<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<!-- This is a meta-role. A Role indented to be assigned to other roles.
     I really mean assigned, not included or induced. -->

<role oid="31ea66ac-1a8e-11e5-8ab8-001e8c717e5b"
        xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3">
    <name>Create Custom Customer LDAP Group Metarole</name>

    <inducement>
        <description>CUSTOMGROUP-I</description>
        <construction>
            <resourceRef oid="40be7fa0-cbec-11e5-926a-3c970e44b9e2" type="c:ResourceType"/>
            <kind>entitlement</kind>
            <intent>group-custom</intent>
        </construction>
    </inducement>

    <inducement>
        <description>CUSTOMGROUP-II</description>
        <construction>
            <resourceRef oid="40be7fa0-cbec-11e5-926a-3c970e44b9e2" type="c:ResourceType"/>
            <kind>account</kind>
            <intent>default</intent>
            <association>
                <ref>ri:group</ref>
                <outbound>
                    <expression>
                        <associationFromLink>
                            <projectionDiscriminator>
                                <kind>entitlement</kind>
                                <intent>group-custom</intent>
                            </projectionDiscriminator>
                        </associationFromLink>
                    </expression>
                </outbound>
            </association>
        </construction>
        <order>2</order>
    </inducement>

    <inducement>
        <focusMappings><!-- Generate role type -->
            <mapping>
                <name>Generate Role type</name>
                <expression>
                    <script>
                        <code>return 'customer'</code>
                    </script>
                </expression>
                <target>
                    <path>$focus/description</path>
                </target>
            </mapping>
        </focusMappings>
    </inducement>

    <inducement>
        <focusMappings><!-- Store customer info to identifier attribute -->
            <mapping>
                <name>Store customer info</name>
                <expression>
                    <script>
                        <code>return requester?.organizationalUnit</code>
                    </script>
                </expression>
                <target>
                    <path>$focus/identifier</path>
                </target>
            </mapping>
        </focusMappings>
    </inducement>
    <subtype>customer</subtype>
</role>
