<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2016-2019 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  -->

<role oid="00000000-0000-0000-0000-00000000000c"
      xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3">
    <name>Delegator</name>
    <description>Role authorizing users to delegate their own privileges to any other user.</description>
    <assignment id="1">
        <identifier>archetype</identifier>
        <targetRef oid="00000000-0000-0000-0000-000000000320" type="ArchetypeType"/> <!-- System role -->
    </assignment>
    <authorization id="2">
        <name>gui-delegator-access</name>
        <description>
            Allow access to the delegate functionality (e.g. "add delegation" button).
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#delegate</action>
    </authorization>
    <authorization id="3">
        <name>delegator-req</name>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delegate</action>
        <phase>request</phase>
        <object id="7">
            <type>UserType</type>
        </object>
        <target id="8">
            <special>self</special>
        </target>
    </authorization>
    <authorization id="4">
        <name>delegator-exec-user</name>
        <description>
            Quite strong universal execution rights are needed here. We are going to modify other users
            (deputy assignments are in the delegate user, not delegator).
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <phase>execution</phase>
        <object id="9">
            <type>UserType</type>
        </object>
    </authorization>
    <authorization id="5">
        <name>delegator-exec-shadow</name>
        <description>
            Quite strong universal execution rights are needed here. We are going to modify other users
            (deputy assignments are in the delegate user, not delegator). Modification of other users
            may mean also creation/modification/deletion of their accounts.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
        <phase>execution</phase>
        <object id="10">
            <type>ShadowType</type>
        </object>
    </authorization>
    <authorization id="6">
        <name>delegator-read-delagate-assignments</name>
        <description>
            Authorization to read the assignments and assignment-related items from my delegates.
            This authorization is necessary so the self-service GUI can properly display user's
            delegations. Delegations are in fact assignments in the delegate object, not delegator
            object. Therefore authorization to read just "self" will not display the delegations.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="11">
            <type>UserType</type>
            <delegator>
                <special>self</special>
            </delegator>
        </object>
        <item>assignment</item>
        <item>roleMembershipRef</item>
        <item>delegatedRef</item>
    </authorization>
    <adminGuiConfiguration>
        <homePage id="12">
            <type>UserType</type>
            <widget id="13">
                <identifier>myWorkItems</identifier>
                <visibility>hidden</visibility>
            </widget>
        </homePage>
    </adminGuiConfiguration>
</role>
