<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<!-- User template that demonstrates advanced usage such as account assignment and RB-RBAC -->

<objectTemplate oid="10000000-0000-0000-0000-000000000222"
   xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
   xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
   xmlns:c='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
   xmlns:t='http://prism.evolveum.com/xml/ns/public/types-3'>
    <name>Complex User Template</name>
    <mapping>
        <!-- This expression is NOT initial so if will in fact FORCE fullname consistency -->
        <strength>strong</strength>
        <source>
            <path>$user/givenName</path>
        </source>
        <source>
            <path>$user/familyName</path>
        </source>
        <expression>
            <script>
                <language>http://midpoint.evolveum.com/xml/ns/public/expression/language#Groovy</language>
                <code>
                    givenName + ' ' + familyName
                </code>
            </script>
        </expression>
        <target>
            <path>$user/fullName</path>
        </target>
    </mapping>

    <!-- Unconditional automatic assignment of OpenDJ resource -->
    <mapping>
        <strength>strong</strength>
        <expression>
            <value>
                <assignment>
                    <construction>
                        <resourceRef oid="ef2bc95b-76e0-48e2-86d6-3d4f02d3e1a2" type="ResourceType"/>
                    </construction>
                </assignment>
            </value>
        </expression>
        <target>
            <path>assignment</path>
        </target>
    </mapping>

    <!-- RB-RBAC functionality. The Pirate role is automatically assigned based on the value of subtype property -->
    <mapping>
        <strength>strong</strength>
        <source>
            <path>subtype</path>
        </source>
        <expression>
            <value>
                <assignment>
                    <targetRef oid="12345678-d34d-b33f-f00d-987987987988" type="RoleType"/>
                </assignment>
            </value>
        </expression>
        <target>
            <path>assignment</path>
        </target>
        <condition>
            <script>
                <language>http://midpoint.evolveum.com/xml/ns/public/expression/language#Groovy</language>
                <code>subtype == 'PIRATE'</code>
            </script>
        </condition>
    </mapping>

    <!-- Automatically generate employee number if there is none (note the "weak" flag)
    The "Alphanumeric Password Policy" will be used.  -->
    <mapping>
        <strength>weak</strength>
        <expression>
            <generate>
            <valuePolicyRef oid="81818181-76e0-59e2-8888-3d4f02d3fffd"/>
            </generate>
        </expression>
        <target>
            <path>employeeNumber</path>
        </target>
    </mapping>

</objectTemplate>
