<?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2010-2019 Evolveum and contributors
  ~
  ~ Licensed under the EUPL-1.2 or later.
  -->

<role oid="00000000-0000-0000-0000-000000000008"
      xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
      xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
      xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3">
    <name>End user</name>
    <description>Role authorizing end users to log in, change their passwords and review assigned accounts. Note: This role definition is just an example. It should be tailored for each specific deployment.</description>
    <!--
        End user role is NOT archetyped as system role - by purpose.
        Firstly, this role is almost always customized. We do not want to create an impression that
        this role is finished and ready for production use.
        Secondly, it is not really a system role. It is perhaps closer to business role. We cannot
        clearly decide where it belongs as this depends on how the role hierarchy is structured.
        Therefore we have chosen not to mark it with any archetype to avoid risk of creating
        a confusing situation.
    -->
    <authorization id="1">
        <name>gui-self-service-access</name>
        <description>
            Allow access to all self-service operations in GUI.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#selfAll</action>
    </authorization>
    <authorization id="2">
        <name>self-read</name>
        <description>
            Allow to read all the properties of "self" object. I.e. every logged-in user can read
            object that represent his own identity.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="16">
            <special>self</special>
        </object>
    </authorization>
    <authorization id="3">
        <name>self-shadow-read</name>
        <description>
            Allow to read all the properties of all the shadows that belong to "self" object.
            I.e. every logged-in user can read all his accounts.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="17">
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <authorization id="4">
        <name>self-persona-read</name>
        <description>
            Allow to read all the personas of currently logged-in user.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="18">
            <type>UserType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <authorization id="5">
        <name>self-credentials-request</name>
        <description>
            Allow to modify user's own credentials.
            Note that this is a request phase authorization. It also requires corresponding execution-phase authorization.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
        <phase>request</phase>
        <object id="19">
            <special>self</special>
        </object>
        <item>credentials</item>
    </authorization>
    <authorization id="6">
        <name>self-shadow-credentials-request</name>
        <description>
            Allow to modify credentials of all users accounts.
            Note that this is a request phase authorization. It also requires corresponding execution-phase authorization.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#changeCredentials</action>
        <phase>request</phase>
        <object id="20">
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
        <item>credentials</item>
    </authorization>
    <authorization id="7">
        <name>read-requestable-roles</name>
        <description>
            Allow to read requestable roles. This allows to search for requestable roles in user interface.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="21">
            <type>RoleType</type>
            <filter>
                <q:text>requestable = true</q:text>
            </filter>
        </object>
        <!-- Note: for production use you should consider limiting the items that can be read. -->
    </authorization>
    <authorization id="8">
        <name>requestable-role-details</name>
        <description>
            Allow to show details of requestable roles in the user interface.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#roleDetails</action>
        <!-- Note: object specification should be here to limit this authorization to requestable roles.
             But this is not yet supported. -->
    </authorization>
    <authorization id="9">
        <name>assign-requestable-roles</name>
        <description>
            Allow to assign requestable roles. This allows to request roles in a request-and-approve process.
            The requestable roles will be displayed in the role request dialog by default.
            Please note that the roles also need an approval definition to go through the approval process.
            Otherwise they will be assigned automatically without any approval.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#assign</action>
        <phase>request</phase>
        <object id="22">
            <special>self</special>
        </object>
        <target id="23">
            <type>RoleType</type>
            <filter>
                <q:text>requestable = true</q:text>
            </filter>
        </target>
        <relation>org:default</relation>        <!-- only assignments with the default (member) relation can be requested -->
    </authorization>
    <authorization id="10">
        <name>self-execution-modify</name>
        <description>
            Authorization that allows to self-modification of some properties, but only in execution phase.
            The limitation real limitation of these operations is done in the request phase.
            E.g. the modification of assignments is controlled in the request phase by using the #assign
            authorization.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <phase>execution</phase>
        <object id="24">
            <special>self</special>
        </object>
        <item>credentials</item>
        <item>assignment</item>
    </authorization>
    <authorization id="11">
        <name>self-shadow-execution-add-modify-delete</name>
        <description>
            Authorization that allows to self-modification of user's accounts, but only in execution phase.
            The real limitation of these operations is done in the request phase.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
        <phase>execution</phase>
        <object id="25">
            <type>ShadowType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <authorization id="12">
        <name>assignment-target-get</name>
        <description>
            Authorization that allows to read all the object that are possible assignment targets. We want that
            to display the targets in the selection windows.
            Note that this authorization may be too broad for production use. Normally it should be limited to just
            selected properties such as name and description.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#get</action>
        <object id="26">
            <type>OrgType</type>
        </object>
        <object id="27">
            <type>ResourceType</type>
        </object>
        <object id="28">
            <type>RoleType</type>
        </object>
        <object id="29">
            <type>ServiceType</type>
        </object>
        <object id="30"> <!-- Deputy delegations may have users as targets -->
            <type>UserType</type>
        </object>
        <!-- Note: for production use you should consider limiting the items that can be read. -->
    </authorization>
    <authorization id="13">
        <name>operational-objects-get</name>
        <description>
            Authorization that allows to read all the object that are possible to use for (not only) GUI
            customizations. E.g there might be lookup tables used for attributes, custom form types defined, etc.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#get</action>
        <object id="31">
            <type>LookupTableType</type>
        </object>
        <!-- Note: for production use you should consider limiting the items that can be read. -->
    </authorization>
    <authorization id="14">
        <name>assignment-target-read-case</name>
        <description>
            Authorization that allows to read approval status of cases. This is used to display requests
            to the end users, especially in the "My Requests" box in user dashboard.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="32">
            <type>CaseType</type>
            <requester>
                <special>self</special>
            </requester>
        </object>
    </authorization>
    <authorization id="15">
        <name>self-owned-task-read</name>
        <description>
            Authorization that allows to see all tasks owned by a currently logged-in user.
        </description>
        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
        <object id="33">
            <type>TaskType</type>
            <owner>
                <special>self</special>
            </owner>
        </object>
    </authorization>
    <adminGuiConfiguration>
        <feedbackMessagesHook>
            <stackTraceVisibility>hidden</stackTraceVisibility>
        </feedbackMessagesHook>
        <homePage id="34">
            <type>UserType</type>
            <widget id="35">
                <identifier>myWorkItems</identifier>
                <visibility>hidden</visibility>
            </widget>
            <widget id="36">
                <identifier>myHistory</identifier>
                <visibility>hidden</visibility>
            </widget>
            <widget id="37">
                <identifier>listUsersWidget</identifier>
                <visibility>hidden</visibility>
            </widget>
            <widget id="38">
                <identifier>listResourcesWidget</identifier>
                <visibility>hidden</visibility>
            </widget>
            <widget id="39">
                <identifier>myRequests</identifier>
                <action id="40">
                    <identifier>viewAll</identifier>
                    <visibility>hidden</visibility>
                </action>
            </widget>
        </homePage>
        <selfProfilePage>
            <type>UserType</type>
            <panel id="41">
                <identifier>history</identifier>
                <visibility>hidden</visibility>
            </panel>
            <panel id="42">
                <identifier>personas</identifier>
                <visibility>hidden</visibility>
            </panel>
            <panel id="43">
                <identifier>focusTriggers</identifier>
                <visibility>hidden</visibility>
            </panel>
            <panel id="44">
                <identifier>password</identifier>
                <visibility>hidden</visibility>
            </panel>
            <panel id="45">
                <identifier>assignments</identifier>
                <panel id="46">
                    <identifier>constructionAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
                <panel id="47">
                    <identifier>indirectAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
                <panel id="48">
                    <identifier>dataProtectionAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
                <panel id="49">
                    <identifier>orgAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
                <panel id="50">
                    <identifier>roleAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
                <panel id="51">
                    <identifier>serviceAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
                <panel id="51">
                    <identifier>serviceAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
                <panel id="52">
                    <identifier>policyAssignments</identifier>
                    <visibility>hidden</visibility>
                </panel>
            </panel>
            <panel id="53">
                <identifier>focusMarks</identifier>
                <visibility>hidden</visibility>
            </panel>
        </selfProfilePage>
    </adminGuiConfiguration>
</role>
