<?xml version="1.0" encoding="UTF-8"?>
<!--

    Copyright (C) 2009 eXo Platform SAS.

    This is free software; you can redistribute it and/or modify it
    under the terms of the GNU Lesser General Public License as
    published by the Free Software Foundation; either version 2.1 of
    the License, or (at your option) any later version.

    This software is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
    Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public
    License along with this software; if not, write to the Free
    Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
    02110-1301 USA, or see the FSF site: http://www.fsf.org.

-->

<jboss-identity xmlns="urn:picketlink:idm:config:v1_0_0_ga"
                xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
                xsi:schemaLocation="urn:picketlink:idm:config:v1_0_0_ga identity-config.xsd">
  <realms>
    <realm>
      <id>idm_realm</id>
      <repository-id-ref>PortalRepository</repository-id-ref>
      <identity-type-mappings>
        <user-mapping>USER</user-mapping>
      </identity-type-mappings>
      <options>
        <option>
          <name>template</name>
          <value>true</value>
        </option>
        <option>
          <name>oldCredentialEncoder.class</name>
          <value>${exo.plidm.password.oldClass:org.picketlink.idm.impl.credential.DatabaseReadingSaltEncoder}</value>
        </option>
        <option>
          <name>credentialEncoder.class</name>
          <value>${exo.plidm.password.class:org.exoplatform.web.security.hash.Argon2IdPasswordEncoder}</value>
        </option>
        <option>
          <name>credentialEncoder.hashAlgorithm</name>
          <value>${exo.plidm.password.hash:SHA-256}</value>
        </option>
        <option>
          <name>credentialEncoder.secureRandomAlgorithm</name>
          <value>${exo.plidm.password.secureRandomAlgorithm:SHA1PRNG}</value>
        </option>
      </options>
    </realm>
  </realms>
  <repositories>
    <repository>
      <id>PortalRepository</id>
      <class>org.gatein.portal.idm.impl.repository.ExoFallbackIdentityStoreRepository</class>
      <external-config/>
      <default-identity-store-id>HibernateStore</default-identity-store-id>
      <default-attribute-store-id>HibernateStore</default-attribute-store-id>
      <identity-store-mappings>
        <identity-store-mapping>
          <identity-store-id>PortalLDAPStore</identity-store-id>
          <identity-object-types>
            <identity-object-type>USER</identity-object-type>
            <identity-object-type>LDAP_MAPPED_GROUP</identity-object-type>
          </identity-object-types>
          <options>
            <option>
              <name>readOnly</name>
              <value>true</value>
            </option>
            <option>
              <name>mandatoryStoredObjects</name>
              <value>USER,</value>
            </option>
          </options>
        </identity-store-mapping>
      </identity-store-mappings>
      <options>
        <option>
          <name>allowNotDefinedAttributes</name>
          <value>true</value>
        </option>
      </options>
    </repository>
    <repository>
      <id>DefaultPortalRepository</id>
      <class>org.picketlink.idm.impl.repository.WrapperIdentityStoreRepository</class>
      <external-config/>
      <default-identity-store-id>HibernateStore</default-identity-store-id>
      <default-attribute-store-id>HibernateStore</default-attribute-store-id>
    </repository>
  </repositories>
  <stores>
    <attribute-stores/>
    <identity-stores>
      <identity-store>
        <id>HibernateStore</id>
        <class>org.gatein.portal.idm.impl.store.hibernate.ExoHibernateIdentityStoreImpl</class>
        <external-config/>
        <supported-relationship-types>
          <relationship-type>JBOSS_IDENTITY_MEMBERSHIP</relationship-type>
          <relationship-type>JBOSS_IDENTITY_ROLE</relationship-type>
        </supported-relationship-types>
        <supported-identity-object-types>
          <identity-object-type>
            <name>USER</name>
            <relationships/>
            <credentials>
              <credential-type>PASSWORD</credential-type>
            </credentials>
            <attributes/>
            <options/>
          </identity-object-type>
        </supported-identity-object-types>
        <options>
          <option>
            <name>hibernateSessionFactoryRegistryName</name>
            <value>hibernateSessionFactory</value>
          </option>
          <option>
            <name>populateRelationshipTypes</name>
            <value>true</value>
          </option>
          <option>
            <name>populateIdentityObjectTypes</name>
            <value>true</value>
          </option>
          <option>
            <name>allowNotDefinedIdentityObjectTypes</name>
            <value>true</value>
          </option>
          <option>
            <name>allowNotDefinedAttributes</name>
            <value>true</value>
          </option>
          <option>
            <name>allowNotCaseSensitiveSearch</name>
            <value>${exo.idm.search.notCaseSensitive:true}</value>
          </option>
          <option>
            <name>isRealmAware</name>
            <value>true</value>
          </option>
          <option>
            <name>lazyStartOfHibernateTransaction</name>
            <value>true</value>
          </option>
        </options>
      </identity-store>
      <identity-store>
        <id>PortalLDAPStore</id>
        <class>org.picketlink.idm.impl.store.ldap.ExoLDAPIdentityStoreImpl</class>
        <external-config/>
        <supported-relationship-types>
          <relationship-type>JBOSS_IDENTITY_MEMBERSHIP</relationship-type>
        </supported-relationship-types>
        <supported-identity-object-types>
          <identity-object-type>
            <name>USER</name>
            <relationships/>
            <credentials>
              <credential-type>PASSWORD</credential-type>
            </credentials>
            <attributes>
              <attribute>
                <name>firstName</name>
                <mapping>${exo.ldap.users.attributes.firstName.mapping:cn}</mapping>
                <type>text</type>
                <isRequired>false</isRequired>
                <isMultivalued>false</isMultivalued>
                <isReadOnly>false</isReadOnly>
              </attribute>
              <attribute>
                <name>lastName</name>
                <mapping>${exo.ldap.users.attributes.lastName.mapping:sn}</mapping>
                <type>text</type>
                <isRequired>false</isRequired>
                <isMultivalued>false</isMultivalued>
                <isReadOnly>false</isReadOnly>
              </attribute>
              <attribute>
                <name>email</name>
                <mapping>${exo.ldap.users.attributes.email.mapping:mail}</mapping>
                <type>text</type>
                <isRequired>false</isRequired>
                <isMultivalued>false</isMultivalued>
                <isReadOnly>false</isReadOnly>
                <isUnique>true</isUnique>
              </attribute>
            </attributes>
            <options>
              <option>
                <name>idAttributeName</name>
                <value>${exo.ldap.users.id.attributeName:uid}</value>
              </option>
              <option>
                <name>passwordAttributeName</name>
                <value>${exo.ldap.users.password.attributeName:userPassword}</value>
              </option>
              <option>
                <name>ctxDNs</name>
                <value>${exo.ldap.users.base.dn:ou=users,dc=company,dc=org}</value>
              </option>
              <option>
                <name>entrySearchFilter</name>
                <value>${exo.ldap.users.filter:}</value>
              </option>
              <option>
                <name>entrySearchScope</name>
                <value>${exo.ldap.users.search.scope:subtree}</value>
              </option>
              <option>
                <name>allowCreateEntry</name>
                <value>false</value>
              </option>
              <option>
                <name>createEntryAttributeValues</name>
                <value>objectClass=top</value>
                <value>objectClass=inetOrgPerson</value>
                <value>sn= </value>
                <value>cn= </value>
              </option>
            </options>
          </identity-object-type>
          <identity-object-type>
            <name>LDAP_MAPPED_GROUP</name>
            <relationships>
              <relationship>
                <relationship-type-ref>JBOSS_IDENTITY_MEMBERSHIP</relationship-type-ref>
                <identity-object-type-ref>USER</identity-object-type-ref>
              </relationship>
              <relationship>
                <relationship-type-ref>JBOSS_IDENTITY_MEMBERSHIP</relationship-type-ref>
                <identity-object-type-ref>LDAP_MAPPED_GROUP</identity-object-type-ref>
              </relationship>
            </relationships>
            <credentials/>
            <attributes/>
            <options>
              <option>
                <name>idAttributeName</name>
                <value>${exo.ldap.groups.id:cn}</value>
              </option>
              <option>
                <name>ctxDNs</name>
                <value>${exo.ldap.groups.base.dn:ou=groups,dc=company,dc=org}</value>
              </option>
              <option>
                <name>entrySearchFilter</name>
                <value>${exo.ldap.groups.filter:}</value>
              </option>
              <option>
                <name>entrySearchScope</name>
                <value>${exo.ldap.groups.search.scope:subtree}</value>
              </option>
              <option>
                <name>allowCreateEntry</name>
                <value>false</value>
              </option>
              <option>
                <name>parentMembershipAttributeName</name>
                <value>${exo.ldap.groups.parentMembershipAttributeName:member}</value>
              </option>
              <option>
                <name>isParentMembershipAttributeDN</name>
                <value>${exo.ldap.groups.isParentMembershipAttributeDN:true}</value>
              </option>
              <option>
                <name>childMembershipAttributeName</name>
                <value>${exo.ldap.groups.childMembershipAttributeName:}</value>
              </option>
              <option>
                <name>childMembershipAttributeDN</name>
                <value>${exo.ldap.groups.childMembershipAttributeDN:}</value>
              </option>
              <option>
                <name>allowEmptyMemberships</name>
                <value>true</value>
              </option>
              <option>
                <name>createEntryAttributeValues</name>
                <value>objectClass=top</value>
                <value>objectClass=groupOfNames</value>
              </option>
            </options>
          </identity-object-type>
        </supported-identity-object-types>
        <options>
          <option>
            <name>providerURL</name>
            <value>${exo.ldap.url:ldap://localhost:1389}</value>
          </option>
          <option>
            <name>adminDN</name>
            <value>${exo.ldap.admin.dn:cn=admin}</value>
          </option>
          <option>
            <name>adminPassword</name>
            <value>${exo.ldap.admin.password:}</value>
          </option>
          <option>
            <name>searchTimeLimit</name>
            <value>${exo.ldap.search.timelimit:10000}</value>
          </option>
          <option>
            <name>createMissingContexts</name>
            <value>false</value>
          </option>
          <option>
            <name>allowNotCaseSensitiveSearch</name>
            <value>${exo.idm.search.notCaseSensitive:true}</value>
          </option>
          <option>
            <name>pagedResultsExtensionSize</name>
            <value>${exo.ldap.search.resultlimit:1000}</value>
          </option>
          <option>
            <name>pagedResultsExtensionSupported</name>
            <value>${exo.ldap.search.pagedResult.enabled:true}</value>
          </option>
        </options>
      </identity-store>
    </identity-stores>
  </stores>
  <options>
    <option>
      <name>defaultTemplate</name>
      <value>idm_realm</value>
    </option>
  </options>
</jboss-identity>
