#
# Grouper Configuration
# $Id: grouper.example.properties,v 1.48 2009-12-16 06:02:30 mchyzer Exp $
#

########################################
## General settings
########################################

# in cases where grouper is logging or emailing, it will use this to differentiate test vs dev vs prod
grouper.env.name = Health Grid Development

#######################################
## inititalization and configuration settings
#######################################

#if grouper should auto init the registry if not initted (i.e. insert the root stem, built in fields, etc)
#defaults to true
registry.autoinit = true

#if grouper should try and detect and log configuration errors on startup
#in general this should be true, unless the output is too annoying or if it is causing a problem
configuration.detect.errors = true

#if the startup message should display
configuration.display.startup.message = true

#if groups like the wheel group should be auto-created for convenience (note: check config needs to be on)
configuration.autocreate.system.groups = true

#auto-create groups (increment the integer index), and auto-populate with users 
#(comma separated subject ids) to bootstrap the registry on startup
#(note: check config needs to be on)
#configuration.autocreate.group.name.0 = etc:uiUsers
#configuration.autocreate.group.description.0 = users allowed to log in to the UI
#configuration.autocreate.group.subjects.0 = johnsmith

###################################
## security settings
###################################

# If set to _true_, the ALL subject will be granted that privilege on
# each new group that is created.  Note, you can override the default
# checkboxes on screen of UI in media.properties.
groups.create.grant.all.admin         = false
groups.create.grant.all.optin         = false
groups.create.grant.all.optout        = false
groups.create.grant.all.read          = true
groups.create.grant.all.update        = false
groups.create.grant.all.view          = true

# If set to _true_, the ALL subject will be granted that privilege on
# each new stem that is created.  
stems.create.grant.all.create         = false
stems.create.grant.all.stem           = false

# If set to _true_, the ALL subject will be granted that privilege on
# each new attributeDef that is created.  
attributeDefs.create.grant.all.attrAdmin         = false
attributeDefs.create.grant.all.attrOptin         = false
attributeDefs.create.grant.all.attrOptout        = false
attributeDefs.create.grant.all.attrRead          = false
attributeDefs.create.grant.all.attrUpdate        = false
attributeDefs.create.grant.all.attrView          = false



# A wheel group allows you to enable non-GrouperSystem subjects to act
# like a root user when interacting with the registry.
groups.wheel.use                      = true

# Set to the name of the group you want to treat as the wheel group.
# The members of this group will be treated as root-like users.
groups.wheel.group                    = etc:sysadmingroup

# To change the internal names for GrouperAll and GrouperSystem
# uncomment and change. Review UI nav.properties to ensure consistency
subject.internal.grouperall.name   = Everyone
subject.internal.groupersystem.name   = GrouperAdmin

#by default, anyone with admin rights on a group can edit the types or attributes
#specify types (related attributes will also be protected) which are wheel only, or restricted to a certain group
#security.types.typeName.wheelOnly = true
security.types.grouperLoader.wheelOnly = true
security.types.grouperGroupMembershipSettings.wheelOnly = true

#security.types.typeName.allowOnlyGroup = etc:someAdminGroup


# If this property is set, then to move a stem, in addition to having the appropriate stem privileges for the stem being moved and the destination stem,
# a user must also be a member of the defined group.  Note that users in the wheel group will have access regardless of this property.
#security.stem.groupAllowedToMoveStem = etc:someAdminGroup

# If this property is set, then to rename a stem, in addition to having the appropriate stem privilege for the stem being renamed,
# a user must also be a member of the defined group.  Note that users in the wheel group will have access regardless of this property.
#security.stem.groupAllowedToRenameStem = etc:someAdminGroup

# If this property is set, then to copy a stem, a user must be a member of the defined group.  Note that users in the wheel group will have access regardless of this property.
#security.stem.groupAllowedToCopyStem = etc:someAdminGroup


###################################
## whitelist (allow) and blacklist (deny) for db/ldap data or object deletes, without prompting the user to confirm
## if a listing is in the whitelist (allow), it will be allowed to delete db/ldap
## if a listing is in the blacklist (deny), it will be denied from deleting db/ldap
## multiple inputs can be entered with .0, .1, .2, etc.  These numbers must be sequential, starting with 0
###################################

db.change.allow.user.0=sa
db.change.allow.url.0=jdbc:hsqldb:hsql://localhost/grouper
db.change.allow.user.1=grouper1
db.change.allow.url.1=jdbc:mysql://localhost:3306/grouper1

db.change.deny.user.0=grouper2
db.change.deny.url.0=jdbc:mysql://localhost:3306/grouper2

# db.change.allow.user.2=uid=admin,ou=system
# db.change.allow.url.2=ldap://localhost:10389

###################################
## Grouper include / exclude and requireGroups
## If enabled, will make sure the Type is installed, and when that type is
## applied to a group, it will auto-create the other groups needed to manage the include and exclude lists
## see: https://bugs.internet2.edu/jira/browse/GRP-178
## the naming settings below are only used when the type is applied to a group, will not affect
## existing include/exclude groups
###################################

#if the addIncludeExclude and requireInGroups should be enabled, and if the type(s) should be 
#auto-created, and used to auto create groups to facilitate include and exclude lists, and require lists
grouperIncludeExclude.use = false
grouperIncludeExclude.requireGroups.use = false

#for requireGroups (groups that the members must be to be in the overall group).  name is the name of the attribute or type
#attributeOrType is either attribute for an attribute underneath the requireInGroups type, or type to be a top level type
#group is the group to be anded in.  note attributes are a global namespace, so you might want to use a naming convention,
#e.g. prefix with "require".  description is the tooltip.  add as many as you like.
#grouperIncludeExclude.requireGroup.name.0 = requireActiveEmployee
#grouperIncludeExclude.requireGroup.attributeOrType.0 = type
#grouperIncludeExclude.requireGroup.group.0 = school:community:activeEmployee
#grouperIncludeExclude.requireGroup.description.0 = If value is true, members of the overall group must be an active employee (in the school:community:activeEmployee group).  Otherwise, leave this value not filled in.

#grouperIncludeExclude.requireGroup.name.1 = requireActiveStudent
#grouperIncludeExclude.requireGroup.attributeOrType.1 = attribute
#grouperIncludeExclude.requireGroup.group.1 = school:community:activeStudent
#grouperIncludeExclude.requireGroup.description.1 = If value is true, members of the overall group must be an active student (in the school:community:activeStudent group).  Otherwise leave this value not filled in.


# set some names and tooltips
grouperIncludeExclude.type.name = addIncludeExclude
grouperIncludeExclude.tooltip = Select this type to auto-create other groups which facilitate having include and exclude list

grouperIncludeExclude.requireGroups.type.name = requireInGroups
grouperIncludeExclude.requireGroups.tooltip = Select this type to auto-create other groups which set up group math so that other groups can be required for membership (e.g. activeEmployee)

#leave grouperIncludeExclude.andGroups.attributeName blank if you dont want to use this attribute...  
#though if you were using it, it wont remove already configured groups
grouperIncludeExclude.requireGroups.attributeName = requireAlsoInGroups
grouperIncludeExclude.requireGroups.attribute.tooltip = Enter in comma separated group path(s).  An entity must be in these groups for it to be in the overall group.  e.g. stem1:stem2:group1, stem1:stem3:group2

#suffixes for various include/exclude groups (can use ${space} for space).
#note, these should uniquely identify various parts of the include/exclude.
#i.e. if the grouperIncludeExclude type is applied to a group with a suffix of the include suffix,
#the other groups will not be created...
grouperIncludeExclude.systemOfRecord.extension.suffix = _systemOfRecord
grouperIncludeExclude.include.extension.suffix = _includes
grouperIncludeExclude.exclude.extension.suffix = _excludes
grouperIncludeExclude.systemOfRecordAndIncludes.extension.suffix = _systemOfRecordAndIncludes
grouperIncludeExclude.includesMinusExcludes.extension.suffix = _includesMinusExcludes
#note, put a ${i} in there for where the 1 based index will go
grouperIncludeExclude.requireGroups.extension.suffix = _requireGroups${i}

#suffixes for various include/exclude groups (can use ${space} for space)
grouperIncludeExclude.systemOfRecord.displayExtension.suffix = ${space}system of record
grouperIncludeExclude.include.displayExtension.suffix = ${space}includes
grouperIncludeExclude.exclude.displayExtension.suffix = ${space}excludes
grouperIncludeExclude.systemOfRecordAndIncludes.displayExtension.suffix = ${space}system of record and includes
grouperIncludeExclude.includesMinusExcludes.displayExtension.suffix = ${space}includes minus excludes
#note, put a ${i} in there for where the 1 based index will go
grouperIncludeExclude.requireGroups.displayExtension.suffix = ${space}requireGroups ${i}

#can use ${extension} as the group extension, or ${displayExtension} for group display extension
grouperIncludeExclude.overall.description = Group containing list of ${displayExtension} after adding the includes and subtracting the excludes
grouperIncludeExclude.systemOfRecord.description = Group containing list of ${displayExtension} (generally straight from the system of record) without yet considering manual include or exclude lists
grouperIncludeExclude.include.description = Group containing manual list of includes for group ${displayExtension} which will be added to the system of record list (unless the subject is also in the excludes group)
grouperIncludeExclude.exclude.description = Group containing manual list of excludes for group ${displayExtension} which will not be in the overall group
grouperIncludeExclude.systemOfRecordAndIncludes.description = Internal utility group for group ${displayExtension} which facilitates the group math for the include and exclude lists
grouperIncludeExclude.includesMinusExclude.description = Internal utility group for group ${displayExtension} which facilitates includes, excludes, and required groups (e.g. activeEmployee)
#note, put a ${i} in there for where the 1 based index will go
grouperIncludeExclude.requireGroups.description = Internal utility group for group ${displayExtension} which facilitates required groups (e.g. activeEmployee)

###################################
## Hooks
## You can register multiple classes for one hook base class by comma separating the hooks implementations
## You can also register hooks at runtime with: 
## GrouperHookType.addHookManual("hooks.group.class", YourSchoolGroupHooks2.class);
###################################

#implement a group attribute hook by extending edu.internet2.middleware.grouper.hooks.AttributeHooks
#hooks.attribute.class=edu.yourSchool.it.YourSchoolGroupHooks,edu.yourSchool.it.YourSchoolGroupHooks2

#implement a group hook by extending edu.internet2.middleware.grouper.hooks.GroupHooks
#hooks.group.class=edu.yourSchool.it.YourSchoolGroupHooks,edu.yourSchool.it.YourSchoolGroupHooks2

#implement a grouper lifecycle hook by extending edu.internet2.middleware.grouper.hooks.LifecycleHooks
#hooks.lifecycle.class=edu.yourSchool.it.YourSchoolLifecycleHooks

#implement a membership hook by extending edu.internet2.middleware.grouper.hooks.MembershipHooks
#hooks.membership.class=edu.yourSchool.it.YourSchoolMembershipHooks

#implement a member hook by extending edu.internet2.middleware.grouper.hooks.MemberHooks
#hooks.member.class=edu.yourSchool.it.YourSchoolMemberHooks

#implement a stem hook by extending edu.internet2.middleware.grouper.hooks.StemHooks
#hooks.stem.class=edu.yourSchool.it.YourSchoolStemHooks

#implement a composite hook by extending edu.internet2.middleware.grouper.hooks.CompositeHooks
#hooks.composite.class=edu.yourSchool.it.YourSchoolCompositeHooks

#implement a field hook by extending edu.internet2.middleware.grouper.hooks.FieldHooks
#hooks.field.class=edu.yourSchool.it.YourSchoolFieldHooks

#implement a grouperSession hook by extending edu.internet2.middleware.grouper.hooks.GrouperSessionHooks
#hooks.grouperSession.class=edu.yourSchool.it.YourSchoolGrouperSessionHooks

#implement a groupType hook by extending edu.internet2.middleware.grouper.hooks.GroupTypeHooks
#hooks.groupType.class=edu.yourSchool.it.YourSchoolGroupTypeHooks

#implement a groupTypeTuple hook by extending edu.internet2.middleware.grouper.hooks.GroupTypeTupleHooks
#hooks.groupTypeTuple.class=edu.yourSchool.it.YourSchoolGroupTypeTupleHooks

#implement a loader hook by extending edu.internet2.middleware.grouper.hooks.LoaderHooks
#hooks.loader.class=edu.yourSchool.it.YourSchoolLoaderHooks

###################################
## Group attribute validation via regex
## You can attach a regex to an attribute name (including built ins)
## If none are registered, the built in hook will not be enabled
## The built ins are description, displayName, extension, displayExtension, name
## Configure a group.attribute.validator.attributeName.X for attribute name
## group.attribute.validator.regex.X for the regex
## group.attribute.validator.vetoMessage.X for the veto message (can contain the variable $attributeValue$ which will substitute)
## the X must be a sequential integer which groups the config entries together.
## do not repeat two config entries
###################################

#Attach a regex validator by attribute name
#group.attribute.validator.attributeName.0=extension
#group.attribute.validator.regex.0=^[a-zA-Z0-9]+$
#group.attribute.validator.vetoMessage.0=Group ID '$attributeValue$' is invalid since it must contain only alpha-numerics
#
#group.attribute.validator.attributeName.1=displayExtension
#group.attribute.validator.regex.1=^[a-zA-Z0-9 ]+$
#group.attribute.validator.vetoMessage.1=Group name '$attributeValue$' is invalid since it must contain only alpha-numerics or spaces

#####################################
## Audit settings
#####################################

# if set to true, then exceptions will be thrown if any actions are not audited... exceptions
# should not be thrown since everything should be audited, so this is a switch to make it absorb
# errors if there is a problem (will be logged instead if second param is true)
audit.requireAuditsForAllActions = false
audit.logAuditsForMissingActions = false

#####################################
## Change log settings
#####################################

# if we should insert records into grouper_change_log_temp when events happen
# defaults to true
changeLog.enabled = true


#####################################
## Settings to track last membership changes for groups and stems.
#####################################

# If true, when a membership is added to a group (either a privilege or a list member), 
# then an update will be made to the lastMembershipChange property for the group.
groups.updateLastMembershipTime = true

# If true, when a membership is added to a stem (this would be a naming privilege), 
# then an update will be made to the lastMembershipChange property for the stem.
stems.updateLastMembershipTime = true


#####################################
## Database structure data definition language (DDL) settings
#####################################
# ddlutils db name will be set by default, you can override it here, it must be one of:
# axion, cloudscape, db2, db2v8, derby, firebird, hsqldb, interbase, maxdb, mckoi, 
# mssql, mysql, mysql5, oracle, oracle10, oracle9, postgresql, sapdb, sybase, sybasease15, 
#
#ddlutils.dbname.override = oracle10

# if you want to not create the subject tables (grouper examples for unit testing), 
# then set this to true
ddlutils.exclude.subject.tables = false

# set the path where ddl scripts are generated (they will be uniquely named in this directory).
# if blank, the directory used will be the current directory
ddlutils.directory.for.scripts = ddlScripts

# during schema export, should it install grouper data also or not.  e.g. insert the root stem, default true
ddlutils.schemaexport.installGrouperData = true

# when grouper starts, should it shut down if not right version?
ddlutils.failIfNotRightVersion = true

# after you have converted id's, and are happy with the conversion of removing the uuid col, 
# this will remove the backup uuid cols when running the gsh command: gsh -registry -deep 
ddlutils.dropBackupUuidCols = false

# after you have converted field id foreign keys, and are happy with the conversion of removing the attribute name, 
# membership list name, and type cols, 
# this will remove the backup field name/type cols when running the gsh command: gsh -registry -deep  
ddlutils.dropBackupFieldNameTypeCols = false

# before the group name etc was moved to the grouper_groups table, the attributes table
# was backed up.  If it should not be backed up, or if the upgrade is done and works, then it can
# be removed, set to true, run: gsh -registry -deep 
ddlutils.dropAttributeBackupTableFromGroupUpgrade = false

# Since grouper_memberships no longer has effective memberships, that table doesn't need via_id,
# depth and parent_membership.  If they were converted, this will drop the backup of those cols with: gsh -registry -deep 
ddlutils.dropMembershipBackupColsFromOwnerViaUpgrade = false

# this is the schema ddlutils uses to query metadata with jdbc.  usually this can be omitted,
# and it defaults to your database loginid, however, in postgres, it can be different, so enter here
#ddlutils.schema = public

#if you are running a DB that supports them, but you dont want them, disable comments here (defaults to false)
ddlutils.disableComments = false

#set to true and we wont subsitute varchar 4000 for text in mysql (wont work in innodb utf-8 databases
ddlutils.dontSubstituteVarchar4000forTextMysql = false

#####################################
## mail settings (optional, e.g. for daily report form loader)
#####################################

#smtp server is a domain name or dns name, must be simple clear text stmp with no authentication
#mail.smtp.server = whatever.school.edu

#leave blank if unauthenticated
#mail.smtp.user = 

#leave blank if unauthenticated
#mail.smtp.pass = 

#this is the default email address where mail from grouper will come from
#mail.from.address = noreply@school.edu

#this is the subject prefix of emails, which will help differentiate prod vs test vs dev etc
#mail.subject.prefix = TEST:

#####################################
## misc settings which probably dont need to be changed
#####################################

dao.factory = edu.internet2.middleware.grouper.internal.dao.hib3.Hib3DAOFactory

# if tables that are hibernated should have optimistic locking or not (assumes the data layer supports this, hibernate does)
dao.optimisticLocking = true

# Use this interface implementation for access privileges
privileges.access.interface           = edu.internet2.middleware.grouper.GrouperAccessAdapter
# Use this interface implementation for naming privileges
privileges.naming.interface           = edu.internet2.middleware.grouper.GrouperNamingAdapter
# Use this interface implementation for attributeDef privileges
privileges.attributeDef.interface     = edu.internet2.middleware.grouper.privs.GrouperAttributeDefAdapter

# set the API as readonly (e.g. during upgrades).  Any updates will throw an exception
grouper.api.readonly = false

# When searching for memberships using the getMemberships WS (or underlying API call), limit the number of memberships
# which can be returned, else throws exception.  -1 means dont check.
ws.getMemberships.maxResultSize = 30000

# When searching for attribute assignments using the getAttributeAssignments WS (or underlying API call), limit the number of assignments
# which can be returned, else throws exception.  -1 means dont check.
ws.findAttrAssignments.maxResultSize = 30000

# When searching attribute def names, this is max size
findAllAttributeDefNames.maxResultSize = 30000

# create the type and attribuute for membership lite ui config by group
membershipUpdateLiteTypeAutoCreate = false

#####################################
## testing settings
#####################################

# if the ldappc tests should be included when running all tests (default false)
junit.test.ldappc = false

# if the loader tests should be included when running all tests (default true)
junit.test.loader = true

# if the ddl tests should be included when running all tests (default true)
junit.test.ddl = true

# if the gsh tests should be included when running all tests (default false)
junit.test.gsh = false

# if the stress tests should be included when running all tests (default false)
junit.test.stress = false

#####################################
## attribute framework
#####################################

# root stem in grouper where built in attributes are put
grouper.attribute.rootStem = etc:attribute

# if the attribute loader attributes should be autoconfigured (created, etc)
grouper.attribute.loader.autoconfigure = false


#####################################
## org management
#####################################

# if the orgs table(s) should be included in the DDL (includes the hierarchical table
orgs.includePocOrgsTablesInDdl = false

# loader connection of the database where orgs are (grouper means the grouper db in grouper.hibernate.properties)
orgs.databaseName = grouper

#table name of the org table (can prefix by schema name if you like)
orgs.orgTableName = grouperorgs_poc_orgs

#column names of this table
orgs.orgIdCol = id
orgs.orgNameCol = org_name
orgs.orgDisplayNameCol = org_display_name
orgs.orgParentIdCol = parent_id

#stem where the orgs are, e.g. poc:orgs
orgs.parentStemName = poc:orgs

#org config name
orgs.configGroupName = poc:orgs:orgsConfig


