        search operations.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.errorHandling</a:displayName>
                        <a:experimental>true</a:experimental>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="normal" minOccurs="0" name="shadowClassificationMode" type="tns:ShadowClassificationModeType">
                <xsd:annotation>
                    <xsd:documentation>
                        Should shadows be reclassified when being retrieved?
                        Used for "get" style operations: get and search.
                        For internal use. Currently supported only in a limited way.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>GetOperationOptionsType.shadowClassificationMode</a:displayName>
                        <a:since>4.9</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="RetrieveOptionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="default">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DEFAULT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="include">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INCLUDE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="exclude">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXCLUDE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="PointInTimeTypeType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="cached">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CACHED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="current">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CURRENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="future">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FUTURE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="DefinitionProcessingOptionType">
        <xsd:annotation>
            <xsd:documentation>
                How should be definitions processed when object is to be retrieved. Currently applies at the model level;
                but in the future it might be used also elsewhere.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.7.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="full">
                <xsd:annotation>
                    <xsd:documentation>
                        Full definition processing for the specified item(s) is to be done.
                        This applies recursively also to sub-items.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FULL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="onlyIfExists">
                <xsd:annotation>
                    <xsd:documentation>
                         Full definition processing for the specified item(s) is to be done, but only if the item(s) exist.
                         This applies recursively also to sub-items.

                         Currently supported on root level only.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ONLY_IF_EXISTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition for the specified item(s) is to be excluded from the resulting object, even if the item(s) do exist.

                        NOT IMPLEMENTED YET
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="IterationMethodType">
        <xsd:annotation>
            <xsd:documentation>
                How to iterate through entities in searchObjectsIterative method.
                Can be used to avoid long-running transactions in some cases.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="default">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DEFAULT"/>
                        <xsd:documentation>
                            Uses the default method configured for the particular database.
                            For databases it is traditional sequential read.
                        </xsd:documentation>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="singleTransaction">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SINGLE_TRANSACTION"/>
                        <xsd:documentation>
                            Fetches objects in single DB transaction. Not supported for all DBMSs.
                        </xsd:documentation>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="simplePaging">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SIMPLE_PAGING"/>
                        <xsd:documentation>
                            Uses the "simple paging" method: takes objects (e.g.) numbered 0 to 49, then 50 to 99,
                            then 100 to 149, and so on. The disadvantage is that if the order of objects is changed
                            during operation (e.g. by inserting/deleting some of them) then some objects can be
                            processed multiple times, where others can be skipped.
                        </xsd:documentation>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="strictlySequentialPaging">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STRICTLY_SEQUENTIAL_PAGING"/>
                        <xsd:documentation>
                            Uses the "strictly sequential paging" method: sorting returned objects by OID. This
                            is (almost) reliable in such a way that no object would be skipped. However, custom
                            paging cannot be used in this mode.
                        </xsd:documentation>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="fetchAll">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FETCH_ALL"/>
                        <xsd:documentation>
                            This is a workaround for situations when STRICTLY_SEQUENTIAL_PAGING cannot be used because
                            a client-supplied paging is present. All the objects are fetched as in regular searchObjects()
                            call and then send to the client one-by-one. (This defeats the basic purpose of
                            searchObjectsIterative but can be safely used for small numbers of objects.)

                            So this method is a safe fallback that is used when STRICTLY_SEQUENTIAL_PAGING is implicitly
                            chosen but a custom paging exists, provided that the paging contains maxSize clause with a number
                            not greater than a specified limit (maxObjectsForImplicitFetchAllIterationMethod).
                        </xsd:documentation>
                        <a:since>3.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ModelExecuteOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                Options for execution of Model operations. These options influence the way how the operations are executed.
                The options are not mandatory. All options have reasonable default values. They may not be specified at all.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:extension">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Extension container used to provide deployment-specific execution options.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="force" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Force the operation even if it would otherwise fail due to external failure. E.g. attempt to delete an account
                        that no longer exists on resource may fail without a FORCE option. If FORCE option is used then the operation is
                        finished even if the account does not exist (e.g. at least shadow is removed from midPoint repository).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="pushChanges" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        "Pushes" changes even if they are phantom. For example, when disabling already disabled user with this
                        option, all related administrativeStatus-sourced mappings are evaluated even if they would be normally
                        skipped. This restores behavior of midPoint before 4.2.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="raw" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Avoid any smart processing of the data except for schema application. Do not synchronize the data, do not apply
                        any expressions, etc.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="noCrypt" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Avoid encryption of any cleartext data on write. Applies only to the encrypted
                        data formats (ProtectedString, ProtectedByteArray).
                        It is not recommended to use in production environment. This option is provided only for diagnostic
                        purposes to be used in development environments.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="reconcile" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to reconcile focus and all projections while executing changes.
                        (implies reconcileFocus)

                        An exception to this meaning is when this flag is used during synchronization process (like in import,
                        reconciliation, or live sync task). In this case, setting reconcile = true sets the reconciliation
                        only for the projection being synchronized. Other projections are not affected.

                        This "conditional" meaning may change in the future.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="cachedShadowsUse" type="tns:CachedShadowsUseType">
                <xsd:annotation>
                    <xsd:documentation>
                        How should we use cached shadows during this operation?
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="reconcileFocus" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to reconcile focus while executing changes.
                        If this option is set and the reconcile option is not set then the projections
                        reconciliation will not be forced (but it may still happen if other configuration
                        loads full projection).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="reconcileAffected" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to reconcile affected objects after executing changes.
                        Typical use: after a role is changed, all users that have been assigned this role
                        would be reconciled.

                        Because it is difficult to determine all affected objects (e.g. users that have
                        indirectly assigned a role), midPoint does a reasonable attempt to determine
                        and reconcile them. E.g. it may be limited to a direct assignees.

                        Also, because of time complexity, the reconciliation may be executed in
                        a separate background task.

                        Support was removed in 4.2. It is replaced by new "Linked objects" functionality.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:removed>true</a:removed>
                        <a:deprecatedSince>4.2</a:deprecatedSince>
                        <a:removedSince>4.8</a:removedSince>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="executeImmediatelyAfterApproval" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to execute changes as soon as they are approved. (For the primary stage approvals, the default behavior
                        is to wait until all changes are approved/rejected and then execute the operation as a whole.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="overwrite" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to user overwrite flag. It can be used from web service, if we want to re-import some object
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="isImport" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to simulate import operation. E.g. search filters will be resolved.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="limitPropagation" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to limit change computation and execution only for the source resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="reevaluateSearchFilters" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Causes reevaluation of search filters.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="requestBusinessContext" type="tns:OperationBusinessContextType">
                <xsd:annotation>
                    <xsd:documentation>
                        Business context that describes this request.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="partialProcessing" type="tns:PartialProcessingOptionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Options that control selective execution of model logic.
                        Use with extreme care. Some combinations may be dangerous.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="initialPartialProcessing" type="tns:PartialProcessingOptionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        Partial processing for initial clockwork stage. Used primarily for eliminating overhead when starting
                        operations that are expected to result in (background) approval processing.

                        Note that if this option is used and if the clockwork proceeds to PRIMARY phase (e.g. because there are
                        no approvals), the context will be rotten after INITIAL phase. This presents some overhead. So please use
                        this option only if there is reasonable assumption that the request will stop after INITIAL phase.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.2</a:since> <!-- was present in ModelExecuteOptions earlier but got into bean in 4.2 -->
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="firstClickOnly" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If true, only the first clockwork click (presumably, in the INITIAL state) is executed.

                        This is to provide the behavior similar to previewChanges() in the modern, simulation-based,
                        implementation present in 4.9+. (Although the legacy functionality tried to project other waves
                        as well, this flag provides the best aligned behavior to appropriate use cases: computing
                        indirect assignments, and evaluating policy rules for the access request.)

                        To be used for simulations (or preview changes) only!

                        Experimental. Only for midPoint internal use.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="focusConflictResolution" type="tns:ConflictResolutionType">
                <xsd:annotation>
                    <xsd:documentation>
                        A method to resolve conflicts on focus objects. This specifies how will the
                        processors handle optimistic locking conflicts - and whether they even try
                        to detect them. The default value is null, which means that there is no reaction
                        to conflicts and that the conflicts are not even detected.
                        Note that different default conflict resolution may be specified in system configuration.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6.1</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="ignoreAssignmentPruning" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If true, assignments are not pruned even if "prune" policy action is triggered.
                        To be used when previewing changes only! Main reason is the shopping cart, when we are interested
                        in assignments conflicts - and if the assignments are pruned, the conflicts disappear.
                        See e.g. MID-8243.

                        Experimental. Only for midPoint internal use.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.7</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="previewPolicyRulesEnforcement" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If true, "enforcement" action in policy rules is previewed only, not enforced.
                        This is to provide legacy previewChanges() behavior in the modern, simulation-based, implementation
                        present in 4.9+.

                        To be used for simulations (or preview changes) only!

                        Experimental. Only for midPoint internal use.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="modelExecuteOptions" type="tns:ModelExecuteOptionsType"/>

    <xsd:complexType name="OperationBusinessContextType">
        <xsd:annotation>
            <xsd:documentation>
                The business context of an operation. This structure contains data about the operation that bind it to the
                business process or other non-information environment. It contains data such as free-form comment of the
                affected user (requester, approver) it may contain references to other business documents that are outside
                of the IDM scope (e.g. reference to the support contract or employee contact number), etc.
                It is designed for future extensibility.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" ref="tns:extension">
                <xsd:annotation>
                    <xsd:documentation>
                        The extension for future dynamic extensibility.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="comment" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free-form comment of the affected person. If this business context describe the request then
                        this is the requestor comment. If the context describes approval step then this is approver
                        comment. The comment is expected to be a short comment justifying the request, explaining
                        the decision and so on. It is supposed to be few lines of text at the most.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO: we may want to add more generic fields here in the future. E.g. contract reference (contract number) may be a good addition. -->
        </xsd:sequence>
   </xsd:complexType>

    <xsd:complexType name="PartialProcessingOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                Options that allows to select only some of the projector/clockwork parts to process.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="automatic" minOccurs="0" name="load" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="focus" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="inbound" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="focusActivation" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="objectTemplateBeforeAssignments" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="assignments" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="assignmentsOrg" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="assignmentsMembershipAndDelegate" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="assignmentsConflicts" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="focusLifecycle" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="objectTemplateAfterAssignments" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="focusCredentials" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="focusPolicyRules" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="policyRuleCounters" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="projection" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="outbound" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="projectionValues" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="projectionCredentials" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="projectionReconciliation" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="projectionLifecycle" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="projectionPolicyRules" type="tns:PartialProcessingTypeType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:since>4.7</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="automatic" minOccurs="0" name="objectTemplateAfterProjections" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="approvals" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="execution" type="tns:PartialProcessingTypeType"/>
            <xsd:element default="automatic" minOccurs="0" name="notification" type="tns:PartialProcessingTypeType"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
   </xsd:complexType>
   <xsd:element name="partialProcessingOptions" type="tns:PartialProcessingOptionsType">
       <xsd:annotation>
           <xsd:documentation>
               Business context that describes this request.
               Global element - for use in task extension.
           </xsd:documentation>
       </xsd:annotation>
   </xsd:element>

    <xsd:simpleType name="PartialProcessingTypeType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies whether a particular part should be processed or not.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="automatic">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Process the part if it would be processed normally.
                            This is automatic behavior that leaves the decision
                            to the code. This means that all usual parts of the
                            code will be processed.
                            This is the default option.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AUTOMATIC"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="skip">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Skip processing of a particular part.
                            Do NOT process it. This setting can be
                            used to skip particular parts that would
                            be normally processed. However, using this
                            option may cause errors and/or wrong results.
                            Use with care.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SKIP"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="process">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Process particular part. This setting can be used
                            to turn on processing of optional parts of the code
                            or to override the automatic behavior.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PROCESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ModelCompareOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                EXPERIMENTAL.
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="computeCurrentToProvided" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Computes current-to-provided delta. ("Current" means the object that is currently available in the midPoint.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="computeProvidedToCurrent" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Computes provided-to-current delta.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="returnNormalized" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Returns the normalized version of provided object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="returnCurrent" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Returns the current version of provided object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="ignoreOperationalItems" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Should the items marked as operational be ignored?
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="SynchronizationIntentType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        New account that should be added (and linked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that should be deleted (and unlinked)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="keep">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="KEEP"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is kept as it is (remains linked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unlink">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNLINK"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that should be unlinked (but NOT deleted).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="synchronize">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SYNCHRONIZE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that belongs to the user and needs to be synchronized.
                        This may include deleting, archiving or disabling the account.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="SynchronizationPolicyDecisionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        New account that is going to be added (and linked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is going to be deleted (and unlinked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="keep">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="KEEP"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is kept as it is (remains linked).
                        Note: there still may be attribute or entitlement changes.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unlink">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNLINK"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is going to be unlinked (but NOT deleted).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="broken">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BROKEN"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        The account is not usable. E.g. because the associated shadow does
                        not exist anymore, resource does not exist anymore, etc.
                        Such account link will be removed.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ObjectDeltaOperationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="objectOid" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        OID of object that was target of this operation. If objectDelta is present it must not have value or
                        value must be same as objectDelta/oid.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="objectDelta" type="t:ObjectDeltaType"/>
            <xsd:element minOccurs="0" name="executionResult" type="tns:OperationResultType"/>
            <xsd:element minOccurs="0" name="objectName" type="t:PolyStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the object that was the target of this delta, if known.
                        As for other similar attributes, it may become obsolete.
                        Useful for informational purposes, typically in audit records.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="resourceOid" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        OID of the resource that is related to this operation - typically
                        if the object being processed is a shadow of a resource object.
                        Useful for informational purposes, typically in audit records.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="resourceName" type="t:PolyStringType">
                <xsd:annotation>
                    <xsd:documentation>
                        Name of the resource that is related to this operation - typically
                        if the object being processed is a shadow of a resource object.
                        As for other similar attributes, it may become obsolete.
                        Useful for informational purposes, typically in audit records.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

            <xsd:element name="shadowKind" type="tns:ShadowKindType">
                <xsd:annotation>
                    <xsd:documentation>
                        Shadow kind of the shadow, that is related to this operation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="shadowIntent" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Shadow kind of the shadow, that is related to this operation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ProvidedServiceConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of a service provided by midPoint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short name of the service.
                        It will be used as a short identifier, e.g. in logfiles, item paths and so on.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="identifier" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Exact identifier of the service (abstract URI).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="provenance" type="tns:ProvenanceFeedDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of a provenance metadata for data that originate from this service.
                        E.g. provenance definition for data that are entered in the user interface or that are supplied to REST service.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <!-- TODO profiling Configuration -->
    <xsd:complexType name="ProfilingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                A configuration for profiling features of midPoint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:resourceObjectChangeListener</a:element>
                    <a:version>4.0</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="enabled" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.enabled</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="requestFilter" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.requestFilter</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="performanceStatistics" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.performanceStatistics</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="dumpInterval" type="xsd:int">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.dumpInterval</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- Subsystems start -->
            <xsd:element default="false" minOccurs="0" name="model" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.model</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="repository" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.repository</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="provisioning" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.provisioning</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="ucf" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        This profiling option is currently not supported.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.ucf</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="synchronizationService" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.synchronizationService</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="taskManager" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.taskManager</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="workflow" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>ProfilingConfigurationType.workflow</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- Subsystems end -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="profilingConfiguration" type="tns:ProfilingConfigurationType"/>

    <xsd:complexType name="ReportParameterType">
     <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
       <xsd:sequence>
            <xsd:any maxOccurs="unbounded" minOccurs="0" processContents="lax">
            </xsd:any>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ReportType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of midPoint report. This specification defines what the report should
                contain, how it should look like, output format and so on.

                This specification does NOT define when the report is executed. The report may be
                executed ad-hoc (e.g. by explicitly executing it in GUI), or the report may be
                scheduled by using a task.
            </xsd:documentation>
            <xsd:appinfo>
                <a:schemaMigration>
                    <a:element>tns:parent</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:subreport</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:template</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:templateStyle</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:useHibernateSession</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:dataSource</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:dataSource</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:field</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:configuration</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:configurationSchema</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:virtualizer</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:virtualizerKickOn</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:maxPages</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:timeout</a:element>
                    <a:version>4.2</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:reportEngine</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
                <a:schemaMigration>
                    <a:element>tns:jasper</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>

                    <xsd:element minOccurs="0" name="dashboard" type="tns:DashboardReportEngineConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Configuration for dashboard-based reports. Only applicable if reportEngine=dashboard.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ReportType.dashboard</a:displayName>
                                <a:since>4.0</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="objectCollection" type="tns:ObjectCollectionReportEngineConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Configuration for object collection-based reports. Only applicable if reportEngine=objectCollection.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ReportType.objectCollection</a:displayName>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="fileFormat" type="tns:FileFormatConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Report output file format.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ReportType.export</a:displayName>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="defaultScriptConfiguration" type="tns:ScriptExpressionEvaluatorConfigurationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Default configuration for the scripts executed inside the report.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.0</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element minOccurs="0" name="postReportScript" type="tns:CommandLineScriptType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Command-line script that will be executed after the report is complete
                                and the output file is completely produced. Output filename will
                                be passed to the script as the "file" argument.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>3.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="behavior" type="tns:ReportBehaviorType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Behavior for report. Contains import option and direction of report.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>GuiObjectColumnType.behavior</a:displayName>
                                <a:experimental>true</a:experimental>
                                <a:since>4.2</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="report" substitutionGroup="c:object" type="tns:ReportType"/>

    <xsd:complexType name="ReportBehaviorType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Behavior for report. Contains import option and direction of report.
                </p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="export" minOccurs="0" name="direction" type="tns:DirectionTypeType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Direction of report. We can use export or import direction.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ReportBehaviorType.direction</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="importOptions" type="tns:ImportOptionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Options used during importing of new objects from file.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ReportBehaviorType.importOptions</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="importScript" type="s:ExecuteScriptType">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Script used for processing lines from file.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ReportBehaviorType.importExecuteScript</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ReportEngineSelectionType">
        <xsd:annotation>
            <xsd:documentation>
                Selects which report engine should be used to render this report.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="jasper">
                <xsd:annotation>
                    <xsd:documentation>JasperReports engine</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="JASPER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="dashboard">
                <xsd:annotation>
                    <xsd:documentation>
                        Dashboard reports. The reports will be based on a dashboard.
                        In fact, the report will be a static version of the dashboard
                        at the time when the report runs.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DASHBOARD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="collection">
                <xsd:annotation>
                    <xsd:documentation>
                        Collection reports. The reports will be based on a collection.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="COLLECTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="FileFormatConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Export configuration.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="type" type="tns:FileFormatTypeType">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of export file.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>ExportConfigurationType.type</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:choice>
                <xsd:element minOccurs="0" name="csv" type="tns:CsvFileFormatType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Configuration for CSV type.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>ExportConfigurationType.csv</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element minOccurs="0" name="html" type="tns:HtmlFileFormatType">
                    <xsd:annotation>
                        <xsd:documentation>
                            Configuration for HTML type.
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>ExportConfigurationType.html</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="FileFormatTypeType">
        <xsd:annotation>
            <xsd:documentation>
                Report export type.
                csv, html.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="csv">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CSV"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="html">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HTML"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AbstractFileFormatType">
        <xsd:annotation>
            <xsd:documentation>
                Supertype of report export types.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.2</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="CsvFileFormatType">
        <xsd:annotation>
            <xsd:documentation>
                CSV export type for Report.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractFileFormatType">
                <xsd:sequence>
                    <xsd:element default="," minOccurs="0" name="multivalueDelimiter" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Delimiter for multivalue property.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.multivalueDelimiter</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default=";" minOccurs="0" name="fieldDelimiter" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Delimiter for field of csv file.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.fieldDelimiter</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="\" minOccurs="0" name="escape" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                The escape character of the format.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.escape</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="&quot;" minOccurs="0" name="quote" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Character for the quote.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.quote</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="nonNumeric" minOccurs="0" name="quoteMode" type="tns:QuoteModeType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Quote Mode for records. Possible values is all, allNonNull, minimal, nonNumeric and none.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.quoteMode</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="&#13;&#10;" minOccurs="0" name="recordSeparator" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Separator of line of record.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.recordSeparator</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="trailingDelimiter" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Define, whether to add a trailing delimiter.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.trailingDelimiter</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="trim" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Define, whether to trim leading and trailing blanks.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.trim</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="true" minOccurs="0" name="header" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Create header in csv output file.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.createHeader</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="utf-8" minOccurs="0" name="encoding" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Encoding of csv file.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>CsvExportType.encoding</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="QuoteModeType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies type of quote.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="all">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Quotes all fields.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="allNonNull">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Quotes all non-null fields.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL_NON_NULL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="minimal">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Quotes fields which contain special characters such as a the field delimiter,
                            quote character or any of the characters in the line separator string.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MINIMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="nonNumeric">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Quotes all non-numeric fields.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NON_NUMERIC"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                            Never quotes fields. When the delimiter occurs in data, the printer prefixes it with the escape character.
                            If the escape character is not set, format validation throws an exception.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="HtmlFileFormatType">
        <xsd:annotation>
            <xsd:documentation>
                HTML export type for Report.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractFileFormatType"/>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ReportConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Report configuration based on report configuration schema.
                TODO

                This element belongs to ReportType and should
                not be used elsewhere. This is a top-level
                element to make the implementation (JAXB
                marshal/unmarshal) easier.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any maxOccurs="unbounded" minOccurs="0" processContents="lax">
            </xsd:any>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="AbstractReportEngineConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Abstract type for configuration of reports.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="DashboardReportEngineConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of dashboard-based reports.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.0</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractReportEngineConfigurationType">
                <xsd:sequence>
                    <xsd:element name="dashboardRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to dashboard definition that should be used as a basis for the report.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:DashboardType</a:objectReferenceTargetType>
                                <a:displayName>DashboardReportEngineConfigurationType.dashboardRef</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="view" type="tns:GuiObjectListViewType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies a view of an object collection that is be reported.
                                    We can specify more views for different object types.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:displayName>DashboardReportEngineConfigurationType.view</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="showOnlyWidgetsTable" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Some export types show tables of objects from widgets.
                                    These tables don't show if this element is true.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:displayName>DashboardReportEngineConfigurationType.showOnlyWidgetsTable</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="onlyFile" minOccurs="0" name="storeExportedWidgetData" type="tns:StoreExportedWidgetDataType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Type of storing exported widget data.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.4</a:since>
                                <a:displayName>DashboardReportEngineConfigurationType.storeExportedData</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <!-- TODO: other elements to configure the report -->
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="StoreExportedWidgetDataType">
        <xsd:annotation>
            <xsd:documentation>
                Type of storing exported widget data. Specification where will be stored widget data.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="onlyWidget">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ONLY_WIDGET"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Exported widget data will be stored only in element of widget.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="onlyFile">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ONLY_FILE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Exported widget data will be stored only in file.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="widgetAndFile">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WIDGET_AND_FILE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Exported widget data will be stored only in element of widget and file.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ObjectCollectionReportEngineConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of object collection-based reports.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractReportEngineConfigurationType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="collection" type="tns:CollectionRefSpecificationType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Specification of an explicit or implicit object collection that will be used to select objects in report.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:displayName>ObjectCollectionReportEngineConfigurationType.collection</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="view" type="tns:GuiObjectListViewType">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies a view of an object collection that is be reported.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectCollectionReportEngineConfigurationType.view</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="condition" type="tns:ExpressionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Condition for the searched objects. Searched object will be shown if the condition evaluates to true.
                                This condition use only for reports and as last option because of performance.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.2</a:since>
                                <a:experimental>true</a:experimental>
                                <a:displayName>ObjectCollectionReportEngineConfigurationType.condition</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="useOnlyReportView" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                    Specifies that during creating of report will be used only view in report without merging with other view.
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>ObjectCollectionReportEngineConfigurationType.useOnlyReportView</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="parameter" type="c:SearchFilterParameterType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Parameter used in filter expression.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.4</a:since>
                                <a:displayName>ObjectCollectionReportEngineConfigurationType.parameter</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="subreport" type="c:SubreportParameterType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Subreport with expression.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:since>4.4</a:since>
                                <a:displayName>ObjectCollectionReportEngineConfigurationType.subreport</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SubreportParameterType">
        <xsd:annotation>
            <xsd:documentation>
                Subreport with expression.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.4</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ExpressionParameterType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="order" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                Order in which this entry is to be evaluated. (Related to other entries.) Smaller numbers
                                go first. Entries with no order go last.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SubreportParameterType.order</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="resultHandling" type="tns:SubreportResultHandlingType">
                        <xsd:annotation>
                            <xsd:documentation>
                                How should we handle the situations when the sub-report produces either multiple values,
                                or no values at all?

                                BEWARE: This item is currently not supported when previewing reports in GUI. Attempts to
                                preview reports with this feature may fail.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>SubreportParameterType.resultHandling</a:displayName>
                                <a:since>4.7</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SubreportResultHandlingType">
        <xsd:annotation>
            <xsd:documentation>
                How should we handle the situations when a sub-report produces either either multiple values, or no values at all?
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="embedInParentRow" minOccurs="0" name="multipleValues" type="tns:MultipleSubreportResultValuesHandlingType">
                <xsd:annotation>
                    <xsd:documentation>
                        How should we handle the situations when a sub-report produces multiple values?
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SubreportResultHandlingType.multipleValues</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="keepParentRow" minOccurs="0" name="noValues" type="tns:NoSubreportResultValuesHandlingType">
                <xsd:annotation>
                    <xsd:documentation>
                        How should we handle the situations when a sub-report produces no values?
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>SubreportResultHandlingType.noValues</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="MultipleSubreportResultValuesHandlingType">
        <xsd:annotation>
            <xsd:documentation>
                How should we handle the situations when a sub-report produces multiple values?
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="embedInParentRow">
                <xsd:annotation>
                    <xsd:documentation>
                        The values of the sub-report are used within the parent row. No row manipulation is done.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EMBED_IN_PARENT_ROW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="splitParentRow">
                <xsd:annotation>
                    <xsd:documentation>
                        The N &gt; 1 value(s) of the sub-report are "joined" (in the relational terms) with the parent row,
                        producing N rows. In each of these rows the value of the respective element is provided as a variable
                        named as specified in this subreport.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SPLIT_PARENT_ROW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="NoSubreportResultValuesHandlingType">
        <xsd:annotation>
            <xsd:documentation>
                How should we handle the situations when a sub-report produces no values?
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="keepParentRow">
                <xsd:annotation>
                    <xsd:documentation>
                        The parent row is kept intact. The respective variable (named after the subreport) is null.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="KEEP_PARENT_ROW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="removeParentRow">
                <xsd:annotation>
                    <xsd:documentation>
                        The parent row is removed. No further evaluation of subreports nor columns is done.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REMOVE_PARENT_ROW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ReportDataType">
        <xsd:annotation>
            <xsd:documentation>
                Reports outputs.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element name="filePath" type="xsd:string"/>
                    <xsd:element name="fileFormat" type="tns:FileFormatTypeType">
                    </xsd:element>
                    <xsd:element name="reportRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Report which is assigned.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ReportType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="nodeRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Node where the generated report is stored.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:NodeType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="parentRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Parent report data object. If present it means that this object contains only a partial
                                information that should be eventually aggregated into the parent report data - and deleted.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ReportDataType</a:objectReferenceTargetType>
                                <a:experimental>true</a:experimental>
                                <a:since>4.4</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="sequentialNumber" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                Sequential number of partial report data. Can be present if and only if parentRef is specified.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:since>4.4</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="data" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Full data of the report.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:experimental>true</a:experimental>
                                <a:since>4.4</a:since>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:element name="reportData" substitutionGroup="c:object" type="tns:ReportDataType"/>

    <xsd:complexType name="SequenceType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                    Definition of a sequence object that produces unique values. The sequence state is
                    persistently stored in the repository, therefore it can efficiently produce unique
                    identifiers in a controlled and predictable manner.
                </p>
                <p>
                    The sequence is atomic. If two threads or even two nodes request a value from
                    the same sequence at the same time then different values will be returned. Therefore the
                    use of the sequence has some inherent cost (e.g. database locking overhead).
                </p>
                <p>
                    The sequence produces only values of type "long". If any other type or format is needed
                    then an expression must be used to transform the value.
                </p>
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="counter" type="xsd:long">
                        <xsd:annotation>
                            <xsd:documentation>
                                Current state of the sequence. This is the next number that will be assigned
                                from the sequence when "advance" operation is invoked and there are no unused values
                                to re-use.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="unusedValues" type="xsd:long">
                        <xsd:annotation>
                            <xsd:documentation>
                                List of values that were already assigned by the sequence but they were not used.
                                The client can return unused values to sequence so the sequence will not advance
                                too fast. If there are any unused values, these will be assigned from the sequence
                                before the regular value from the counter.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="maxCounter" type="xsd:long">
                        <xsd:annotation>
                            <xsd:documentation>
                                Maximum value that the counter can produce. If not specified then
                                the highest value that the "long" datatype can produce is assumed.
                                (Please note that this may depend on the range of underlying database type)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element default="false" minOccurs="0" name="allowRewind" type="xsd:boolean">
                        <xsd:annotation>
                            <xsd:documentation>
                                Flag that affects the behaviour in case maxCounter is exceeded. If set to true then
                                the counter is reset to zero. If set to false then an error is produced.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="maxUnusedValues" type="xsd:int">
                        <xsd:annotation>
                            <xsd:documentation>
                                The number of unused values that the sequence will maintain.
                                If set to zero then no values are maintained and therefore the
                                use of unused values is effectively prohibited. This will make
                                the sequence strictly monotonous.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="sequence" type="tns:SequenceType"/>

    <xsd:simpleType name="DirectionTypeType">
        <xsd:annotation>
            <xsd:documentation>
                Direction of report. We can use export or import direction.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.2</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="import">
                <xsd:annotation>
                    <xsd:documentation>
                        Import direction. We can use it for importing objects from file.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IMPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="export">
                <xsd:annotation>
                    <xsd:documentation>
                        Export direction. We can use it for exporting objects to report file.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ImportOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                The options for import tasks. It specifies optional settings for import such as "overwrite" and "stop on
                error".
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="overwrite" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to a true value it will cause that objects that are already in the repository will be
                        overwritten by the imported objects.
                        It may not be applicable to all import types. E.g. it makes no sense for import from resource,
                        as this
                        is not storing objects in the repository directly.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="keepOid" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to a true value it will cause that objects that overwritten objects will reuse the same
                        OID
                        as previous objects.
                        May be potentially dangerous. USE WITH CARE.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="stopAfterErrors" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of errors that will cause import to stop. If set to one the import will stop on first
                        error.
                        If set to zero or negative value the import will not stop on any error.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="summarizeSucceses" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true the successfully imported items will be summarized in the result.
                        WARNING: setting this to false may result in a very large result structure and may cause
                        overflow of the system memory.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="summarizeErrors" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true the import errors will be summarized in the result.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="referentialIntegrity" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="validateStaticSchema" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="validateDynamicSchema" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="true" minOccurs="0" name="encryptProtectedValues" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="fetchResourceSchema" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="keepMetadata" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true then the importer will keep the metadata from the source file.
                        If set to false then the imported will re-generate metadata on each object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="modelExecutionOptions" type="c:ModelExecuteOptionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        If present, these options are used for adding objects into the repository.
                        Null option values might be overridden by import-related options. In particular, the missing
                        "raw" option is overridden to "true". So, if you want the operation run in non-raw mode,
                        set "raw" option to "false".
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="false" minOccurs="0" name="compatMode" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Compatibility model. If selected then the data parsing will be less strict.
                        E.g. removed element will be ignored.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ObjectTreeDeltasType">
        <xsd:annotation>
            <xsd:documentation>
                Container for ChangesRequested (focus primary delta and/or projection primary deltas).
            </xsd:documentation>
            <xsd:appinfo>       <!-- switch to container after deltas will be moved out of task extension -->
                <!--<a:container/>-->
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="focusPrimaryDelta" type="t:ObjectDeltaType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="projectionPrimaryDelta" type="tns:ProjectionObjectDeltaType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="objectTreeDeltas" type="tns:ObjectTreeDeltasType"/>

    <xsd:complexType name="ProjectionObjectDeltaType">
        <xsd:annotation>

            <xsd:documentation>
                TODO
            </xsd:documentation>
            <!--<xsd:appinfo>-->
            <!--<a:container/>-->
            <!--</xsd:appinfo>-->
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="resourceShadowDiscriminator" type="c:ShadowDiscriminatorType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="primaryDelta" type="t:ObjectDeltaType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="MappingEvaluationRequestType">
        <xsd:annotation>
            <xsd:documentation>
                TODO ... EXPERIMENTAL
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="sourceContext" type="c:MappingEvaluationSourceContextType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="targetContext" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="variable" type="c:MappingEvaluationVariableType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="options" type="c:MappingEvaluationOptionsType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="mapping" type="c:MappingType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="MappingEvaluationRequest" type="tns:MappingEvaluationRequestType"/>

    <xsd:complexType name="MappingEvaluationSourceContextType">
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string"/>
            <xsd:choice>
                <xsd:element minOccurs="0" name="objectRef" type="c:ObjectReferenceType"/>
                <xsd:element ref="c:object"/>
            </xsd:choice>
            <xsd:element minOccurs="0" name="delta" type="t:ObjectDeltaType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="MappingEvaluationVariableType">
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string"/>
            <xsd:element minOccurs="0" ref="c:value"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="MappingEvaluationOptionsType">
        <xsd:sequence>
            <xsd:element minOccurs="0" name="now" type="xsd:dateTime"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="MappingEvaluationResponseType">
        <xsd:annotation>
            <xsd:documentation>
                TODO ... EXPERIMENTAL
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="response" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="MappingEvaluationResponse" type="tns:MappingEvaluationResponseType"/>

    <xsd:complexType name="LogFileContentType">
        <xsd:sequence>
            <xsd:element name="content" type="xsd:string"/>
            <xsd:element name="at" type="xsd:long">
                <xsd:annotation>
                    <xsd:documentation>
                        Position of this fragment in the log file.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="complete" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        Is the fragment we are returning the complete content of the log file (starting from the given position)?
                        I.e. if false, there are some data after this fragment.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="logFileSize" type="xsd:long">
                <xsd:annotation>
                    <xsd:documentation>
                        Current log file size, in bytes.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="BuildInformationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="version" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Version taken from POM file, e.g. 3.4.1 or 3.5-SNAPSHOT.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="revision" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Revision, i.e. output of git describe command. Example: git-v3.5devel-314-g02f4792.
                        May not be known, depending on how midPoint was built.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ValidationResultType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="issue" type="tns:ValidationIssueType">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="validationResult" type="tns:ValidationResultType"/>

    <xsd:complexType name="ValidationIssueType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="severity" type="tns:ValidationIssueSeverityType"/>
            <xsd:element name="category" type="xsd:string"/>
            <xsd:element name="code" type="xsd:string"/>
            <xsd:element name="text" type="xsd:string"/>
            <xsd:element minOccurs="0" name="objectRef" type="tns:ObjectReferenceType"/>
            <xsd:element minOccurs="0" name="itemPath" type="xsd:string"/>                    <!-- ItemPathType is problem within containers -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="ValidationIssueSeverityType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="error">
                <xsd:annotation>
                    <xsd:documentation>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="warning">
                <xsd:annotation>
                    <xsd:documentation>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WARNING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="info">
                <xsd:annotation>
                    <xsd:documentation>
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INFO"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="MergeConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration that specifies automatic merging of two objects.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short name of the merge configuration that also works as identifier for this configuration.
                        It has to be unique among all the applicable merge configurations.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="displayName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free form-name that can be displayed in user interfaces.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                            <xsd:annotation>
                    <xsd:documentation>
                        Free form description that can be displayed in user interfaces. It may be
                        longer text (more than few lines).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="item" type="tns:ItemRefMergeConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Item merge configuration. It will be applied to the specified (named) item.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="projection" type="tns:ProjectionMergeConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Projection merge configuration. It will be applied to merge projections (linkRefs)
                        of the objects.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="default" type="tns:ItemMergeConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Default merge configuration. It will be applied to all the items that are not
                        explicitly specified in the item merge configurations.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ItemMergeConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="ignore" minOccurs="0" name="left" type="tns:MergeStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Strategy to process values from the left-hand-side object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element default="ignore" minOccurs="0" name="right" type="tns:MergeStrategyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Strategy to process values from the right-hand-side object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="valueExpression" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Expression to process every value (if specified by strategy). The value that the
                        expression returns will be taken. If the expression returns null then the value will
                        be skipped.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="ItemRefMergeConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ItemMergeConfigurationType">
                <xsd:sequence>
                    <xsd:element name="ref" type="t:ItemPathType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ProjectionMergeConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ItemMergeConfigurationType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="situation" type="tns:ProjectionMergeSituationType"/>
                    <xsd:element minOccurs="0" name="projectionDiscriminator" type="tns:ShadowDiscriminatorType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="MergeStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="ignore">
                <xsd:annotation>
                    <xsd:documentation>
                        Ignore all the values.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IGNORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="take">
                <xsd:annotation>
                    <xsd:documentation>
                        Take all the values.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TAKE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="expression">
                <xsd:annotation>
                    <xsd:documentation>
                        Take only values that are selected and processed by the expression.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXPRESSION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <!-- TODO: values for manual selection may come here in the future. -->
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ProjectionMergeSituationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="existing">
                <xsd:annotation>
                    <xsd:documentation>
                        Projection exists on the left side. There is no conflicting
                        projection on the right side.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXISTING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="mergeable">
                <xsd:annotation>
                    <xsd:documentation>
                        Projection exists on the right side. There is no conflicting
                        projection on the left side. The projection can be merged.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MERGEABLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="conflict">
                <xsd:annotation>
                    <xsd:documentation>
                        There are two conflicting projections, one on the left side
                        other on the right side.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CONFLICT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="DeploymentInformationType">
        <xsd:annotation>
            <xsd:documentation>
                Information about midPoint deployment: subscription information, deployment name,
                description, color and so on.
                These information are not critical for midPoint operation. However they may influence
                the look and feel of this midPoint instance.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.5.1</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short name of this midPoint deployment. The name will be displayed
                        on a prominent place in the user interface, most likely displayed as
                        a part of the header (on every page). The name is usually used
                        to distinguish between midPoint deployments in the same organization.
                        Strings such as "DEVEL", "TEST", "UAT" are often used.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.name</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="description" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Free form description that specifies the details of this deployment.
                        It may be significantly long (few paragraphs). It has no special purpose
                        other then a form of "on-line" documentation for the deployment. It will
                        NOT be displayed on every page. It will most likely be displayed on a system
                        configuration pages or in configuration summaries.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.description</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" ref="tns:documentation"/>
            <xsd:element minOccurs="0" name="headerColor" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of a color that will be used as a background for a page header.
                        The color can be used as a form of easy look and feel customization to match the
                        customer corporate identity. But perhaps more often the color will be used to
                        distinguish different midPoint environments in the same organization, e.g.
                        green color for devel environment, blue color for testing, etc.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.headerColor</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="skin" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of the adminLTE skin that will be applied to the base template.
                        The base template contains 12 predefined skins including: skin-blue, skin-blue-light
                        skin-yellow, skin-yellow-light, skin-green, skin-green-light, skin-purple, skin-purple-light,
                        skin-red, skin-red-light, skin-black and skin-black-light.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6.1</a:since>
                        <a:displayName>DeploymentInformationType.skin</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="logo" type="tns:IconType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of a logo that will be used in the title bar on every screen.
                        This can be used as an easy customization and point to a customer logo. Or
                        it may be used as an icon to indicate the environment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.logo</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="customerName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short name of the organization that is end user of the midPoint deployment.
                        It is supposed to be a company name, such as "ExAmPLE, Inc."
                        It will be displayed together with subscription information.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.customerName</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="customerUrl" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        URL of the customer web site. It will be used as a link target in case
                        that the customer name is displayed as hyperlink.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.customerUrl</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="partnerName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Short name of the organization that deployed this midPoint instance.
                        It is usually the name of Evolveum partner.
                        It is supposed to be a company name, such as "ExAmPLE, Inc."
                        It will be displayed together with subscription information.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.partnerName</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="partnerUrl" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        URL of the partner web site. It will be used as a link target in case
                        that the partner name is displayed as hyperlink.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.partnerUrl</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="subscriptionIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier of Evolveum subscription contract that applies to this deployment.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.subscriptionIdentifier</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="systemName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Custom name for midPoint identity management system.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>DeploymentInformationType.systemName</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="additionalFooter" type="xsd:base64Binary">
                <xsd:annotation>
                    <xsd:documentation>
                        Base64 encoded string containing HTML fragment that will be rendered as additional header.

                        WARNING:
                        Content of this field will be not be escaped and rendered on page AS IS.
                        Make sure to avoid XSS and other security issues.

                        Experimental.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.10.1</a:since>
                        <a:experimental/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="InfrastructureConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Technical (infrastructure) configuration of midPoint deployment.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="defaultHostname" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Hostname that will be used as a public hostname for the midPoint deployment.
                        E.g. it will be used in URLs that point to the midPoint in notification mails.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>InfrastructureConfigurationType.defaultHostname</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="intraClusterHttpUrlPattern" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Pattern for HTTP/HTTPS communication inside midPoint cluster.
                        This is specifies the URLs that ure used by midPoint cluster nodes
                        when they need to communicate with each other. The pattern is in fact
                        an URL prefix pointing to root URL of the application. Specific paths
                        will be appended to the URL.
                        Example: https://$host/midpoint
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>InfrastructureConfigurationType.intraClusterHttpUrlPattern</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="remoteHostAddressHeader" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Whether to try to determine client's IP address information from HTTP headers and if so,
                        what header(s) to use. Note that the order of headers to try is indeterminate: they might be
                        tried in any order.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>3.6</a:since>
                        <a:displayName>InfrastructureConfigurationType.remoteHostAddressHeader</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="publicHttpUrlPattern" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Pattern for HTTP/HTTPS communication with client. This specifies the URL
                        that is used by midPoint when it creates redirect URL for client.
                        The pattern is in fact an URL prefix pointing to root URL of the application.
                        Specific paths will be appended to the URL.
                        Example: 'https://$host/midpoint', where 'defaultHostname' element is used as '$host'.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.1</a:since>
                        <a:displayName>InfrastructureConfigurationType.publicHttpUrlPattern</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:complexType name="CachingPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of object attribute caching policies.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:since>3.5</a:since>
                <a:schemaMigration>
                    <a:element>tns:cachingStategy</a:element>
                    <a:version>4.6</a:version>
                    <a:operation>moved</a:operation>
                    <a:replacement>tns:cachingStrategy</a:replacement>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="none" minOccurs="0" name="cachingStrategy" type="tns:CachingStrategyType"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:simpleType name="CachingStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of overall caching strategy.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        Do not cache information at all. Caches are not used and not maintained.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="passive">
                <xsd:annotation>
                    <xsd:documentation>
                        Caches are maintained with minimal impact on normal operations.
                        Generally the data are cached only if they are retrieved for other
                        reasons. There is no read-ahead. The writes are always going to the
                        resource (synchronously): read-through, write-through.
                        There is no cache eviction (but old information is overwritten if
                        newer information is available).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PASSIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="OperationExecutionType">
        <xsd:annotation>
            <xsd:documentation>
                Information about an operation executed on an object.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.6</a:since>
                <a:container/>
                <a:schemaMigration>
                    <a:element>tns:taskPartUri</a:element>
                    <a:version>4.4</a:version>
                    <a:operation>removed</a:operation>
                </a:schemaMigration>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="recordType" type="tns:OperationExecutionRecordTypeType">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of the operation execution record: either simple (recording modification or modifications
                        of a given object) or complex (recording the whole process of e.g. reconciliation of a given object).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="realOwner" type="tns:OperationExecutionRecordRealOwnerType">
                <xsd:annotation>
                    <xsd:documentation>
                        Information about operation execution record real owner. It is set only in the case that the record
                        belongs to object other than its current holder. (The only reason for such redirection is that
                        real owner has no repository object to attach the record to.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.3</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="timestamp" type="xsd:dateTime">
                <xsd:annotation>
                    <xsd:documentation>
                        When was this information recorded. It is expected that it was when
                        the operation finished (successfully or not).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>OperationExecutionType.timestamp</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="operation" type="tns:ObjectDeltaOperationType">
                <xsd:annotation>
                    <xsd:documentation>
                        The elementary modification operations that were part of the (complex or simple) operation execution
                        and their results. However, the content would be reduced e.g. by deletion of modification items
                        and operation result children. The level of reduction could be configurable in the future.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="status" type="tns:OperationResultStatusType">
                <xsd:annotation>
                    <xsd:documentation>
                        Result status of the whole operation (complex or simple).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="message" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Message connected to the reported result status.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="initiatorRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        User that initiated the operation. (TODO)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:FocusType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="taskRef" type="tns:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:documentation>
                        The task that was used to initiate the operation (if any). Only the latest result(s)
                        for a given non-zero task OID will be kept for any object.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:TaskType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="taskRunIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identifier of specific task run that can be used to differentiate between multiple
                        task executions if task is executed recurrently.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.10</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="activityPath" type="tns:ActivityPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        Path to the activity whose execution resulted in this record. Necessary to distinguish between
                        results of various activities within a task. Currently supported only for complex operations.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.4</a:since>
                        <a:experimental>true</a:experimental>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="channel" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Channel through which the operation was initiated.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="requestIdentifier" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Request identifier related to this (complex or simple) operation.
                        Generally, each complex operation has its own request identifier, and it is used for all
                        enclosed simple operations. However, there might be complex operations without request identifier
                        (if model-level processing is not present).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>

    <xsd:element name="operationExecution" type="tns:OperationExecutionType">

    </xsd:element>

    <xsd:simpleType name="OperationExecutionRecordTypeType">
        <xsd:annotation>
            <xsd:documentation>
                Type of an operation execution record.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>4.3</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="simple">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SIMPLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="complex">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="COMPLEX"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="OperationExecutionRecordRealOwnerType">
        <xsd:annotation>
            <xsd:documentation>
                Information about operation execution record real owner. It is created only in the case that the record
                belongs to object other than its current holder. (The only reason for such redirection is that
                real owner has no repository object to attach the record to.)
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.3</a:since>
                <a:experimental>true</a:experimental>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="objectType" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of the real record owner (if known).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="identification" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Identification of the real record owner. Free-form, using
                        any relevant data that is available. An example: connector object UID.
                        Should not be null.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="operationExecutionRecordRealOwner" type="tns:OperationExecutionRecordRealOwnerType"/>

    <xsd:complexType abstract="true" name="LocalizableMessageType">
        <xsd:annotation>
            <xsd:documentation>
                A message that is to be localized into specified language.
                Abstract superclass for both single-item message and a message list.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
    </xsd:complexType>

    <xsd:complexType name="SingleLocalizableMessageType">
        <xsd:annotation>
            <xsd:documentation>
                A message that is to be localized into specified language.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
                <!-- Make this class a 'default' instance of LocalizableMessageType,
                     to avoid the need of specifying xsi:type for empty messages (experimental) -->
                <a:instantiationOrder>1</a:instantiationOrder>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:LocalizableMessageType">
                <xsd:sequence>
                    <xsd:element minOccurs="0" name="key" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Localization key.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="argument" type="tns:LocalizableMessageArgumentType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Arguments to be used as values for localized message parameters.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="fallbackLocalizableMessage" type="tns:LocalizableMessageType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Fallback localizable message to be used when key couldn't be resolved. Mutually exclusive with fallbackMessage.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="fallbackMessage" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Fallback message to be used when key couldn't be resolved. Mutually exclusive with fallbackLocalizableMessage.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="LocalizableMessageListType">
        <xsd:annotation>
            <xsd:documentation>
                List of localizable messages, to be presented as a single message.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:LocalizableMessageType">
                <xsd:sequence>
                    <xsd:element maxOccurs="unbounded" minOccurs="0" name="message" type="tns:LocalizableMessageType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Messages.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="separator" type="tns:LocalizableMessageType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Separator to be put between the messages. Typically a comma.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="prefix" type="tns:LocalizableMessageType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Prefix of the sequence.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element minOccurs="0" name="postfix" type="tns:LocalizableMessageType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Postfix of the sequence.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="LocalizableMessageArgumentType">
        <xsd:annotation>
            <xsd:documentation>
                Argument that is to be used for localized message parameter.
                Might be a LocalizableMessageType itself, allowing for messages like
                "Assignment exists for {0} {1} (OID {2}" where {0} has to be resolved
                to e.g. "role", localized for the target language.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:choice>
            <xsd:element name="value" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Literal value.
                    </xsd:documentation>
                </xsd:annotation>

            </xsd:element>
            <xsd:element name="localizable" type="tns:LocalizableMessageType">
                <xsd:annotation>
                    <xsd:documentation>
                        Embedded localizable message.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:choice>
    </xsd:complexType>

    <xsd:complexType name="LocalizableMessageTemplateType">
        <xsd:annotation>
            <xsd:documentation>
                A template that produces a localizable message after argument expressions are evaluated into specific arguments.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>3.7</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="key" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Localization key. Mutually exclusive with keyExpression.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="keyExpression" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Localization key expression. Mutually exclusive with the key.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="argument" type="tns:LocalizableMessageArgumentType">
                <xsd:annotation>
                    <xsd:documentation>
                        Values for arguments. Mutually exclusive with argumentExpression: if at least one argument is used,
                        no argumentExpression can be used, and vice versa.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="argumentExpression" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Expressions to be evaluated to specific arguments, which are to be used as values for localized message parameters.
                        Mutually exclusive with argument: if at least one argumentExpression is used, no argument can be used, and vice versa.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="fallbackMessage" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Fallback message to be used when key couldn't be resolved. Mutually exclusive with fallbackMessageExpression.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="fallbackMessageExpression" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Fallback message expression to be evaluated to specific fallback message. Mutually exclusive with fallbackMessage.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="HttpMethodType">
        <xsd:annotation>
            <!-- This is meant as a general enumeration to be used at various places in midPoint.
            Not all places of use are obliged to support all HTTP methods listed here. -->
            <xsd:documentation>
                Individual HTTP methods. Not all of them are supported by midPoint components.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
                <a:since>3.7.1</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="get">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GET"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="post">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POST"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="put">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PUT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="head">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HEAD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="patch">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PATCH"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="options">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OPTIONS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="trace">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TRACE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="CachesStateInformationType">
        <xsd:annotation>
            <xsd:documentation>
                Report on the state of midPoint caches.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
                <a:container>true</a:container>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="entry" type="tns:SingleCacheStateInformationType">
                <xsd:annotation>
                    <xsd:documentation>
                        State of a single cache.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="cachesStateInformation" type="tns:CachesStateInformationType"/>

    <xsd:complexType name="SingleCacheStateInformationType">
        <xsd:annotation>
            <xsd:documentation>
                Report on the cache state. Can be specialized for different caches.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
                <a:container>true</a:container>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Cache name.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!-- TODO somehow indicate current configuration -->
            <xsd:element minOccurs="0" name="size" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Current size of the cache (whatever that means).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="secondarySize" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Current "secondary size" of the cache, if applicable. This can mean e.g. number of cached objects
                        for query caches.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="component" type="tns:ComponentSizeInformationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Size of cache components (whatever that means).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="performance" type="tns:SingleCachePerformanceInformationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Performance information (if requested).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="singleCacheStateInformation" type="tns:SingleCacheStateInformationType"/>

    <xsd:complexType name="ComponentSizeInformationType">
        <xsd:annotation>
            <xsd:documentation>
                Report on structured object size.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
                <a:container>true</a:container>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="name" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Component name.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="size" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Component size.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="secondarySize" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Component secondary size (if applicable).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="component" type="tns:ComponentSizeInformationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Information on sub-components.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="componentSizeInformation" type="tns:ComponentSizeInformationType"/>

    <xsd:complexType name="TriggerCreationType">
        <xsd:annotation>
            <xsd:documentation>
                Deals with creation of recompute triggers for selected objects.
                These triggers can be created in "raw" way, simply by adding respective
                TriggerType objects. Or, they can be created in so called optimized way, where
                we look if a compatible trigger already exists and skip trigger creation in such
                case.

                This structure deals with recompute triggers for now. In might be generalized
                in the future.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.0</a:since>
                <a:container>true</a:container>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="fireAfter" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        How long after current time the trigger should be fired. When not specified,
                        trigger is created unconditionally ("raw" way), with the fire time being
                        equal to the current time. If specified, the trigger is created with the
                        fire time in the future; skipping the creation if compatible trigger was
                        created and still has not been fired.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="safetyMargin" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        What is the safety margin, i.e. how many long before the trigger fire time
                        we need to create a new trigger. This is to avoid (rare but in theory possible)
                        race conditions where we skip creation of a trigger but it fires in the meanwhile.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="triggerCreation" type="tns:TriggerCreationType"/>

    <xsd:complexType name="PlannedOperationAttemptType">
        <xsd:annotation>
            <xsd:documentation>
                Describes an attempt that is to be made. Useful e.g. for shadow synchronization triggers
                where it counts attempts that are to be made.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.3</a:since>
                <a:container>true</a:container>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="number" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of the next scheduled attempt.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="interval" type="xsd:duration">
                <xsd:annotation>
                    <xsd:documentation>
                        Interval to be used after the next scheduled attempt fails.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="limit" type="xsd:int">
                <xsd:annotation>
                    <xsd:documentation>
                        Maximal number of attempts.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long"/>
    </xsd:complexType>
    <xsd:element name="plannedOperationAttempt" type="tns:PlannedOperationAttemptType"/>

    <xsd:complexType name="SchemaFilesType">
        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="schema" type="tns:SchemaFileType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:element name="schemaFiles" type="tns:SchemaFilesType"/>

    <xsd:complexType name="SchemaFileType">
        <xsd:sequence>
            <xsd:element name="fileName" type="xsd:string"/>
            <xsd:element name="namespace" type="xsd:string"/>
            <xsd:element minOccurs="0" name="usualPrefix" type="xsd:string"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ItemRouteType">
        <xsd:annotation>
            <xsd:documentation>
                Generalized item path. It allows pointing to a specific item value, while allowing to select
                from multivalued items not only by ID, but by arbitrary filter.

                HIGHLY EXPERIMENTAL. It will be replaced by something more serious in Axiom.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>

        <xsd:sequence>
            <xsd:element maxOccurs="unbounded" minOccurs="0" name="segment" type="tns:ItemRouteSegmentType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ItemRouteSegmentType">
        <xsd:annotation>
            <xsd:documentation>
                A segment of ItemRouteType.

                HIGHLY EXPERIMENTAL.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.5</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="path" type="t:ItemPathType"/>
            <xsd:element minOccurs="0" name="selector" type="q:SearchFilterType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AbstractOperationPolicyConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Common supertype for policy for given operation.
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.7</a:since> <!-- factored out in 4.9 -->
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element default="error" minOccurs="0" name="severity" type="tns:OperationPolicyViolationSeverityType">
                <xsd:annotation>
                    <xsd:documentation>
                        How severe is the policy violation? I.e. how "loudly" is a policy enforced - if the given
                        operation would occur, what should be signalled to the upper layers?

                        Currently not fully supported, please see the docs.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="OperationPolicyConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.7</a:since>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractOperationPolicyConfigurationType">
                <xsd:sequence>
                    <xsd:element default="true" minOccurs="0" name="enabled" type="xsd:boolean"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SyncInboundOperationPolicyConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.9</a:since>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractOperationPolicyConfigurationType">
                <xsd:sequence>
                    <xsd:element default="true" minOccurs="0" name="enabled" type="tns:SyncInboundOperationPolicyEnabledType"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="SyncInboundOperationPolicyEnabledType">
        <xsd:annotation>
            <!-- note: The values of "true" and "false" are here to provide backwards compatibility with pre-4.9 schema. -->
            <!-- note: We use enum instead of separate item in SynchronizeOperationPolicyConfigurationType to avoid problems
                 with merging the policies (e.g., when using the default) -->
            <xsd:documentation>
                The degree how much are inbound operations enabled.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="true">
                <xsd:annotation>
                    <xsd:documentation>
                        All of the inbound processing is enabled.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TRUE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="false">
                <xsd:annotation>
                    <xsd:documentation>
                        Inbound processing is completely disabled: no correlation, no synchronization situation determination,
                        no reaction execution, no mappings.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FALSE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="exceptForMappings">
                <xsd:annotation>
                    <xsd:documentation>
                        The correlation, synchronization situation determination, and reaction execution are enabled.
                        Only inbound mappings are disabled, preventing data flow from the resource to midPoint.
                        <!-- TODO what about "add" sync reaction? It probably makes no sense without inbound mappings.
                              But can there be a special case in which we want to invoke it? -->
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXCEPT_FOR_MAPPINGS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <!-- TODO find a better name; maybe the values are not ideal either -->
    <xsd:simpleType name="OperationPolicyViolationSeverityType">
        <xsd:annotation>
            <xsd:documentation>
                Severity level of operation policy violation.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="error">
                <xsd:annotation>
                    <xsd:documentation>
                        If a given operation would occur, a (fatal) error should be signalled.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="info">
                <xsd:annotation>
                    <xsd:documentation>
                        The operation should be skipped silently.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INFO"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="SynchronizeOperationPolicyConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Drives the synchronization of respective shadows (or related aspects).
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="inbound" type="tns:SyncInboundOperationPolicyConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        If disabled, then the shadow will not be synchronized from the resource to midPoint.
                        Not even synchronization reactions will be evaluated.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="outbound" type="tns:OperationPolicyConfigurationType"/>
            <xsd:element minOccurs="0" name="membership" type="tns:SynchronizeMembershipOperationPolicyConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Drives the synchronization of simple association values having this shadow as an object.
                        (Applies only to such shadows.)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:since>4.9</a:since>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SynchronizeMembershipOperationPolicyConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Drives the synchronization of simple association values having this shadow as an object.
                (Applies only to such shadows.)
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.9</a:since>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element minOccurs="0" name="inbound" type="tns:OperationPolicyConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        If disabled, then association values related to this entitlement (i.e., the subject membership
                        data related to this entitlement) will not be synchronized from the resource to midPoint.
                        For example, if assignments are to be created based on the group membership, this process is skipped
                        for this value. (Note that range processing is not touched by this setting.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="outbound" type="tns:OperationPolicyConfigurationType">
                <xsd:annotation>
                    <xsd:documentation>
                        If disabled, then association values related to this entitlement (i.e., the subject membership
                        data related to this entitlement) will not be provisioned from midPoint to the resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element minOccurs="0" name="tolerant" type="xsd:boolean">
                <xsd:annotation>
                    <xsd:documentation>
                        When this shadow is used as the default object for simple associations, this value - if present -
                        overrides the default tolerance setting for that association.

                        Hence, "false" means that the particular association value will removed by midPoint if it is not present
                        in computed association values. On the other hand, "true" means that the particular association value
                        will be kept even if not present in computed association values.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ObjectOperationPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Shadow specific provisioning policy. This policy is applied to concrete shadows using MarkType.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container>true</a:container>
                <a:since>4.7</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <!--
                 If false: (like protected)
                 Inbound / outbound mapping changes are disabled
                 do not run clockwork (SynchronizationServiceImpl)
                 do not run inbounds
                 do not run outbounds
            -->

            <xsd:element minOccurs="0" name="synchronize" type="tns:SynchronizeOperationPolicyConfigurationType"/>
            <xsd:element minOccurs="0" name="add" type="tns:OperationPolicyConfigurationType"/>
            <xsd:element minOccurs="0" name="modify" type="tns:OperationPolicyConfigurationType"/>
            <xsd:element minOccurs="0" name="delete" type="tns:OperationPolicyConfigurationType"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SchemaType">
        <xsd:annotation>
            <xsd:documentation>
                Schema definition type. Replacement for extension schema defined in midPoint.home
            </xsd:documentation>
            <xsd:appinfo>
                <a:since>4.9</a:since>
                <a:experimental>true</a:experimental>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AssignmentHolderType">
                <xsd:sequence>
                    <xsd:element minOccurs="1" name="definition" type="t:SchemaDefinitionType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Xsd schema definition.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="schema" substitutionGroup="c:object" type="tns:SchemaType"/>

    <xsd:simpleType name="CachedShadowsUseType">
        <xsd:annotation>
            <xsd:documentation>
                Whether (and how) we use cached shadows during processing.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="useFresh">
                <xsd:annotation>
                    <xsd:documentation>
                        When we need the data from the shadow, we will fetch it from the resource.
                        This is the same behavior as it was before midPoint 4.9.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="USE_FRESH"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="useCachedOrFresh">
                <xsd:annotation>
                    <xsd:documentation>
                        When we need the data from the shadow, we will use the cached data, if they are available.
                        If they are not, we will fetch them from the resource.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="USE_CACHED_OR_FRESH"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="useCachedOrIgnore">
                <xsd:annotation>
                    <xsd:documentation>
                        When we need the data from the shadow, we will use the cached data, if they are available.
                        If they are not, we will skip the respective part of the processing (e.g., a mapping).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <jaxb:typesafeEnumMember name="USE_CACHED_OR_IGNORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="useCachedOrFail">
                <xsd:annotation>
                    <xsd:documentation>
                        When we need the data from the shadow, we will use the cached data, if they are available.
                        If they are not, we will fail.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:experimental>true</a:experimental>
                        <jaxb:typesafeEnumMember name="USE_CACHED_OR_FAIL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
</xsd:schema>