<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->


<!--

This file is an example of Resource definition. It defines an LDAP resource
using an Identity Connector Framework LDAP connector. It contains configuration
for use with stock ODSEE servers.

This resource definition contains also definition to enable synchronization and
especially an expression that is using a lookup of value from an configuration
object.

-->

<c:objects xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
           xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:xsd="http://www.w3.org/2001/XMLSchema"
           xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
           xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
           xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
           xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
           xmlns:my="http://myself.me/schemas/whatever"
           xsi:schemaLocation="http://midpoint.evolveum.com/xml/ns/public/common/common-3 ../../infra/schema/src/main/resources/xml/ns/public/common/common-3.xsd">

    <c:resource oid="ef2bc95b-76e0-48e2-86d6-3d4f02d3e1aa">
        <!-- Resource name. It will be displayed in GUI.  -->
        <name>Localhost ODSEE7</name>
        <!-- Reference to the ICF LDAP connector. This is dynamic reference, it will be translated to
           OID during import. -->
        <connectorRef type="ConnectorType">
            <filter>
                <q:text>c:connectorType = "org.identityconnectors.ldap.LdapConnector"</q:text>
            </filter>
        </connectorRef>

        <!-- Configuration section contains configuration of the connector,
             such as hostnames and passwords -->
        <c:connectorConfiguration>

            <!-- Configuration specific for the LDAP connector -->
            <icfc:configurationProperties
            xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/org.identityconnectors.ldap.LdapConnector">
                <icfcldap:port>11389</icfcldap:port>
                <icfcldap:host>localhost</icfcldap:host>
                <icfcldap:baseContexts>dc=example,dc=com</icfcldap:baseContexts>
                <icfcldap:principal>uid=idm,ou=Administrators,dc=example,dc=com</icfcldap:principal>
                <icfcldap:credentials>
                    <clearValue>secret</clearValue>
                </icfcldap:credentials>
                <icfcldap:modifiersNamesToFilterOut>uid=idm,ou=Administrators,dc=example,dc=com</icfcldap:modifiersNamesToFilterOut>
                <icfcldap:vlvSortAttribute>uid</icfcldap:vlvSortAttribute>
                <icfcldap:useBlocks>true</icfcldap:useBlocks>
                <icfcldap:usePagedResultControl>true</icfcldap:usePagedResultControl>
                <icfcldap:uidAttribute>nsUniqueId</icfcldap:uidAttribute>
                <icfcldap:accountOperationalAttributes>nsAccountLock</icfcldap:accountOperationalAttributes>

            </icfc:configurationProperties>

            <!-- Generic ICF configuration -->

            <icfc:connectorPoolConfiguration>
                <icfc:minEvictableIdleTimeMillis>120000</icfc:minEvictableIdleTimeMillis>
                <icfc:minIdle>1</icfc:minIdle>
                <icfc:maxIdle>10</icfc:maxIdle>
                <icfc:maxObjects>10</icfc:maxObjects>
                <icfc:maxWait>150000</icfc:maxWait>
            </icfc:connectorPoolConfiguration>

            <icfc:producerBufferSize>100</icfc:producerBufferSize>
            <icfc:resultsHandlerConfiguration>
                <icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
            </icfc:resultsHandlerConfiguration>

        </c:connectorConfiguration>

        <schemaHandling>

            <!-- Definition of default account type.
                 This is now the only account type that midPoint can work with. -->
            <objectType>
                <!-- Readable name for the account type -->
                <displayName>Default Account</displayName>
                <default>true</default>

                <!-- Reference to the Resource Schema (see above) specifying
                     object class for this account type -->
                <objectClass>ri:AccountObjectClass</objectClass>

                <!-- Definition of __NAME__ attribute handling.
                     ICF will put entry DN into __NAME__ attribute.-->
                <attribute>
                    <ref>icfs:name</ref>

                    <!-- Readable name for the attribute. This will be used in GUI -->
                    <displayName>Distinguished Name</displayName>

                    <!-- Access limitation for this attribute.
                         In our case ICF will put DN in the __NAME__ attribute.
                         Althouhg DN can be theoretically changes, this definition
                         will make it immutable. -->
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>true</add>
                        </access>
                    </limitations>

                    <!-- Outbound expression for the __NAME__ attribute.
                         If account is created or updated, the __NAME__ attribute
                         will be set accruing to this expression.

                         This specific expression will construct DN by concatenating
                         name from user object and string constants.

                         The expression is marked as "initial", therefore it will
                         be evaluated only if the entry already does not have an DN. -->
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>$user/name</path>
                        </source>
                        <expression>
                            <script>
                                <code>'uid=' + name + ',ou=people,dc=example,dc=com'</code>
                            </script>
                        </expression>
                    </outbound>
<!-- Try this, but it does not work as of 24.5.2012 10:44
                                'uid=' + name + iterationToken +',ou=people,dc=example,dc=com'
-->

                    <!-- No inbound expression here. We cannot sync changes in DN yet -->

                </attribute>

                <!-- Definition of __UID__ attribute handling.
                     ICF will put entry UUID into __UID__ attribute in case it
                     is connecting to OpenDJ/OpenDS. It may be different for
                     other directory servers and it also dependes on connector
                     configuration. Please see connector documentation for
                     more details.-->
                <attribute>
                    <ref>icfs:uid</ref>

                    <!-- Readable name for the attribute. This will be used in GUI -->
                    <displayName>Entry UUID</displayName>

                    <!-- Access limitation for this attribute.
                         Entry UUID is created by the directory server itelf
                         and it is immutable. We can only read it. -->
                    <limitations>
                        <access>
                            <read>true</read>
                        </access>
                    </limitations>

                    <!-- There is no "outbound" expression, so midPoint will not
                         do anything with this attribute. -->

                    <!-- No inbound expression here. Does not make sense to sync UUID as it is supposed to be immutable -->

                </attribute>
                <!-- Definition of uid attribute handling.
                     Do not confuse with __UID__! -->
                <attribute>
                    <ref>ri:uid</ref>
                    <displayName>Login Name</displayName>
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>true</add>
                        </access>
                    </limitations>
                    <outbound>
                        <!-- It is mapped from (and also to) "name" property of
                             user. It is essentially a login name -->
                        <source>
                               <path>$user/name</path>
                           </source>
                    </outbound>
                    <inbound>
                        <description>It is mapped to (and also from) "name" property of
                            user. It is essentially a login name
                        </description>
                        <target>
                            <path>$user/name</path>
                        </target>
                    </inbound>

                </attribute>
                <!-- Definition of cn attribute handling. -->
                <attribute>
                    <ref>ri:cn</ref>

                    <displayName>Common Name</displayName>

                    <!-- Outbound expression here is using "pure" XPath, without
                         using functions. This is the simplest case, just copying
                         the "fullName" property of user to the "cn" attribute of
                         an account.

                         Please note that this expression is not marked as "default".
                         Therefore this value will be copied on every change,
                         overwriting the original value of "cn" on the resource.
                     -->
                    <outbound>
                        <source>
                            <path>$user/fullName</path>
                        </source>
                    </outbound>
                    <inbound>
                        <description>
                            Inbound expression. It is used to synchronize changes
                            in the account to the user object in the IDM. This
                            expression specifies to copy the cn attribute value
                            from the account to the fullName property of the user.
                        </description>
                        <target>
                            <path>$user/fullName</path>
                        </target>
                    </inbound>
                </attribute>

                <!-- Definition of sn attribute handling. -->
                <attribute>
                    <ref>ri:sn</ref>
                    <displayName>Surname</displayName>
                    <outbound>
                        <source>
                          <path>$user/familyName</path>
                        </source>
                    </outbound>
                    <inbound>
                        <description>sn will be synchronized to user's familyName</description>
                        <target>
                            <path>$user/familyName</path>
                        </target>
                    </inbound>

                    <!-- sn will be synchronized to user's familyName -->
                </attribute>

                <!-- Definition of givenName attribute handling. -->
                <attribute>
                    <ref>ri:givenName</ref>
                    <displayName>Given Name</displayName>
                    <outbound>
                        <source>
                            <path>$user/givenName</path>
                        </source>
                    </outbound>
                    <inbound>
                        <description>givenName will be synchronized to user's givenName</description>
                        <target>
                            <path>$user/givenName</path>
                        </target>
                    </inbound>

                </attribute>

                   <activation>
                    <administrativeStatus>
                        <outbound/>
                    </administrativeStatus>
                </activation>

                <credentials>
                    <password>
                        <outbound/>
                    </password>
                </credentials>

            </objectType>
        </schemaHandling>

        <capabilities xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3">
            <configured>
                <cap:activation>
                    <cap:status>
                        <cap:attribute>ri:nsAccountLock</cap:attribute>
                        <cap:enableValue/>
                        <cap:disableValue>true</cap:disableValue>
                    </cap:status>
                </cap:activation>
            </configured>
        </capabilities>
        <!--
            Synchronization section describes the synchronization policy, timing,
            reactions and similar synchronization settings.
        -->
        <synchronization>
            <objectSynchronization>
                <!--
                    The synchronization for this resource is enabled.
                    It means that the synchronization will react to changes detected by
                    the system (live sync task, discovery or reconciliation) -->
                <enabled>true</enabled>

                <correlation>
                    <q:description>
                        Correlation expression is a search query.
                        Following search query will look for users that have "name"
                        equal to the "uid" attribute of the account. Simply speaking,
                        it will look for match in usernames in the IDM and the resource.
                        The correlation rule always looks for users, so it will not match
                        any other object type.
                    </q:description>
                    <q:equal>
                        <q:path>c:name</q:path>
                        <expression>
                            <path>
                                    declare namespace i="http://midpoint.evolveum.com/xml/ns/public/common/common-3";
                                    declare namespace dj="http://midpoint.evolveum.com/xml/ns/public/resource/instances/ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2";
                                    $i:account/i:attributes/dj:uid
                            </path>
                        </expression>
                    </q:equal>
                </correlation>

                <!-- Confirmation rule may be here, but as the search above will
                     always return at most one match, the confirmation rule is not needed. -->

                <!-- Following section describes reactions to a situations.
                     The setting here assumes that this resource is authoritative,
                     therefore all accounts created on the resource should be
                     reflected as new users in IDM.
                     See http://wiki.evolveum.com/display/midPoint/Synchronization+Situations
                 -->
                <reaction>
                    <situation>linked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#modifyUser</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlinkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#linkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unmatched</situation>
                    <objectTemplateRef oid="c0c010c0-d34d-b33f-f00d-777222222222"/>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addUser</handlerUri>
                        <!-- Reference to the User Template is here. If the user would be
                             created as a result of this action, it will be created according
                             to this template. -->
                    </action>
                </reaction>
            </objectSynchronization>
        </synchronization>

    </c:resource>

</c:objects>
