<!--
  ~ Copyright (c) 2010-2017 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
<resource xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
          xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
          xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
          xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
          xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
          xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
          xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3"
          oid="e307a460-2310-4f18-9644-6534d62fa999"
          version="0">
    <name>SAP</name>

    <connectorRef type="ConnectorType">
        <filter>
            <q:text>c:connectorType = "com.evolveum.polygon.connector.sap.SapConnector"</q:text>
        </filter>
    </connectorRef>
    <connectorConfiguration xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3">
        <icfc:configurationProperties xmlns:sap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-sap/com.evolveum.polygon.connector.sap.SapConnector">
            <sap:host>host.to.sap</sap:host>
            <sap:systemNumber>34</sap:systemNumber>
            <sap:systemId>SRS</sap:systemId>
            <sap:client>200</sap:client>
            <sap:user>USER</sap:user>
            <sap:password>
                <t:clearValue>secret</t:clearValue>
            </sap:password>
            <sap:testBapiFunctionPermission>false</sap:testBapiFunctionPermission>
        </icfc:configurationProperties>
        <icfc:resultsHandlerConfiguration>
            <icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler>
            <icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
            <icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler>
        </icfc:resultsHandlerConfiguration>
        <icfc:legacySchema>true</icfc:legacySchema>
    </connectorConfiguration>

    <schemaHandling>
        <objectType>
            <kind>account</kind>
            <intent>default</intent>
            <displayName>Default Account</displayName>
            <default>true</default>
            <objectClass>ri:AccountObjectClass</objectClass>
            <attribute>
                <c:ref>icfs:name</c:ref>
                <displayName>USERNAME</displayName>
                <limitations>
                    <minOccurs>0</minOccurs>
                </limitations>
                <outbound>
                    <source>
                        <c:path>$user/name</c:path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                return basic.uc(basic.stringify(name));
                            </code>
                        </script>
                    </expression>
                </outbound>
                <inbound>
                    <strength>weak</strength>
                    <target>
                        <c:path>$user/name</c:path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <c:ref>icfs:uid</c:ref>
                <displayName>Entry UUID</displayName>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <matchingRule>mr:stringIgnoreCase</matchingRule>
            </attribute>
            <attribute>
                <c:ref>ri:ADDRESS.FIRSTNAME</c:ref>
                <outbound>
                    <source>
                        <c:path>$user/givenName</c:path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <c:path>$user/givenName</c:path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <c:ref>ri:ADDRESS.LASTNAME</c:ref>
                <outbound>
                    <source>
                        <c:path>$user/familyName</c:path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <c:path>$user/familyName</c:path>
                    </target>
                </inbound>
            </attribute>
            <!-- TODO not in CSV input? -->
            <attribute>
                <c:ref>ri:ADDRESS.E_MAIL</c:ref>
                <outbound>
                    <source>
                        <c:path>$user/emailAddress</c:path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <c:path>$user/emailAddress</c:path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <c:ref>ri:ADDRESS.TEL1_NUMBR</c:ref>
                <outbound>
                    <source>
                        <c:path>$user/telephoneNumber</c:path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <c:path>$user/telephoneNumber</c:path>
                    </target>
                </inbound>
            </attribute>
            <!-- TODO we have also this? where? -->
            <!--<attribute>-->
                <!--<c:ref>ri:ADDRESS.TEL1_EXT</c:ref>-->
                <!--<displayName>ONLY FOR TESTING: TEL1_EXT = '3392' (outbound)</displayName>-->
                <!--<outbound>-->
                    <!--<expression>-->
                        <!--<script>-->
                            <!--<code>-->
                                <!--return "3392";-->
                            <!--</code>-->
                        <!--</script>-->
                    <!--</expression>-->
                <!--</outbound>-->
            <!--</attribute>-->
            <!-- TODO departmentNumber ? -->
            <attribute>
                <c:ref>ri:ADDRESS.DEPARTMENT</c:ref>
                <outbound>
                    <source>
                        <c:path>$user/organization</c:path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <c:path>$user/organization</c:path>
                    </target>
                </inbound>
            </attribute>
            <!-- TODO postalAddress is where in midPoint? -->
            <attribute>
                <c:ref>ri:ADDRESS.COUNTRY</c:ref>
                <displayName>ONLY FOR TESTING: COUNTRY = locality</displayName>
                <outbound>
                    <source>
                        <c:path>$user/locality</c:path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <c:path>$user/locality</c:path>
                    </target>
                </inbound>
            </attribute>
            <!-- TODO PERS_NO = employeeNumber it's OK? -->
            <attribute>
                <c:ref>ri:ADDRESS.PERS_NO</c:ref>
                <displayName>ONLY FOR TESTING: PERS_NO = employeeNumber (inbound)</displayName>
                <outbound>
                    <source>
                        <c:path>$user/employeeNumber</c:path>
                    </source>
                </outbound>
                <inbound>
                    <target>
                        <c:path>$user/employeeNumber</c:path>
                    </target>
                </inbound>
            </attribute>
            <!-- TODO: where is in midPoint? -->
            <!--<attribute>-->
                <!--<c:ref>ri:ADDRESS.FAX_NUMBER</c:ref>-->
                <!--<displayName>ONLY FOR TESTING: FAX_NUMBER = Description</displayName>-->
                <!--<outbound>-->
                    <!--<source>-->
                        <!--<c:path>$user/description</c:path>-->
                    <!--</source>-->
                <!--</outbound>-->
                <!--<inbound>-->
                    <!--<target>-->
                        <!--<c:path>$user/description</c:path>-->
                    <!--</target>-->
                <!--</inbound>-->
            <!--</attribute>-->


            <attribute>
                <c:ref>ri:ACTIVITYGROUPS.AGR_NAME</c:ref>
                <displayName>roles</displayName>
                <inbound>
                    <target>
                        <c:path>$user/extension/sapRoles</c:path>
                    </target>
                </inbound>
            </attribute>

            <attribute>
                <c:ref>ri:PROFILES.BAPIPROF</c:ref>
                <displayName>profiles</displayName>
                <inbound>
                    <target>
                        <c:path>$user/extension/sapProfiles</c:path>
                    </target>
                </inbound>
            </attribute>

            <attribute>
                <c:ref>ri:GROUPS.USERGROUP</c:ref>
                <displayName>groups</displayName>
                <inbound>
                    <target>
                        <c:path>$user/extension/sapGroups</c:path>
                    </target>
                </inbound>
            </attribute>

            <attribute>
                <c:ref>ri:USER_LOGIN_INFO.LAST_LOGON_DATE</c:ref>
                <displayName>last logon date + time</displayName>
                <inbound>
                    <source>
                        <name>ltime</name>
                        <path>$account/attributes/ri:LOGONDATA.LTIME</path>
                    </source>
                    <expression>
                        <script>
                            <code>
                                if (input!=null) {
                                    if (ltime!=null) {
                                        return input+ltime;
                                    }
                                    retrn input;
                                }
                            </code>
                        </script>
                    </expression>
                    <target>
                        <c:path>$user/extension/sapLastLogonDate</c:path>
                    </target>
                </inbound>
            </attribute>


            <association>
                <c:ref>ri:roles</c:ref>
                <!-- roles are case sensitive, don't use stringIgnoreCase matchingRule -->
                <displayName>Role (activity group) Membership</displayName>
                <tolerant>true</tolerant>
                <kind>entitlement</kind>
                <intent>roles</intent>
                <direction>subjectToObject</direction>
                <associationAttribute>ri:ACTIVITYGROUPS.AGR_NAME</associationAttribute>
                <valueAttribute>icfs:uid</valueAttribute>
            </association>

            <association>
                <c:ref>ri:groups</c:ref>
                <!-- groups are case sensitive, don't use stringIgnoreCase matchingRule -->
                <displayName>Group Membership</displayName>
                <tolerant>true</tolerant>
                <kind>entitlement</kind>
                <intent>groups</intent>
                <direction>subjectToObject</direction>
                <associationAttribute>ri:GROUPS.USERGROUP</associationAttribute>
                <valueAttribute>icfs:uid</valueAttribute>
            </association>

            <association>
                <c:ref>ri:profiles</c:ref>
                <!-- profiles are case sensitive, don't use stringIgnoreCase matchingRule -->
                <displayName>Profile Membership</displayName>
                <tolerant>true</tolerant>
                <kind>entitlement</kind>
                <intent>profiles</intent>
                <direction>subjectToObject</direction>
                <associationAttribute>ri:PROFILES.BAPIPROF</associationAttribute>
                <valueAttribute>icfs:uid</valueAttribute>
            </association>

            <!-- TODO -->
            <protected>
                <filter>
                    <q:text>attributes/icfs:name = "IDMTUSAPR3"</q:text>
                </filter>
            </protected>
            <!-- TODO need it? -->
            <activation>
                <administrativeStatus>
                    <outbound/>
                    <inbound>
                        <strength>weak</strength>
                    </inbound>
                </administrativeStatus>
                <validFrom>
                    <outbound/>
                    <inbound/>
                </validFrom>
                <validTo>
                    <outbound/>
                    <inbound/>
                </validTo>
            </activation>
            <credentials>
                <password>
                    <outbound/>
                </password>
            </credentials>
        </objectType>

        <objectType>
            <kind>entitlement</kind>
            <intent>roles</intent>
            <displayName>ActivityGroups</displayName>
            <objectClass>ri:CustomACTIVITYGROUPObjectClass</objectClass>
            <attribute>
                <c:ref>icfs:name</c:ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <!-- CASE Sensitive !!!-->
                <inbound>
                    <expression>
                        <script>
                            <code>'r:' + input</code>
                        </script>
                    </expression>
                    <target>
                        <c:path>name</c:path>
                    </target>
                </inbound>
                <inbound>
                    <target>
                        <c:path>identifier</c:path>
                    </target>
                </inbound>
                <inbound>
                    <expression>
                        <value>sap-role</value>
                    </expression>
                    <target>
                        <c:path>subtype</c:path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <c:ref>icfs:uid</c:ref>
                <displayName>Entry UUID</displayName>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <!-- CASE Sensitive !!!-->
            </attribute>
        </objectType>
        <objectType>
            <kind>entitlement</kind>
            <intent>groups</intent>
            <displayName>Groups</displayName>
            <objectClass>ri:CustomGROUPObjectClass</objectClass>
            <attribute>
                <c:ref>icfs:name</c:ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <!-- CASE Sensitive !!!-->
                <inbound>
                    <expression>
                        <script>
                            <code>'g:' + input</code>
                        </script>
                    </expression>
                    <target>
                        <c:path>name</c:path>
                    </target>
                </inbound>
                <inbound>
                    <target>
                        <c:path>identifier</c:path>
                    </target>
                </inbound>
                <inbound>
                    <expression>
                        <value>sap-group</value>
                    </expression>
                    <target>
                        <c:path>subtype</c:path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <c:ref>icfs:uid</c:ref>
                <displayName>Entry UUID</displayName>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <!-- CASE Sensitive !!!-->
            </attribute>
        </objectType>
        <objectType>
            <kind>entitlement</kind>
            <intent>profiles</intent>
            <displayName>Profiles</displayName>
            <objectClass>ri:CustomPROFILEObjectClass</objectClass>
            <attribute>
                <c:ref>icfs:name</c:ref>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <!-- CASE Sensitive !!!-->
                <inbound>
                    <expression>
                        <script>
                            <code>'p:' + input</code>
                        </script>
                    </expression>
                    <target>
                        <c:path>name</c:path>
                    </target>
                </inbound>
                <inbound>
                    <target>
                        <c:path>identifier</c:path>
                    </target>
                </inbound>
                <inbound>
                    <expression>
                        <value>sap-profile</value>
                    </expression>
                    <target>
                        <c:path>subtype</c:path>
                    </target>
                </inbound>
            </attribute>
            <attribute>
                <c:ref>icfs:uid</c:ref>
                <displayName>Entry UUID</displayName>
                <limitations>
                    <access>
                        <read>true</read>
                        <add>false</add>
                        <modify>false</modify>
                    </access>
                </limitations>
                <!-- CASE Sensitive !!!-->
            </attribute>
        </objectType>

    </schemaHandling>

    <synchronization>
        <objectSynchronization>
            <name>user sync</name>
            <objectClass>ri:AccountObjectClass</objectClass>
            <kind>account</kind>
            <intent>default</intent>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:matching>polyStringNorm</q:matching>
                    <q:path>c:name</q:path>
                    <expression>
                        <c:path>$account/attributes/icfs:name</c:path>
                    </expression>
                </q:equal>
            </correlation>
            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unmatched</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri>
                </action>
            </reaction>
        </objectSynchronization>

        <objectSynchronization>
            <name>role sync</name>
            <objectClass>ri:CustomACTIVITYGROUPObjectClass</objectClass>
            <kind>entitlement</kind>
            <intent>roles</intent>
            <focusType>c:OrgType</focusType>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:path>c:name</q:path>
                    <expression>
                        <c:path>$shadow/attributes/icfs:uid</c:path>
                    </expression>
                </q:equal>
            </correlation>
            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unmatched</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri>
                </action>
            </reaction>
        </objectSynchronization>

        <objectSynchronization>
            <name>group sync</name>
            <objectClass>ri:CustomGROUPObjectClass</objectClass>
            <kind>entitlement</kind>
            <intent>groups</intent>
            <focusType>c:OrgType</focusType>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:path>c:name</q:path>
                    <expression>
                        <c:path>$shadow/attributes/icfs:uid</c:path>
                    </expression>
                </q:equal>
            </correlation>
            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unmatched</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri>
                </action>
            </reaction>
        </objectSynchronization>

        <objectSynchronization>
            <name>profile sync</name>
            <objectClass>ri:CustomPROFILEObjectClass</objectClass>
            <kind>entitlement</kind>
            <intent>profiles</intent>
            <focusType>c:OrgType</focusType>
            <enabled>true</enabled>
            <correlation>
                <q:equal>
                    <q:path>c:name</q:path>
                    <expression>
                        <c:path>$shadow/attributes/icfs:uid</c:path>
                    </expression>
                </q:equal>
            </correlation>
            <reaction>
                <situation>linked</situation>
                <synchronize>true</synchronize>
            </reaction>
            <reaction>
                <situation>deleted</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unlinked</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                </action>
            </reaction>
            <reaction>
                <situation>unmatched</situation>
                <synchronize>true</synchronize>
                <action>
                    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#addFocus</handlerUri>
                </action>
            </reaction>
        </objectSynchronization>
    </synchronization>
</resource>
