<?xml version="1.0" encoding="UTF-8"?>
<config>
  <sync>
    <transaction>off</transaction>
    <data name="IDP">
      <object name="User">
        <syncdn>ou=People</syncdn>
<!--
        <syncfilter>(&amp;(&amp;(objectClass=organizationalPerson)(!(seciossAccountStatus=deleted)))(!(uid=ADMINID)))</syncfilter>
-->
        <syncfilter>(&amp;(&amp;(|(objectClass=seciossIamAccount)(memberOf=cn=idsync,*))(!(seciossAccountStatus=deleted)))(!(uid=ADMINID)))</syncfilter>
        <syncoporder>delete,add</syncoporder>
        <order>50</order>
        <dnignore>on</dnignore>
        <syncattr>
          <name>employeeNumber</name>
        </syncattr>
        <syncattr>
          <name>sn</name>
        </syncattr>
        <syncattr>
          <name>givenName</name>
        </syncattr>
        <syncattr>
          <name>sn;lang-ja;phonetic</name>
        </syncattr>
        <syncattr>
          <name>givenName;lang-ja;phonetic</name>
        </syncattr>
        <syncattr>
          <name>displayName</name>
        </syncattr>
        <syncattr>
          <name>mail</name>
        </syncattr>
        <syncattr>
          <name>seciossTelephoneNumber</name>
        </syncattr>
        <syncattr>
          <name>seciossFax</name>
        </syncattr>
        <syncattr>
          <name>seciossMobile</name>
        </syncattr>
        <syncattr>
          <name>seciossHomePhone</name>
        </syncattr>
        <syncattr>
          <name>seciossCompany</name>
        </syncattr>
        <syncattr>
          <name>seciossDepartment</name>
        </syncattr>
        <syncattr>
          <name>title</name>
        </syncattr>
        <syncattr>
          <name>seciossCountry</name>
        </syncattr>
        <syncattr>
          <name>postalCode</name>
        </syncattr>
        <syncattr>
          <name>st</name>
        </syncattr>
        <syncattr>
          <name>l</name>
        </syncattr>
        <syncattr>
          <name>street</name>
        </syncattr>
        <syncattr>
          <name>seciossAccountStatus</name>
        </syncattr>
        <syncattr>
          <name>seciossAllowedService</name>
        </syncattr>
        <syncattr>
          <name>seciossAllowedFunction</name>
        </syncattr>
        <syncattr>
          <name>seciossSystemRole</name>
        </syncattr>
        <syncattr>
          <name>ou</name>
        </syncattr>
      </object>
      <object name="Organization">
        <syncdn>ou=Organizations</syncdn>
        <syncfilter>(objectClass=organizationalUnit)</syncfilter>
        <order>10</order>
        <delorder>last</delorder>
        <syncattr>
          <name>objectClass</name>
        </syncattr>
        <syncattr>
          <name>description</name>
        </syncattr>
      </object>
      <object name="Group">
        <syncdn>ou=Groups</syncdn>
        <syncfilter>(objectClass=seciossIamAccount)</syncfilter>
        <syncattr>
          <name>displayName</name>
        </syncattr>
        <syncattr>
          <name>mail</name>
        </syncattr>
        <syncattr>
          <name>description</name>
        </syncattr>
        <syncattr>
          <name>seciossMember</name>
          <op>modify</op>
        </syncattr>
        <syncattr>
          <name>seciossMemberId</name>
        </syncattr>
      </object>
      <object name="SecurityGroup">
        <syncdn>ou=SecurityGroups</syncdn>
        <syncfilter>(objectClass=seciossIamAccount)</syncfilter>
        <syncattr>
          <name>description</name>
        </syncattr>
        <syncattr>
          <name>seciossMember</name>
        </syncattr>
      </object>
<!-- Contact Synchronization
      <object name="Contact">
        <syncdn>ou=Contacts</syncdn>
        <syncfilter>(objectClass=seciossPerson)</syncfilter>
        <dnignore>on</dnignore>
        <syncattr>
          <name>cn</name>
        </syncattr>
        <syncattr>
          <name>sn</name>
        </syncattr>
        <syncattr>
          <name>givenName</name>
        </syncattr>
        <syncattr>
          <name>sn;lang-ja;phonetic</name>
        </syncattr>
        <syncattr>
          <name>givenName;lang-ja;phonetic</name>
        </syncattr>
        <syncattr>
          <name>displayName</name>
        </syncattr>
        <syncattr>
          <name>seciossTelephoneNumber</name>
        </syncattr>
        <syncattr>
          <name>seciossFax</name>
        </syncattr>
        <syncattr>
          <name>seciossMobile</name>
        </syncattr>
        <syncattr>
          <name>seciossHomePhone</name>
        </syncattr>
        <syncattr>
          <name>seciossCompany</name>
        </syncattr>
        <syncattr>
          <name>seciossDepartment</name>
        </syncattr>
        <syncattr>
          <name>title</name>
        </syncattr>
        <syncattr>
          <name>seciossCountry</name>
        </syncattr>
        <syncattr>
          <name>postalCode</name>
        </syncattr>
        <syncattr>
          <name>st</name>
        </syncattr>
        <syncattr>
          <name>l</name>
        </syncattr>
        <syncattr>
          <name>street</name>
        </syncattr>
      </object>
-->
    </data>
    <master>
      <containerdn>ou=Master</containerdn>
      <data>LDAP</data>
    </master>
  </sync>
  <data name="LDAP">
    <container>
      <oc>organizationalUnit</oc>
      <rdn>ou=LDAP</rdn>
    </container>
    <handler name="Rewrite">
      <libload>LISM/Utils/lism_util.pl</libload>
      <libload>LISM/Utils/secioss_util.pl</libload>
      <rewritemap name="dn2oupath" type="function"/>
      <rewritemap name="getADStatus" type="function"/>
      <rewritemap name="getValue" type="function"/>
      <rewritemap name="getparent" type="lism" attrs="ou=Master,o=secioss?dn,memberOf,cn"/>
      <rewritemap name="getuid" type="lism" attrs="ou=Master,o=secioss?cn,uid"/>
      <rewritemap name="getid" type="lism" attrs="ou=Master,o=secioss?sAMAccountName"/>
      <rewritemap name="getmail" type="lism" attrs="ou=Master,o=secioss?mail"/>
      <rewrite context="request" filter="(objectClass=user)" match="^uid(=|: )([^,]+)" substitution="cn%1%2"/>
      <rewrite context="request" match="ou=(People|Organizations),ou=(LDAP|Master)," substitution="ou=%2,"/>
      <rewrite context="request" match="(?!ou=[^,]+,)ou=Groups" substitution="ou=Organizations,ou=Groups"/>
      <rewrite context="request" match="ou=SecurityGroups" substitution="ou=Security,ou=Groups"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="^(distinguishedName: |)cn(=|: )([^,]+)" substitution="%1uid%2%3"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="(uid=.*),ou=(LDAP|Master)," substitution="%1,ou=People,ou=%2,"/>
      <rewrite context="searchResult" dn="ou=(?!Groups|Contacts|Roles)[^,]+,ou=(LDAP|Master)," filter="(objectClass=organizationalUnit)" match="ou=(LDAP|Master)," substitution="ou=Organizations,ou=%1,"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="distinguishedName: (.+)" substitution="ou: %{dn2oupath('%1', 'ou=People,', 1)}"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="userAccountControl: (.+)" substitution="seciossAccountStatus: %{getADStatus('%1', 'active', 'inactive')}"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="memberOf: cn=([^,]+),ou=Services,.*" substitution="seciossAllowedService: %1"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="memberOf: cn=([^,]+),ou=Functions,.*" substitution="seciossAllowedFunction: %1"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="memberOf: cn=admin,ou=Roles,.*" substitution="seciossSystemRole: cn=tenant_admin,ou=roles,o=lism\nseciossAllowedService: seciossadmin"/>
      <rewrite context="searchResult" filter="(objectClass=user)" match="memberOf: cn=([^,]+),ou=([^,]+),ou=([^,]+),ou=Roles,.*" substitution="seciossSystemRole: cn=%1,cn=%2,ou=Roles,o=TENANTID,ou=%3,o=lism"/>
      <rewrite context="searchResult" dn=",ou=(Organizations|Security),ou=Groups," match="objectClass: group" substitution="objectClass: seciossIamAccount\nobjectClass: seciossGroup"/>
      <rewrite context="searchResult" dn=",ou=Organizations,ou=Groups," match="cn: (.+)" substitution="cn: %1\ndisplayName: %1"/>
      <rewrite context="searchResult" dn=",ou=Organizations,ou=Groups," match="^cn(=|: )([^,]+)" substitution="cn%1%{getValue('%0', 'sAMAccountName')}"/>
<!-- Contact Synchronization
      <rewrite context="searchResult" dn=",ou=Organizations,ou=Groups," match="member: cn=([^,]+).*,ou=(LDAP|Master),.*" substitution="seciossMember: mail=%{getmail('(&amp;(objectClass=contact)(cn=%1))')},ou=Contacts,ou=%2,o=secioss"/>
-->
      <rewrite context="searchResult" dn=",ou=(Organizations|Security),ou=Groups," match="member: cn=([^,]+).*,ou=(LDAP|Master),.*" substitution="seciossMember: uid=%{getuid('(&amp;(objectClass=user)(&amp;(cn=%1)(memberOf=cn=idsync,ou=Roles,ou=Groups,ou=Master,o=secioss)))')},ou=People,ou=%2,o=secioss"/>
      <rewrite context="searchResult" dn=",ou=Organizations,ou=Groups," match="member: cn=([^,]+).*,ou=(LDAP|Master),.*" substitution="seciossMember: cn=%{getid('(&amp;(objectClass=group)(cn=%1))')},ou=Groups,ou=%2,o=secioss"/>
      <rewrite context="searchResult" dn=",ou=Security,ou=Groups," filter="(memberOf=*,ou=Security,ou=Groups,*)" match="^(cn=[^,]+),ou=Security,ou=Groups,.*$" substitution="%1,%{getValue('%0', 'memberOf')}"/>
      <rewrite context="searchResult" dn=",[^,]+,ou=Security,ou=Groups," match="^(cn=[^,]+),(cn=[^,]+),.*$" substitution="%1,%{getparent('(%2)')}"/>
      <rewrite context="searchResult" dn=",ou=Organizations,ou=Groups," match=",ou=Organizations,ou=Groups," substitution=",ou=Groups,"/>
      <rewrite context="searchResult" dn=",ou=Security,ou=Groups," match=",ou=Security,ou=Groups," substitution=",ou=SecurityGroups,"/>
      <rewrite context="searchResult" filter="(objectClass=contact)" match="cn=([^,]+).*,ou=(LDAP|Master)," substitution="mail=%{getValue('%0', 'mail')},ou=Contacts,ou=%2,"/>
      <rewrite context="searchResult" filter="(objectClass=contact)" match="objectClass: contact" substitution="objectClass: seciossPerson"/>
    </handler>
    <storage name="AD">
      <uri>ldap://localhost/ou=company,dc=example,dc=com</uri>
      <binddn>cn=Administrator,cn=users,ou=company,dc=example,dc=com</binddn>
      <bindpw>secret</bindpw>
      <defaultattrs>distinguishedName, l, st, postalCode, title, ou, streetAddress, co, department, company, homePhone, mobile, facsimileTelephoneNumber, telephoneNumber, dn, member, memberOf, objectClass, mail, cn, samAccountName, employeeNumber, sn, givenName, displayName, description, userAccountControl, msDS-PhoneticLastName, msDS-PhoneticFirstName</defaultattrs>
      <ldapmap type="attribute" local="userPassword" foreign="unicodePwd"/>
      <ldapmap type="attribute" local="sn;lang-ja;phonetic" foreign="msDS-PhoneticLastName"/>
      <ldapmap type="attribute" local="givenName;lang-ja;phonetic" foreign="msDS-PhoneticFirstName"/>
      <ldapmap type="attribute" local="seciossTelephoneNumber" foreign="telephoneNumber"/>
      <ldapmap type="attribute" local="seciossFax" foreign="facsimileTelephoneNumber"/>
      <ldapmap type="attribute" local="seciossMobile" foreign="mobile"/>
      <ldapmap type="attribute" local="seciossHomePhone" foreign="homePhone"/>
      <ldapmap type="attribute" local="seciossCompany" foreign="company"/>
      <ldapmap type="attribute" local="seciossDepartment" foreign="department"/>
      <ldapmap type="attribute" local="seciossCountry" foreign="co"/>
      <ldapmap type="attribute" local="street" foreign="streetAddress"/>
    </storage>
  </data>
  <data name="IDP">
    <container>
      <oc>organizationalUnit</oc>
      <rdn>ou=IDP</rdn>
    </container>
    <handler name="Setval">
      <libload>LISM/Utils/lism_util.pl</libload>
      <entry dn="uid=[^,]+,ou=People,">
        <default name="objectclass">
          <value type="constant">person</value>
          <value type="constant">inetOrgPerson</value>
          <value type="constant">seciossPerson</value>
          <value type="constant">seciossIamAccount</value>
        </default>
        <default name="cn">
          <value type="function">getValue($entryStr, 'sn').' '.getValue($entryStr, 'givenName')</value>
        </default>
        <default name="seciosslocalecode">
          <value type="constant">ja_JP</value>
        </default>
        <default name="preferredlanguage">
          <value type="constant">ja</value>
        </default>
        <default name="seciossaccountstatus">
          <value type="constant">active</value>
        </default>
        <default name="userpassword">
          <value type="function">randString(12, 'a..z', 'A..Z', '0..9')</value>
        </default>
        <default name="seciosspwdchangedtime">
          <value type="function">time2date()</value>
        </default>
        <default name="seciosspwdmustchange">
          <value type="constant">"TRUE"</value>
        </default>
      </entry>
      <entry dn=",ou=Organizations,">
        <default name="objectclass">
          <value type="constant">organizationalUnit</value>
        </default>
      </entry>
      <entry dn=",ou=(Groups|SecurityGroups),">
        <default name="objectclass">
          <value type="constant">posixGroup</value>
          <value type="constant">seciossIamAccount</value>
          <value type="constant">seciossGroup</value>
        </default>
      </entry>
      <entry dn=",ou=Contacts,">
        <default name="objectclass">
          <value type="constant">inetOrgPerson</value>
          <value type="constant">seciossPerson</value>
        </default>
      </entry>
    </handler>
    <handler name="Rewrite">
      <rewritemap name="getdn" type="lism" attrs="ou=Master,o=secioss?dn"/>
      <rewrite context="request" match="^uid(=|: )([^,\)]+)" substitution="uid%1%2@TENANTID"/>
      <rewrite context="searchResult" dn="uid=[^,]+,ou=People," match="seciossSystemRole: cn=tenant_admin,.*" substitution="seciossSystemRole: cn=tenant_admin,ou=roles,o=lism"/>
      <rewrite context="searchResult" dn="uid=[^,]+,ou=People," match="seciossSystemRole: (cn=[^,]+,cn=[^,]+,ou=Roles,o=[^,]+,ou=[^,]+),ou=Master" substitution="seciossSystemRole: %1"/>
      <rewrite context="request" dn=",ou=(Groups|SecurityGroups)," match="^seciossMember: uid=([^,]+)" substitution="seciossMember: uid=%1@TENANTID"/>
      <rewrite context="searchResult" dn="uid=[^,]+,ou=People," match="uid(=|: )([^@]+)@[^,]+" substitution="uid%1%2"/>
      <rewrite context="searchResult" dn=",ou=(Groups|SecurityGroups)," match="seciossMember: uid=([^@]+)@[^,]*" substitution="seciossMember: uid=%1"/>
    </handler>
    <storage name="SOAP">
      <uri>https://slink.secioss.com/SoapSIM</uri>
      <proxy>https://slink.secioss.com/cgi-bin/sim.cgi</proxy>
      <basedn>o=TENANTID,ou=Master,o=lism</basedn>
      <binddn>uid=ADMINID@TENANTID,ou=People,o=TENANTID,ou=Master,o=lism</binddn>
      <bindpw>ADMINPW</bindpw>
      <control>
        <vlv count="100"/>
      </control>
    </storage>
  </data>
</config>
