<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<role oid="c546fe38-def1-11e5-85bb-3c970e44b9e2"
        xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
        xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3">
    <name>Delegated Administration Role</name>
    <description>Role to delegate administration to customer admins.</description>
    <!-- ***** GUI ***** -->
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#users</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#user</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#userDetails</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#findUsers</action>

        <!-- to see at least Org menu -->
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgStruct</action>
        <!-- to see Org tree -->
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgTree</action>
        <!-- to be able to click on Org -->
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgUnit</action>
        <!-- to be able to see configuration objects - may be security risk to allow
             see e.g. all/foreign password policies... -->
        <!--<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#debugs</action>-->
        <!--<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#tasksAll</action>-->
    </authorization>

    <!-- ***** From End User role (fragments) ***** -->

    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll</action>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <special>self</special>
        </object>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
        <phase>request</phase>
        <object>
            <special>self</special>
        </object>
        <item>credentials</item>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
        <phase>request</phase>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
        <item>credentials</item>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <phase>execution</phase>
        <object>
            <special>self</special>
        </object>
        <item>credentials</item>
    </authorization>
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <phase>execution</phase>
        <object>
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
        <item>credentials</item>
    </authorization>

    <authorization>
        <name>Read for all password policies, all resources and roles of subtype=customer and End User</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ValuePolicyType</type>
        </object>
        <object>
            <type>ResourceType</type>
        </object>
        <object>
            <type>RoleType</type>
            <filter>
                <q:text>subtype = "customer" or name = "End user" or name = "Delegated Administration Role"</q:text>
            </filter>
        </object>
    </authorization>
    <!-- ***** Model ***** -->

    <!-- Authorization to see root. Required even if orgRelation is used! -->
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>OrgType</type>
            <filter>
                <q:text>subtype = "functional"</q:text>
            </filter>
        </object>
    </authorization>
    <!-- Authorization to see lookupTables -->
    <authorization>
        <name>Read for lookuptable</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>LookupTableType</type>
        </object>
    </authorization>

    <!-- Authorization to read own organization and its content including the path from root - if assigned as manager -->
    <authorization>
        <name>Magic read/modify</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <object>
            <orgRelation>
                <subjectRelation>org:manager</subjectRelation>
                <scope>allDescendants</scope>
                <includeReferenceOrg>true</includeReferenceOrg>
            </orgRelation>
        </object>
    </authorization>

    <!-- Authorization to modify some attributes IN their own organizations - if assigned as manager -->
    <authorization>
        <name>Modify some user attributes</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <object>
            <type>UserType</type>
            <orgRelation>
                <subjectRelation>org:manager</subjectRelation>
            </orgRelation>
        </object>
        <item>name</item>
        <item>description</item>
        <item>givenName</item>
        <item>familyName</item>
        <item>subtype</item>
        <item>emailAddress</item>
        <item>activation</item>
        <item>credentials</item>
    </authorization>

    <!-- Authorization to CRD IN their own organizations - if assigned as manager -->
    <authorization>
        <name>Authz: CRD UserType</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
        <!--        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>-->
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
        <object>
            <type>UserType</type>
            <orgRelation>
                <subjectRelation>org:manager</subjectRelation>
            </orgRelation>
        </object>
    </authorization>

    <!-- Authorization to assign/unassign IN their own organizations - if assigned as manager -->
    <!--
        <authorization>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
            <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
            <object>
                <type>UserType</type>
                <orgRelation>
                    <subjectRelation>org:manager</subjectRelation>
                </orgRelation>
            </object>
            <target>
                    <filter>
                            <q:type>
                                    <q:type>c:OrgType</q:type>
                            </q:type>
                    </filter>
            </target>
        </authorization>
    -->
    <!-- Authorization to assign/unassign IN their own organization - roles of subtype=customer or End user -->
    <authorization>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#unassign</action>
        <object>
            <type>UserType</type>
            <orgRelation>
                <subjectRelation>org:manager</subjectRelation>
            </orgRelation>
        </object>
        <target>
            <type>RoleType</type>
            <filter>
                <q:text>subtype = "customer" or name = "End user"</q:text>
            </filter>
        </target>
    </authorization>

    <!-- Authorization to Read Shadows, subtype == 'customer-admin' ||
         'customer-user' -->
    <authorization>
        <name>Read shadows owned by customer-admin/customer-user</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ShadowType</type>
            <owner>
                <type>UserType</type>
                <filter>
                    <q:text>subtype = "customer-admin" or subtype = "customer-user"</q:text>
                </filter>
            </owner>
        </object>
    </authorization>

    <!-- Authorization to read entitlements and generic -->
    <authorization>
        <name>Read all entitlements and generic shadows</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>ShadowType</type>
            <filter>
                <q:text>kind = "entitlement" or kind = "generic"</q:text>
            </filter>
        </object>
    </authorization>

    <!-- Allow derived changes of all user attributes (e.g. name change) (phase=execution) -->
    <authorization>
        <name>Allow execution for derived changes on User</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <phase>execution</phase>
        <object>
            <type>UserType</type>
            <filter>
                <q:text>subtype = "customer-admin" or subtype = "customer-user"</q:text>
            </filter>
        </object>
    </authorization>

    <authorization>
        <name>Allow execution for derived changes on Shadows for users</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
        <phase>execution</phase>
        <object>
            <type>ShadowType</type>
            <owner>
                <type>UserType</type>
                <filter>
                    <q:text>subtype = "customer-admin" or subtype = "customer-user"</q:text>
                </filter>
            </owner>
        </object>
    </authorization>
    <authorization>
        <name>Allow execution for derived changes on Shado for organizations</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
        <phase>execution</phase>
        <object>
            <type>ShadowType</type>
            <owner>
                <type>OrgType</type>
                <filter>
                    <q:text>subtype = "customer"</q:text>
                </filter>
            </owner>
        </object>
    </authorization>

    <authorization>
        <name>Allow creation of background tasks</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
        <object>
            <type>TaskType</type>
        </object>
    </authorization>

    <!-- doesn't work in 3.4
    <authorization>
        <name>Allow reading of own background tasks</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object>
            <type>TaskType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization> -->

    <requestable>false</requestable>
</role>
