<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2019 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<resource xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
            xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
            xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3"
            xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
            xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3"
            xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
            xmlns:icfconf="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/org.connid.bundles.unix/org.connid.bundles.unix.UnixConnector"
            xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
            oid="017a3bc5-e102-4baa-bf93-369a90ec29dd">
    <name>Unix Resource</name>   <!-- Rename -->
    <connectorRef type="c:ConnectorType">
        <filter>
            <q:text>connectorType = "org.connid.bundles.unix.UnixConnector"</q:text>
        </filter>
    </connectorRef>
    <connectorConfiguration>
        <icfc:resultsHandlerConfiguration>
            <icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
        </icfc:resultsHandlerConfiguration>
        <icfc:configurationProperties >
            <icfconf:admin>midpoint</icfconf:admin>
            <icfconf:password>
                <t:clearValue>secret</t:clearValue>    <!-- change to current password -->
            </icfconf:password>
            <icfconf:hostname>localhost</icfconf:hostname>   <!-- set correct ip address -->
            <icfconf:port>22</icfconf:port>
            <icfconf:createHomeDirectory>true</icfconf:createHomeDirectory>
            <icfconf:deleteHomeDirectory>true</icfconf:deleteHomeDirectory>
            <icfconf:shell>$</icfconf:shell>
            <icfconf:root>false</icfconf:root>
            <icfconf:usePty>true</icfconf:usePty>
            <icfconf:sshConnectionTimeout>0</icfconf:sshConnectionTimeout>
            <icfconf:sudoPassword>
                <t:clearValue>secret</t:clearValue>    <!-- change to current password -->
            </icfconf:sudoPassword>
            <icfconf:sshConnectionTimeout>5000</icfconf:sshConnectionTimeout>
            <icfconf:readTimeout>30000</icfconf:readTimeout>
            <icfconf:timeToWait>1000</icfconf:timeToWait>
        </icfc:configurationProperties>
    </connectorConfiguration>
    <schemaHandling>
        <!-- Group management-->
        <objectType>
            <kind>entitlement</kind>
            <intent>unixGroup</intent>
            <displayName>UNIX Group</displayName>
            <objectClass>ri:GroupObjectClass</objectClass>
            <attribute>
                <c:ref>icfs:name</c:ref>
                <matchingRule>mr:stringIgnoreCase</matchingRule>
                <outbound>
                    <source>
                        <c:path>name</c:path>
                    </source>
                </outbound>
            </attribute>
        </objectType>
        <!-- user management -->
        <objectType>
            <kind>account</kind>
            <displayName>Normal Account</displayName>
            <default>true</default>
            <objectClass>ri:AccountObjectClass</objectClass>
            <attribute>
                <c:ref>icfs:name</c:ref>
                <displayName>Distinguished Name</displayName>
                <limitations>
                    <minOccurs>0</minOccurs>
                    <access>
                        <read>true</read>
                        <add>true</add>
                        <modify>true</modify>
                    </access>
                </limitations>
                <outbound>
                    <source>
                        <c:path>$user/name</c:path>
                    </source>
                </outbound>
            </attribute>
            <attribute>
                <c:ref>icfs:uid</c:ref>
                <displayName>Entry UUID</displayName>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>true</modify>
                    </access>
                </limitations>
            </attribute>
            <attribute>
                <c:ref>ri:comment</c:ref>
                <displayName>Comment</displayName>
                <outbound>
                    <source>
                        <c:path>fullName</c:path>
                    </source>
                </outbound>
            </attribute>
            <attribute>
                <c:ref>ri:homeDir</c:ref>
                <displayName>Home directory</displayName>
                <outbound>
                    <source>
                        <c:path>name</c:path>
                    </source>
                    <expression>
                        <script>
                            <code>'/home/' + name.toString()</code>
                        </script>
                    </expression>
                </outbound>
            </attribute>
            <attribute>
                <c:ref>ri:uid</c:ref>
                <displayName>Unix UID</displayName>
                <outbound>
                    <source>
                        <c:path>employeeNumber</c:path>
                    </source>
                </outbound>
            </attribute>
            <attribute>
                <c:ref>ri:shell</c:ref>
                <displayName>Shell</displayName>
                <outbound>
                    <expression>
                        <value>/bin/bash</value>
                    </expression>
                </outbound>
            </attribute>
            <association>
                <c:ref>ri:unixGroup</c:ref>
                <displayName>LDAP Group Membership</displayName>
                <kind>entitlement</kind>
                <intent>unixGroup</intent>
                <direction>subjectToObject</direction>
                <associationAttribute>ri:groups</associationAttribute>
                <valueAttribute>icfs:name</valueAttribute>
            </association>
            <protected>
                <filter>
                    <q:text>attributes/icfs:name = "midpoint"</q:text>
                </filter>
            </protected>
            <protected>
                <filter>
                    <q:text>attributes/icfs:name = "root"</q:text>
                </filter>
            </protected>
            <activation>
                <administrativeStatus>
                    <outbound>
                        <expression>
                            <asIs/>
                        </expression>
                    </outbound>
                </administrativeStatus>
            </activation>
            <credentials>
                <password>
                    <outbound>
                        <expression>
                            <asIs/>
                        </expression>
                    </outbound>
                </password>
            </credentials>
        </objectType>
    </schemaHandling>
    <synchronization>
        <objectSynchronization>
            <objectClass>ri:AccountObjectClass</objectClass>
            <kind>account</kind>
            <focusType>UserType</focusType>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:path>name</q:path>
                    <expression>
                        <c:path xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3">$shadow/attributes/icfs:name</c:path>
                    </expression>
                </q:equal>
            </correlation>
            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <synchronize>false</synchronize>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unmatched</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri>
                </action>
            </reaction>
        </objectSynchronization>
        <objectSynchronization>
            <objectClass>ri:GroupObjectClass</objectClass>
            <kind>entitlement</kind>
            <intent>unixGroup</intent>
            <focusType>OrgType</focusType>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:path>name</q:path>
                    <expression>
                        <c:path>$shadow/attributes/icfs:name</c:path>
                    </expression>
                </q:equal>
            </correlation>
            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <synchronize>false</synchronize>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                </action>
            </reaction>
        </objectSynchronization>
    </synchronization>
</resource>

