<?xml version="1.0" encoding="ISO-8859-1"?>
<!--

    Copyright (C) 2009 eXo Platform SAS.
    
    This is free software; you can redistribute it and/or modify it
    under the terms of the GNU Lesser General Public License as
    published by the Free Software Foundation; either version 2.1 of
    the License, or (at your option) any later version.
    
    This software is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    Lesser General Public License for more details.
    
    You should have received a copy of the GNU Lesser General Public
    License along with this software; if not, write to the Free
    Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    02110-1301 USA, or see the FSF site: http://www.fsf.org.

-->

<configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.exoplatform.org/xml/ns/kernel_1_2.xsd http://www.exoplatform.org/xml/ns/kernel_1_2.xsd"
  xmlns="http://www.exoplatform.org/xml/ns/kernel_1_2.xsd">

  <component>
    <type>org.exoplatform.services.organization.cache.OrganizationCacheHandler</type>
  </component>

  <component>
    <type>org.exoplatform.services.organization.idm.IdmHibernateService</type>
    <init-params>
      <properties-param>
        <name>hibernate.properties</name>
        <description>Default Hibernate Service</description>
        <property name="hibernate.hbm2ddl.auto" value="${exo.idm.hibernate.hbm2ddl:none}"/>
        <property name="hibernate.show_sql" value="false" />
        <property name="hibernate.connection.datasource" value="${gatein.idm.datasource.name}${container.name.suffix}" />
        <property name="hibernate.connection.autocommit" value="false" />
        <property name="hibernate.id.new_generator_mappings" value="false"/>
        <property name="hibernate.current_session_context_class" value="thread"/>
        <property name="hibernate.cache.use_second_level_cache" value="false"/>
        <property name="hibernate.cache.use_query_cache" value="false"/>
        <property name="hibernate.listeners.envers.autoRegister" value="false"/>
        <property name="hibernate.identifier_generator_strategy_provider" value="io.meeds.common.persistence.HibernateCustomIdentifierGeneratorStrategyProvider" />
      </properties-param>
    </init-params>
  </component>

  <component>
    <key>org.exoplatform.services.organization.idm.PicketLinkIDMService</key>
    <type>org.exoplatform.services.organization.idm.PicketLinkIDMServiceImpl</type>
    <init-params>
      <value-param>
        <name>ldap.type</name>
        <value>${exo.ldap.type:}</value>
      </value-param>
      <value-param>
        <name>config</name>
        <value>war:/conf/organization/picketlink-idm/picketlink-idm-config.xml</value>
      </value-param>
      <value-param>
        <name>config.ldap</name>
        <value>war:/conf/organization/picketlink-idm/picketlink-idm-ldap-config.xml</value>
      </value-param>
      <value-param>
        <name>config.ad</name>
        <value>war:/conf/organization/picketlink-idm/picketlink-idm-msad-config.xml</value>
      </value-param>

      <!-- In default PicketLink IDM configuration hibernate store will namespace identity objects using this realm name
           if you want to share DB between portal and also share the same identity data remove the "${container.name.suffix}" part-->
      <value-param>
        <name>portalRealm</name>
        <value>idm_realm${container.name.suffix}</value>
      </value-param>

        <value-param>
            <name>skipExpirationOfStructureCacheEntries</name>
            <value>true</value>
        </value-param>

        <value-param>
            <name>useSecureRandomService</name>
            <value>true</value>
        </value-param>

    </init-params>
  </component>

  <component>
    <key>org.exoplatform.services.organization.OrganizationService</key>
    <type>org.exoplatform.services.organization.idm.PicketLinkIDMOrganizationServiceImpl</type>
    <init-params>
      <object-param>
        <name>configuration</name>
        <object type="org.exoplatform.services.organization.idm.Config">
          <!-- For all ids not mapped with type in 'groupTypeMappings' use parent id path
               as a group type to store group in PicketLink IDM. The effect of setting
               this option to false and not providing any mappings under 'groupTypeMappings' option
               is that there can be only one group with a given name in all GateIn group tree-->
          <field name="useParentIdAsGroupType">
            <boolean>true</boolean>
          </field>
          <!-- Group stored in PicketLink IDM with a type mapped in 'groupTypeMappings' will
               automatically be member under mapped parent. Normally groups are linked by
               PicketLink IDM group association - such relationship won't be needed then. It can
               be set to false if all groups are added via GateIn APIs
               This option may be useful with LDAP config as it will make (if set to true) every entry
               added to LDAP (not via GateIn management UI) appear in GateIn-->
          <field name="forceMembershipOfMappedTypes">
            <boolean>true</boolean>
          </field>
          <!-- When 'userParentIdAsGroupType is set to true this value will be used to
               replace all "/" chars in id. This is because "/" is not allowed to be
               used in group type name in PicketLink IDM-->
          <field name="pathSeparator">
            <string>.</string>
          </field>
          <!-- Name of a group stored in PicketLink IDM that acts as root group in GateIn - "/" -->
          <field name="rootGroupName">
            <string>GTN_ROOT_GROUP</string>
          </field>
          <!-- Map groups added with GateIn API as a childs of a given group ID to be stored with a given
               group type name in PicketLink IDM. If parent ID ends with "/*" then all child groups will
               have the mapped group type. Otherwise only direct (first level) children will use this type.

               This can be leveraged by LDAP setup. Given LDAP DN configured in PicketLink IDM to
               store specific group type will then store one given branch in GateIn group tree while
               all other groups will remain in DB. -->
          <field name="groupTypeMappings">
            <map type="java.util.HashMap">
              <entry>
                <key><string>/</string></key>
                <value><string>root_type</string></value>
              </entry>
              <!-- exo.group.platform.identity.type will define the identity type of groups under /platform group.
                Before meeds 1.0 , the value was '.platform' , starting meeds 1.0 the value is GROUP -->
              <entry>
                <key><string>/platform/*</string></key>
                <value><string>${exo.group.platform.identity.type:GROUP}</string></value>
              </entry>
              <!-- exo.ldap.groups.rootGroup is the group under which all LDAP/AD groups will be imported
                   exo.ldap.groups.identity.type is the identity type for groups imported from LDAP/AD-->
              <entry>
                <key><string>${exo.ldap.groups.rootGroup:/ldap-groups/*}</string></key>
                <value><string>${exo.ldap.groups.identity.type:LDAP_MAPPED_GROUP}</string></value>
              </entry>
            </map>
          </field>
          <!-- If this option is used then each Membership created with MembrshipType that is
               equal to value specified here will be stored in PicketLink IDM as simple
               Group-User association-->
          <field name="associationMembershipType">
            <string>member</string>
          </field>
          <!-- if "associationMembershipType" option is used and this option is set to true
                then Membership with MembershipType configured to be stored as PicketLink IDM association
                will not be stored as PicketLink IDM Role in case that they are in groups from this parameter.
                For RW LDAP setup, it's recommended to map all groups mapped to LDAP (all those from parameter groupTypeMappings)
                However for DB only and/or Read-only LDAP, it's recommended to not map anything here -->
          <field name="ignoreMappedMembershipTypeGroupList">
            <collection type="java.util.ArrayList" item-type="java.lang.String">
              <!-- Uncomment for sample LDAP config
              <value>
                <string>/platform/*</string>
              </value>
              <value>
                <string>/organization/*</string>
              </value>-->
            </collection>
          </field>

          <!-- If PLIDM group will have name containing slash "/" char than it will be replace with following string.
               Slashes are used in group paths and if present in names may cause unpredictable behaviour -->
          <field name="slashReplacement">
            <string>@_@_@</string>
          </field>

          <!-- If groups should be displayed in a sorted order in the management UI-->
          <field name="sortGroups">
            <boolean>true</boolean>
          </field>

          <!-- If memberships should be displayed in a sorted order in the management UI-->
          <field name="sortMemberships">
            <boolean>true</boolean>
          </field>

            <!--
            When this option is set to true:
              If use fresh user-database or existed user-database of GateIn 3.7 or above, it will work fine with disable-user feature.
              If use existed user-database of GateIn 3.6 or below, Some method introduced by disable-user feature will not
              return existed-user because it is impossible to select user has not an attribute by query with PLIDM,
              so you need to migrate data before use disable-user feature.
            When this option is set to false:
              All method return collection user of UserHandler interface will ignore param 'enabledOnly'.
              They will always return both enable and disabled user

            If you setup a fresh user-database or use existed user-database of GateIn 3.7 or above,
            it's recommended to switch this option to true to use disable-user feature
            If you has existed user-database of Gatein 3.6 or below, it's recommended to migrate data and set this option to true to use disable-user
            feature or set this option to false.
            -->
          <field name="filterDisabledUsersInQueries">
            <boolean>true</boolean>
          </field>

          <!--
          This option is used to toogle disable-user feature
          By default, this option is set to TRUE
          When this option is set to FALSE,
            the disable-user feature is deactivated, and 'filterDisabledUsersInQueries' option is ignored
          -->
          <field name="disableUserActived">
            <boolean>${exo.disable.user.activated:true}</boolean>
          </field>
        </object>
      </object-param>
    </init-params>
  </component>

  <external-component-plugins>
    <target-component>org.exoplatform.services.listener.ListenerService</target-component>
    <component-plugin>
      <name>exo.core.security.ConversationRegistry.register</name>
      <set-method>addListener</set-method>
      <type>io.meeds.portal.security.listener.DefaultUserMembershipListener</type>
      <description>update user groups when first login</description>
      <priority>10</priority>
    </component-plugin>
  </external-component-plugins>    

</configuration>
