<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2014 ProofID
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  ~
  ~ Portions Copyright (c) 2015 Evolveum
  -->


<!--

This file is an example of Resource definition. It defines an Office365 resource
using an Identity Connector Framework Office365 connector.

This contains configuration for a federated Office 365 domain

-->

<objects xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
    xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
    xmlns:xsd="http://www.w3.org/2001/XMLSchema"
    xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
    xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
    xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
    xsi:schemaLocation="http://midpoint.evolveum.com/xml/ns/public/common/common-3 ../../infra/schema/src/main/resources/xml/ns/public/common/common-3.xsd">

    <resource oid="2fdc92cd-b373-455b-892c-627e65169aa0">
        <name>Office 365 Connector</name>

        <connectorRef type="ConnectorType">
            <filter>
                <q:text>c:connectorType = "org.identityconnectors.office365.Office365Connector"</q:text>
            </filter>
        </connectorRef>

        <connectorConfiguration>

            <!-- Configuration specific for the Active Directory connector -->
            <icfc:configurationProperties
                xmlns:o365="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/org.forgerock.openicf.connectors.office365-connector/org.identityconnectors.office365.Office365Connector">
                <o365:apiEndPoint>graph.windows.net</o365:apiEndPoint>
                <o365:tenancy>TENANCYNAME.onmicrosoft.com</o365:tenancy>
                <o365:symetricKey>
                    <clearValue>SYMETRICKEY</clearValue>
                </o365:symetricKey>
                <o365:authURL>https://accounts.accesscontrol.windows.net/tokens/OAuth/2</o365:authURL>
                <o365:principalID>PRINCIAPLID</o365:principalID>
                <o365:resourceID>00000002-0000-0000-c000-000000000000</o365:resourceID>
                <o365:acsPrincipalID>00000001-0000-0000-c000-000000000000</o365:acsPrincipalID>
                <o365:immutableIDEncodeMechanism>straight-base64</o365:immutableIDEncodeMechanism>
            </icfc:configurationProperties>

        </connectorConfiguration>


        <schemaHandling>
            <objectType>
            <kind>account</kind>
                <intent>default</intent>
                <displayName>Federated Account</displayName>
                <default>true</default>
                <objectClass>ri:AccountObjectClass</objectClass>


                <attribute>
                    <!-- UPN -->
                    <ref>icfs:name</ref>
                    <displayName>Distinguished Name</displayName>

                    <limitations>
                        <access>
                            <read>true</read>
                            <add>true</add>
                        </access>
                    </limitations>

                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>$user/name</path>
                        </source>
                        <expression>
                            <script>
                                <code>
                                    name + '@example.com'
                                </code>
                            </script>
                        </expression>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:mailNickname</ref>
                    <displayName>Mail nickname</displayName>
                    <outbound>
                        <source>
                            <path>$user/name</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:givenName</ref>
                    <displayName>First name</displayName>
                    <outbound>
                        <source>
                            <path>$user/givenName</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:surname</ref>
                    <displayName>Last name</displayName>
                    <outbound>
                        <source>
                            <path>$user/familyName</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:displayName</ref>
                    <description>The display name.</description>
                    <outbound>
                        <source>
                            <path>$user/fullName</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:mail</ref>
                    <displayName>Email Address</displayName>
                    <inbound>
                        <target>
                            <path>$user/emailAddress</path>
                        </target>
                    </inbound>
                </attribute>

                <attribute>
                    <ref>ri:licenses</ref>
                    <displayName>License to assign</displayName>
                    <description>The license and plans to assign to the user</description>
                    <outbound>
                        <expression>
                            <value>ENTERPRISEPACK</value>
                        </expression>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:usageLocation</ref>
                    <displayName>Usage Location</displayName>
                    <description>Location of account usage</description>
                    <outbound>
                        <expression>
                            <value>GB</value>
                        </expression>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:telephoneNumber</ref>
                    <displayName>Telephone Number</displayName>
                    <outbound>
                        <source>
                            <path>$user/telephoneNumber</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:jobTitle</ref>
                    <displayName>Job Title</displayName>
                    <outbound>
                        <source>
                            <path>$user/title</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:department</ref>
                    <displayName>Department</displayName>
                    <outbound>
                        <source>
                            <path>$user/organizationalUnit</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:city</ref>
                    <displayName>City</displayName>
                    <outbound>
                        <source>
                            <path>$user/extension/city</path>
                        </source>
                    </outbound>
                </attribute>

                <attribute>
                    <ref>ri:proxyAddresses</ref>
                    <displayName>EMail Address</displayName>
                    <description>Proxy Addresses for the user.</description>
                </attribute>

                <!--  Remove for non federated o365 tenancies -->
                <!--  Note this is not the primary key/NAME/UID as is only present on federated domains and a new ObejctID is always issues in o365 -->
                <!--  This should be the same attribute as released as the immutableID by your federation software ADFS etc -->
                <attribute>
                    <ref>ri:immutableId</ref>
                    <displayName>Immutable ID</displayName>
                    <description>The unique non changing attribute to link this account in a federated domain</description>
                    <outbound>
                        <source>
                            <path>$user/extension/adimmutableuid</path>
                        </source>
                    </outbound>
                </attribute>


                <activation>
                    <administrativeStatus>
                        <outbound />
                        <inbound>
                            <strength>weak</strength>
                        </inbound>
                    </administrativeStatus>
                </activation>

                <credentials>
                    <password>
                        <outbound>
                            <expression>
                                <generate />
                            </expression>
                        </outbound>
                    </password>
                </credentials>

            </objectType>
        </schemaHandling>

        <capabilities
            xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3">
            <configured>
                <cap:activation>
                    <cap:status>
                        <cap:attribute>ri:accountEnabled</cap:attribute>
                        <cap:enableValue />
                        <cap:enableValue>true</cap:enableValue>
                        <cap:disableValue>false</cap:disableValue>
                    </cap:status>
                </cap:activation>
            </configured>
        </capabilities>

        <synchronization>
            <objectSynchronization>
                <!--
                    The synchronization for this resource is enabled.
                    It means that the synchronization will react to changes detected by
                    the system (live sync task, discovery or reconciliation) -->
                <enabled>true</enabled>

                <correlation>
                    <q:description>
                        Correlation expression is a search query.
                        Following search query will look for users that have "name"
                        equal to the "mailNickname" attribute of the account. Simply speaking,
                        it will look for match in usernames in the IDM and the resource.
                        The correlation rule always looks for users, so it will not match
                        any other object type.
                    </q:description>
                    <q:equal>
                        <q:path>c:name</q:path>
                        <expression>
                            <script>
                                <language>http://www.w3.org/TR/xpath/</language>
                                <code>
                                    $c:account/c:attributes/ri:mailNickname
                                </code>
                            </script>
                        </expression>
                    </q:equal>
                </correlation>

                <!-- Confirmation rule may be here, but as the search above will
                     always return at most one match, the confirmation rule is not needed. -->

                <!-- Following section describes reactions to a situations.
                     The setting here assumes that this resource is authoritative,
                     therefore all accounts created on the resource should be
                     reflected as new users in IDM.
                     See http://wiki.evolveum.com/display/midPoint/Synchronization+Situations
                 -->
                <reaction>
                    <situation>linked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#modifyUser</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlinkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#linkAccount</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unmatched</situation>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#linkAccount</handlerUri>
                    </action>
                </reaction>
            </objectSynchronization>
        </synchronization>
    </resource>
</objects>
