apiVersion: v1
kind: ConfigMap
metadata:
  name: mp-demo-poi-ldap-res
  namespace: mp-demo
data:
  151-resource-openldap.xml: |
    <?xml version="1.0" encoding="UTF-8"?>
    <!--
      ~ Copyright (c) 2017 Evolveum
      ~
      ~ Licensed under the Apache License, Version 2.0 (the "License");
      ~ you may not use this file except in compliance with the License.
      ~ You may obtain a copy of the License at
      ~
      ~     http://www.apache.org/licenses/LICENSE-2.0
      ~
      ~ Unless required by applicable law or agreed to in writing, software
      ~ distributed under the License is distributed on an "AS IS" BASIS,
      ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      ~ See the License for the specific language governing permissions and
      ~ limitations under the License.
      -->

    <resource oid="00000000-cafe-0004-0000-000000000001"
        xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
        xmlns:t='http://prism.evolveum.com/xml/ns/public/types-3' xmlns:xsd="http://www.w3.org/2001/XMLSchema"
        xmlns:ri="http://midpoint.evolveum.com/xml/ns/public/resource/instance-3"
        xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
        xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
        xmlns:my="http://whatever.com/my" xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
        xmlns:mr="http://prism.evolveum.com/xml/ns/public/matching-rule-3"
        xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3">

        <name>LDAP</name>

        <description>
            LDAP resource using a ConnId LDAP connector. It contains configuration
            for use with OpenLDAP servers.
        </description>

        <connectorRef type="ConnectorType">
            <filter>
                <q:equal>
                    <q:path>c:connectorType</q:path>
                    <q:value>com.evolveum.polygon.connector.ldap.LdapConnector</q:value>
                </q:equal>
            </filter>
        </connectorRef>

        <connectorConfiguration
            xmlns:icfc="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/connector-schema-3"
            xmlns:icfcldap="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/bundle/com.evolveum.polygon.connector-ldap/com.evolveum.polygon.connector.ldap.LdapConnector">
            <icfc:configurationProperties>
                <icfcldap:port>389</icfcldap:port>
                <icfcldap:host>mp-demo-ldap.mp-demo.svc.cluster.local</icfcldap:host>
                <icfcldap:baseContext>dc=example,dc=com</icfcldap:baseContext>
                <icfcldap:bindDn>cn=idm,ou=Administrators,dc=example,dc=com</icfcldap:bindDn>
                <icfcldap:bindPassword>
                    <t:clearValue>secret</t:clearValue>
                </icfcldap:bindPassword>
                <icfcldap:pagingStrategy>auto</icfcldap:pagingStrategy>
                <icfcldap:passwordHashAlgorithm>SSHA</icfcldap:passwordHashAlgorithm>
                <icfcldap:vlvSortAttribute>uid,cn,ou,dc</icfcldap:vlvSortAttribute>
                <icfcldap:vlvSortOrderingRule>2.5.13.3</icfcldap:vlvSortOrderingRule>
                <icfcldap:operationalAttributes>memberOf</icfcldap:operationalAttributes>
                <icfcldap:operationalAttributes>createTimestamp</icfcldap:operationalAttributes>
                <icfcldap:usePermissiveModify>always</icfcldap:usePermissiveModify>
                <icfcldap:lockoutStrategy>openldap</icfcldap:lockoutStrategy>
            </icfc:configurationProperties>
            <icfc:resultsHandlerConfiguration>
                <icfc:enableNormalizingResultsHandler>false</icfc:enableNormalizingResultsHandler>
                <icfc:enableFilteredResultsHandler>false</icfc:enableFilteredResultsHandler>
                <icfc:enableAttributesToGetSearchResultsHandler>false</icfc:enableAttributesToGetSearchResultsHandler>
            </icfc:resultsHandlerConfiguration>
        </connectorConfiguration>

        <schemaHandling>
            <objectType>
                <kind>account</kind>
                <displayName>Normal Account</displayName>
                <default>true</default>
                <objectClass>ri:inetOrgPerson</objectClass>
                <attribute>
                    <ref>ri:dn</ref>
                    <displayName>Distinguished Name</displayName>
                    <limitations>
                        <minOccurs>0</minOccurs>
                        <access>
                            <read>true</read>
                            <add>true</add>
                            <modify>true</modify>
                        </access>
                    </limitations>
                    <outbound>
                        <source>
                            <path>name</path>
                        </source>
                        <expression>
                            <script>
                                <code>
                                    basic.composeDnWithSuffix('uid', name + iterationToken, 'ou=people,dc=example,dc=com')
                                </code>
                            </script>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:entryUUID</ref>
                    <displayName>Entry UUID</displayName>
                    <limitations>
                        <access>
                            <read>true</read>
                            <add>false</add>
                            <modify>true</modify>
                        </access>
                    </limitations>
                </attribute>
                <attribute>
                    <ref>ri:cn</ref>
                    <displayName>Common Name</displayName>
                    <limitations>
                        <minOccurs>0</minOccurs>
                        <access>
                            <read>true</read>
                            <add>true</add>
                            <modify>true</modify>
                        </access>
                    </limitations>
                    <outbound>
                        <!-- We do not have user fullName populated yet. Use name in the meantime. -->
                        <source>
                            <path>name</path>
                        </source>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:sn</ref>
                    <displayName>Surname</displayName>
                    <limitations>
                        <minOccurs>0</minOccurs>
                    </limitations>
                    <outbound>
                        <source>
                            <path>familyName</path>
                        </source>
                    </outbound>
                    <inbound>
                        <target>
                            <path>familyName</path>
                        </target>
                    </inbound>
                </attribute>
                <attribute>
                    <ref>ri:givenName</ref>
                    <displayName>Given Name</displayName>
                    <outbound>
                        <source>
                            <path>givenName</path>
                        </source>
                    </outbound>
                    <inbound>
                        <target>
                            <path>givenName</path>
                        </target>
                    </inbound>
                </attribute>
                <attribute>
                    <ref>ri:uid</ref>
                    <displayName>Login Name</displayName>
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>name</path>
                        </source>
                        <expression>
                            <script>
                                <code>name + iterationToken</code>
                            </script>
                        </expression>
                    </outbound>
                    <inbound>
                        <target>
                            <path>name</path>
                        </target>
                    </inbound>
                </attribute>
                <attribute>
                    <ref>ri:description</ref>
                    <outbound>
                        <strength>weak</strength>
                        <expression>
                            <value>Created by midPoint</value>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:mail</ref>
                    <displayName>Mail</displayName>
                    <tolerant>false</tolerant>
                    <outbound>
                        <strength>strong</strength>
                        <source>
                            <path>emailAddress</path>
                        </source>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:l</ref>
                    <displayName>Location</displayName>
                    <outbound>
                        <source>
                            <path>locality</path>
                        </source>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:employeeNumber</ref>
                    <displayName>Employee Number</displayName>
                    <tolerant>false</tolerant>
                    <outbound>
                        <strength>strong</strength>
                        <source>
                            <path>employeeNumber</path>
                        </source>
                    </outbound>
                </attribute>

                <association>
                    <ref>ri:ldapGroup</ref>
                    <displayName>LDAP Group Membership</displayName>
                    <kind>entitlement</kind>
                    <intent>ldapGroup</intent>
                    <direction>objectToSubject</direction>
                    <associationAttribute>ri:member</associationAttribute>
                    <valueAttribute>ri:dn</valueAttribute>
                </association>

                <iteration>
                    <maxIterations>5</maxIterations>
                </iteration>

                <protected>
                    <filter>
                        <q:equal>
                            <q:matching>http://prism.evolveum.com/xml/ns/public/matching-rule-3#stringIgnoreCase</q:matching>
                            <q:path>attributes/ri:dn</q:path>
                            <q:value>cn=idm,ou=Administrators,dc=example,dc=com</q:value>
                        </q:equal>
                    </filter>
                </protected>

                <activation>
                    <administrativeStatus>
                        <outbound />
                        <inbound>
                            <strength>weak</strength>
                            <expression>
                                <asIs />
                            </expression>
                        </inbound>
                    </administrativeStatus>
                    <lockoutStatus>
                        <outbound/>
                    </lockoutStatus>
                </activation>

                <credentials>
                    <password>
                        <outbound>
                            <expression>
                                <asIs />
                            </expression>
                        </outbound>
                        <inbound>
                            <strength>weak</strength>
                            <expression>
                                <generate />
                            </expression>
                        </inbound>
                    </password>
                </credentials>

            </objectType>

            <objectType>
                <kind>entitlement</kind>
                <intent>ldapGroup</intent>
                <displayName>LDAP Group</displayName>
                <objectClass>ri:groupOfNames</objectClass>
                <baseContext>
                    <objectClass>ri:organizationalUnit</objectClass>
                    <filter>
                        <q:equal>
                            <q:path>attributes/dn</q:path>
                            <q:value>ou=groups,dc=example,dc=com</q:value>
                        </q:equal>
                    </filter>
                </baseContext>

                <attribute>
                    <ref>ri:dn</ref>
                    <outbound>
                        <source>
                            <path>name</path>
                        </source>
                        <expression>
                            <script>
                                <code>
                                    basic.composeDnWithSuffix('cn', name, 'ou=groups,dc=example,dc=com');
                                </code>
                            </script>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:member</ref>
                    <fetchStrategy>minimal</fetchStrategy>
                    <outbound>
                        <strength>weak</strength>
                        <expression>
                            <value>cn=fake,dc=example,dc=com</value>
                        </expression>
                    </outbound>
                </attribute>
                <attribute>
                    <ref>ri:cn</ref>
                    <outbound>
                        <strength>weak</strength>
                        <source>
                            <path>name</path>
                        </source>
                    </outbound>
                </attribute>
                <configuredCapabilities>
                    <cap:pagedSearch>
                        <cap:defaultSortField>ri:cn</cap:defaultSortField>
                    </cap:pagedSearch>
                </configuredCapabilities>
            </objectType>

        </schemaHandling>

        <synchronization>
            <objectSynchronization>
                <objectClass>ri:inetOrgPerson</objectClass>
                <kind>account</kind>
                <intent>default</intent>
                <focusType>UserType</focusType>
                <enabled>true</enabled>

                <correlation>
                    <q:equal>
                        <q:path>name</q:path>
                        <expression>
                            <path>$account/attributes/uid</path>
                        </expression>
                    </q:equal>
                </correlation>


                <reaction>
                    <situation>linked</situation>
                    <synchronize>true</synchronize>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink
                        </handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link
                        </handlerUri>
                    </action>
                </reaction>
            </objectSynchronization>

            <objectSynchronization>
                <objectClass>ri:groupOfNames</objectClass>
                <kind>entitlement</kind>
                <intent>ldapGroup</intent>
                <focusType>OrgType</focusType>
                <enabled>true</enabled>

                <correlation>
                    <q:equal>
                        <q:path>name</q:path>
                        <expression>
                            <path>$account/attributes/cn</path>
                        </expression>
                    </q:equal>
                </correlation>


                <reaction>
                    <situation>linked</situation>
                    <synchronize>true</synchronize>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink
                        </handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link
                        </handlerUri>
                    </action>
                </reaction>
            </objectSynchronization>

            <objectSynchronization>
                <objectClass>ri:posixGroup</objectClass>
                <kind>entitlement</kind>
                <intent>posixGroup</intent>
                <focusType>OrgType</focusType>
                <enabled>true</enabled>

                <correlation>
                    <q:equal>
                        <q:path>name</q:path>
                        <expression>
                            <path>$projection/attributes/cn</path>
                        </expression>
                    </q:equal>
                </correlation>


                <reaction>
                    <situation>linked</situation>
                    <synchronize>true</synchronize>
                </reaction>
                <reaction>
                    <situation>deleted</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#unlink</handlerUri>
                    </action>
                </reaction>
                <reaction>
                    <situation>unlinked</situation>
                    <synchronize>true</synchronize>
                    <action>
                        <handlerUri>http://midpoint.evolveum.com/xml/ns/public/model/action-3#link</handlerUri>
                    </action>
                </reaction>
            </objectSynchronization>

        </synchronization>

    </resource>
  311-role-ldap.xml: |
    <?xml version="1.0" encoding="UTF-8"?>
    <role xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" oid="00000000-cafe-0001-0000-000000000011">
      <name>ldap</name>
      <displayName>LDAP account</displayName>
      <inducement>
        <construction>
           <resourceRef oid="00000000-cafe-0004-0000-000000000001" relation="org:default" type="ResourceType" />
           <kind>account</kind>
           <intent>default</intent>
        </construction>
      </inducement>
    </role>
  403-test-user.xml: |-
    <?xml version="1.0" encoding="UTF-8"?>
    <user xmlns="http://midpoint.evolveum.com/xml/ns/public/common/common-3" xmlns:org="http://midpoint.evolveum.com/xml/ns/public/common/org-3" xmlns:t='http://prism.evolveum.com/xml/ns/public/types-3'>
      <name>test.user.ldap</name>
      <fullName>Test user</fullName>
      <givenName>Test</givenName>
      <familyName>User</familyName>
      <assignment>
        <targetRef oid="00000000-0000-0000-0000-000000000008" relation="org:default" type="RoleType" />
      </assignment>
      <assignment>
        <targetRef oid="00000000-cafe-0001-0000-000000000011" relation="org:default" type="RoleType" />
      </assignment>
      <credentials>
        <password>
          <value>
            <t:clearValue>5ecr3t</t:clearValue>
          </value>
        </password>
      </credentials>
    </user>
