<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<!--

This file is an example of Resource definition. It defines an LDAP resource
using an Identity Connector Framework LDAP connector. It contains proper schema
for use with a stock OpenDJ and OpenDS servers.

This resource definition contains also definition to enable synchronization.

-->
<objects xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
         xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xmlns:xsd="http://www.w3.org/2001/XMLSchema"
         xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
         xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
         xmlns:idfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
         xmlns:my="http://myself.me/schemas/whatever">

    <resource oid="ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">

        <!-- Resource name. It will be displayed in GUI.  -->
        <name>Localhost OpenDJ</name>

        <!-- Reference to the ICF LDAP connector. OID is "virtual" for now. -->
        <connectorRef type="ConnectorType">
            <filter>
                <q:text>c:connectorType = "org.identityconnectors.ldap.LdapConnector"</q:text>
            </filter>
        </connectorRef>

        <!-- Configuration section contains configuration of the connector,
             such as hostnames and passwords -->
        <connectorConfiguration
                xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/org.forgerock.openicf.connectors.ldap.ldap/org.identityconnectors.ldap.LdapConnector"
                xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/configuration-1.xsd">
            <!-- Propeties of ICF connector bundle. The applicable element
   names can be found in the ICF connector documentation -->
            <!-- Configuration specific for the LDAP connector -->
            <icfc:configurationProperties>
                <icfcldap:port>1389</icfcldap:port>
                <icfcldap:host>localhost</icfcldap:host>
                <icfcldap:baseContexts>dc=example,dc=com</icfcldap:baseContexts>
                <icfcldap:principal>uid=idm,ou=Administrators,dc=example,dc=com</icfcldap:principal>
                <icfcldap:credentials>
                    <clearValue>secret</clearValue>
                </icfcldap:credentials>
                <icfcldap:modifiersNamesToFilterOut>uid=idm,ou=Administrators,dc=example,dc=com
                </icfcldap:modifiersNamesToFilterOut>
                <icfcldap:vlvSortAttribute>uid</icfcldap:vlvSortAttribute>
                <icfcldap:usePagedResultControl>true</icfcldap:usePagedResultControl>
                <icfcldap:accountObjectClasses>top</icfcldap:accountObjectClasses>
                <icfcldap:accountObjectClasses>person</icfcldap:accountObjectClasses>
                <icfcldap:accountObjectClasses>organizationalPerson</icfcldap:accountObjectClasses>
                <icfcldap:accountObjectClasses>inetOrgPerson</icfcldap:accountObjectClasses>
                <icfcldap:accountObjectClasses>piracyPerson</icfcldap:accountObjectClasses>
            </icfc:configurationProperties>

        </connectorConfiguration>

        <schema>
             <generationConstraints>
                <generateObjectClass>ri:inetOrgPerson</generateObjectClass>
                <generateObjectClass>ri:groupOfUniqueNames</generateObjectClass>
                <generateObjectClass>ri:groupOfNames</generateObjectClass>
                <generateObjectClass>ri:organizationalUnit</generateObjectClass>
            </generationConstraints>
        </schema>
        <!-- Resource Schema Handling definition.
             This part defines how the schema defined above will be used by
             OpenIDM. It defines expressions and limitations for individual
             schema attributes.

             The expressions that describe both inbound and outbound flow of
             the attributes are defined in this section.

             This is the part where most of the customization takes place.
        -->
        <schemaHandling>
            <!-- Definition of default account type.
                 This is now the only account type that OpenIDM can work with. -->
            <objectType>
                <intent>default</intent>
                <!-- Readable name for the account type -->
                <displayName>Default Account</displayName>
                <default>true</default>
                <!-- Reference to the Resoure Schema (see above) specifying
                     object class for this account type -->
                <objectClass>rAccount</objectClass>
                <!-- Definition of __NAME__ attribute handling.
                     ICF will put entry DN into __NAME__ attribute.-->
                <attribute>
                    <ref>idfs:name</ref>
                    <!-- Readable name for the attribute. This will be used in GUI -->
                    <displayName>Distinguished Name</displayName>
                    <!-- Access limitation for this attribute.
                         In our case ICF will put DN in the __NAME__ attribute.
                         Althouhg DN can be theoretically changes, this definition
                         will make it immutable. -->
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>true</add>
                            <modify>false</modify>
                        </access>
                    </limitations>
                    <!-- Outbound expression for the __NAME__ attribute.
                         If account is created or updated, the __NAME__ attribute
                         will be set accrding to this expression.

                         This specific expression will construct DN by concatenating
                         name from user object and string constants.

                         The expression is marked as "default", therefore it will
                         be evaluated only if the entry already does not have an DN.

                         It is an XPath expression, similar to BPEL assignment expressions. -->
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>$user/name</path>
                        </source>
                        <expression>
                            <script>
                                <code>'uid=' + name + ',ou=people,dc=example,dc=com'</code>
                            </script>
                        </expression>
                    </outbound>
                    <!-- No inbound expression here. We cannot sync changes in DN yet -->
                </attribute>
                <!-- Definition of __UID__ attribute handling.
                     ICF will put entry UUID into __UID__ attribute in case it
                     is connecting to OpenDJ/OpenDS. It may be different for
                     other directory servers and it also dependes on connector
                     configuration. Please see connector documentation for
                     more details.-->
                <attribute>
                    <ref>idfs:uid</ref>
                    <!-- Readable name for the attribute. This will be used in GUI -->
                    <displayName>Entry UUID</displayName>
                    <!-- Access limitation for this attribute.
                         Entry UUID is created by the directory server itelf
                         and it is immutable. We can only read it. -->
                    <limitations>
                        <access>
                            <read>true</read>
                        </access>
                    </limitations>
                    <!-- There is no "outbound" expression, so OpenIDM will not
                         do anything with this attribute. -->
                    <!-- No inbound expression here. Does not make sense to sync UUID as it is supposed to be immutable -->
                </attribute>
                <!-- Definition of cn attribute handling. -->
                <attribute>
                    <ref>rcn</ref>
                    <displayName>Common Name</displayName>
                    <!-- Outbound expression here is using "pure" XPath, without
                         using functions. This is the simplest case, just copying
                         the "fullName" property of user to the "cn" attribute of
                         an account.

                         Please note that this expression is not marked as "default".
                         Therefore this value will be copied on every change,
                         overwriting the original value of "cn" on the resource.
                     -->
                    <outbound>
                        <source>
                            <path>$user/fullName</path>
                        </source>
                    </outbound>
                    <!-- Inbound expression. It is used to synchronize changes
                         in the account to the user object in the IDM. This
                         expression specifies to copy the cn attribute value
                         from the account to the fullName property of the user.
                     -->
                    <inbound>
                        <target>
                            <path>$user/fullName</path>
                        </target>
                    </inbound>
                </attribute>
                <!-- Definition of sn attribute handling. -->
                <attribute>
                    <ref>rsn</ref>
                    <displayName>Surname</displayName>
                    <outbound>
                        <source>
                            <path>$user/familyName</path>
                        </source>
                    </outbound>
                    <!-- sn will be synchronized to user's familyName -->
                    <inbound>
                        <target>
                            <path>$user/familyName</path>
                        </target>
                    </inbound>
                </attribute>
                <!-- Definition of givenName attribute handling. -->
                <attribute>
                    <ref>rgivenName</ref>
                    <displayName>Given Name</displayName>
                    <outbound>
                        <source>
                            <path>$user/givenName</path>
                        </source>
                    </outbound>
                    <!-- givenName will be synchronized to user's givenName -->
                    <inbound>
                        <target>
                            <path>$user/givenName</path>
                        </target>
                    </inbound>
                </attribute>
                <!-- Definition of uid attribute handling.
                     Do not confuse with __UID__! -->
                <attribute>
                    <ref>ruid</ref>
                    <displayName>Login Name</displayName>
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>true</add>
                            <modify>false</modify>
                        </access>
                    </limitations>
                    <outbound>
                        <!-- It is mapped from (and also to) "name" property of
                             user. It is essentially a login name -->
                        <source>
                            <path>$user/name</path>
                        </source>
                    </outbound>
                    <!-- It is mapped to (and also from) "name" property of
                             user. It is essentially a login name -->
                    <inbound>
                        <target>
                            <path>$user/name</path>
                        </target>
                    </inbound>
                </attribute>
                <!-- Definition of description attribute handling. -->
                <attribute>
                    <ref>rdescription</ref>
                    <!-- This outbound expression is not really an expression.
                         It is using a fixed literal insead of dynamically
                         generated value. -->
                    <outbound>
                        <strength>weak</strength>
                        <expression>
                            <value>Created by IDM</value>
                        </expression>
                    </outbound>
                    <!-- No outbound expression for description. We don't want to synchronize that -->
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyShipName</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyShipName
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyStatus</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyStatus
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyScarNumber</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyScarNumber
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyCaptainship</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyCaptainship
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyEnrollmentTimestamp</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyEnrollmentTimestamp
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyTreasureSecret</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyTreasureSecret
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyNickname</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyNickname
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyBestWeapon</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyBestWeapon
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyQuote</ref>
                    <inbound
                            xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531"
                            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
                            xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                            xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyQuote
                            </path>
                        </target>
                    </inbound>
                </attribute>
                <attribute xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2">
                    <ref>rpiracyDrink</ref>
                    <inbound xmlns:iccldap="http://midpoint.evolveum.com/xml/ns/resource/idconnector/bundle/org.identityconnectors.ldap/org.identityconnectors.ldap.LdapConnector/1.0.5531" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:idc="http://midpoint.evolveum.com/xml/ns/public/resource/idconnector/configuration-1.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:i="http://midpoint.evolveum.com/xml/ns/public/common/common-3">
                        <target>
                            <path>
                                declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                declare namespace ri="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                $user/extension/rpiracyDrink
                            </path>
                        </target>
                    </inbound>
                </attribute>
            </objectType>
        </schemaHandling>
        <!--
            Synchronization section describes the synchronization policy, timing,
            reactions and similar synchronization settings.
        -->
        <synchronization>
            <objectSynchronization>
                <!--
                    The synchronization for this resource is enabled.
                    It means that the synchronization will poll for changes once
                    per interval specified below. -->
                <enabled>true</enabled>

                <!-- Correlation expression.
                     It will be used to find appropriate user entry for an account.
                  -->
                <correlation>
                    <!-- Correlation rule is a search query -->
                    <!-- The clause <type uri="http://midpoint.evolveum.com/xml/ns/public/common/common-3#UserType"/> is implicit in correlation rules -->
                    <!-- Following search query will look for users that have "name"
                         equal to the "uid" attribute of the account. Simply speaking,
                         it will look for match in usernames in the IDM and the resource. -->
                    <q:equal>
                        <q:path>name</q:path>
                        <expression>
                            <script>
                                <code>
                                    declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                    declare namespace dj="http://midpoint.evolveum.com/xml/ns/public/resource/instance/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                    $account/attributes/dj:uid
                                </code>
                            </script>
                        </expression>
                    </q:equal>
                </correlation>
                <!-- Confirmation rule may be here, but as the search above will
                     always return at most one match, the confirmation rule is not needed. -->
                <!-- Following section describes reactions to a situations.
                     The setting here assumes that this resource is authoritative,
                     therefore all accounts created on the resource should be
                     reflected as new users in IDM.
                     See https://wikis.forgerock.org/confluence/display/openidm/Synchronization+Situations
                 -->
                <reaction>
                    <situation>linked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#modifyUser</handlerUri>
                      </action>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlinkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#linkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unmatched</situation>
                    <objectTemplateRef oid="c0c010c0-d34d-b33f-f00d-777111111111"/>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addUser</handlerUri>
                        <!-- Reference to the User Template is here. If the user would be
                             created as a result of this action, it will be created according
                             to this template. -->
                    </action>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#linkAccount</handlerUri>
                    </action>
                </reaction>
            </objectSynchronization>
        </synchronization>
    </resource>
    <!-- User Template Object.
          This object is used when creating a new account, to set it up as needed.
     -->
    <objectTemplate oid="c0c010c0-d34d-b33f-f00d-777111111111">
        <name>Default User Template</name>
        <!-- Property construction.
             Defines how properties of user object are set up.
             This specific definition sets a full name as a concatenation
             of givenName and familyName. -->
        <mapping>
            <strength>weak</strength>
            <source>
                <path>$user/givenName</path>
            </source>
            <source>
                <path>$user/familyName</path>
            </source>
            <expression>
                <script>
                    <code>
                        givenName + ' ' + familyName
                    </code>
                </script>
            </expression>
            <target>
                <path>fullName</path>
            </target>
        </mapping>

    </objectTemplate>
</objects>
