# Copyright 2016 Internet2
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

#
# Subject configuration
#

# The subject properties uses Grouper Configuration Overlays (documented on wiki)
# By default the configuration is read from subject.base.properties
# (which should not be edited), and the subject.properties overlays
# the base settings.  See the subject.base.properties for the possible
# settings that can be applied to the subject.properties

# enter the location of the sources.xml.  Must start with classpath: or file:
# blank means dont use sources.xml, use subject.properties
# default is: classpath:sources.xml
# e.g. file:/dir1/dir2/sources.xml
subject.sources.xml.location = 


#########################################
## Configuration for source id: jdbc
## Source configName: jdbc
#########################################
subjectApi.source.jdbc.id = jdbc

# this is a friendly name for the source
subjectApi.source.jdbc.name = Rutgers Registry Source Adapter

# type is not used all that much.  Can have multiple types, comma separate.  Can be person, group, application
subjectApi.source.jdbc.types = person, group, application

# the adapter class implements the interface: edu.internet2.middleware.subject.Source
# adapter class must extend: edu.internet2.middleware.subject.provider.BaseSourceAdapter
# edu.internet2.middleware.grouper.subj.GrouperJdbcSourceAdapter2  :  if doing JDBC this should be used if possible.  All subject data in one table/view.
# edu.internet2.middleware.grouper.subj.GrouperJdbcSourceAdapter   :  oldest JDBC source.  Put freeform queries in here
# edu.internet2.middleware.grouper.subj.GrouperJndiSourceAdapter   :  used for LDAP
subjectApi.source.jdbc.adapterClass = edu.internet2.middleware.grouper.subj.GrouperJdbcSourceAdapter

subjectApi.source.jdbc.param.jdbcConnectionProvider.value = edu.internet2.middleware.grouper.subj.GrouperJdbcConnectionProvider

subjectApi.source.jdbc.param.emailAttributeName.value = email

# maximum number of results from a search, generally no need to get more than 1000
subjectApi.source.jdbc.param.maxResults.value = 1000

subjectApi.source.jdbc.param.maxPageSize.value = 100

# ldap attribute which is the subject id.  e.g. exampleEduRegID   Each subject has one and only one subject id.  Generally it is opaque and permanent.
subjectApi.source.jdbc.param.SubjectID_AttributeType.value = id

# attribute which is the subject name
subjectApi.source.jdbc.param.Name_AttributeType.value = name

# attribute which is the subject description
subjectApi.source.jdbc.param.Description_AttributeType.value = NAME

# This virtual attribute index 0 is accessible via: subject.getAttributeValue("searchAttribute0");
subjectApi.source.jdbc.param.subjectVirtualAttribute_0_searchAttribute0.value = ${subject.name},${subjectUtils.defaultIfBlank(subject.getAttributeValue('LFNAME'), "")},${subjectUtils.defaultIfBlank(subject.getAttributeValue('LOGINID'), "")},${subjectUtils.defaultIfBlank(subject.description, "")},${subjectUtils.defaultIfBlank(subject.getAttributeValue('EMAIL'), "")}

# the 1st sort attribute for lists on screen that are derived from member table (e.g. search for member in group)
# you can have up to 5 sort attributes 
subjectApi.source.jdbc.param.sortAttribute0.value = NAME

# the 2nd sort attribute for lists on screen that are derived from member table (e.g. search for member in group)
# you can have up to 5 sort attributes 
subjectApi.source.jdbc.param.sortAttribute1.value = LOGINID

# the 1st search attribute for lists on screen that are derived from member table (e.g. search for member in group)
# you can have up to 5 search attributes 
subjectApi.source.jdbc.param.searchAttribute0.value = searchAttribute0

subjectApi.source.jdbc.param.useInClauseForIdAndIdentifier.value = true

subjectApi.source.jdbc.param.identifierAttributes.value = LOGINID

# subject identifier to store in grouper's member table.  this is used to increase speed of loader and perhaps for provisioning
# you can have up to max 1 subject identifier
subjectApi.source.jdbc.param.subjectIdentifierAttribute0.value = LOGINID

#searchSubject: find a subject by ID.  ID is generally an opaque and permanent identifier, e.g. 12345678.
#  Each subject has one and only on ID.  Returns one result when searching for one ID.

# sql is the sql to search for the subject by id should use an {inclause}
subjectApi.source.jdbc.search.searchSubject.param.sql.value = select r.rcp_id as id , name_first|| ' '|| name_last as name,n.network_user_nm as loginid from person_rcp r ,network_user n where n.rcp_id=r.rcp_id and n.primary_ind='Y' and {inclause}

# inclause allows searching by subject for multiple ids or identifiers in one query, must have {inclause} in the sql query,
#    this will be subsituted to in clause with the following.  Should use a question mark ? for bind variable
subjectApi.source.jdbc.search.searchSubject.param.inclause.value = r.rcp_id||''= ?

#searchSubjectByIdentifier: find a subject by identifier.  Identifier is anything that uniquely
#  identifies the user, e.g. jsmith or jsmith@institution.edu.
#  Subjects can have multiple identifiers.  Note: it is nice to have if identifiers are unique
#  even across sources.  Returns one result when searching for one identifier.

# sql is the sql to search for the subject by identifier should use an {inclause}
subjectApi.source.jdbc.search.searchSubjectByIdentifier.param.sql.value = select r.rcp_id as id , name_first|| ' '|| name_last as name,n.network_user_nm as loginid from person_rcp r ,network_user n where n.rcp_id=r.rcp_id and n.primary_ind='Y' and   {inclause}

# inclause allows searching by subject for multiple ids or identifiers in one query, must have {inclause} in the sql query,
#    this will be subsituted to in clause with the following.  Should use a question mark ? for bind variable
subjectApi.source.jdbc.search.searchSubjectByIdentifier.param.inclause.value = n.network_user_nm=?

#   search: find subjects by free form search.  Returns multiple results.

# sql is the sql to search for the subject free-form search.  user question marks for bind variables
subjectApi.source.jdbc.search.search.param.sql.value = select r.rcp_id as id, name_first || ' ' || name_last as name, n.network_user_nm as loginid from person_rcp r, network_user n where n.rcp_id = r.rcp_id and n.primary_ind = 'Y' and lower(name_first|| ' '|| name_last)  like  concat('%',concat(lower(?),'%'))

# internal attributes are used by grouper only not exposed to code that uses subjects.  comma separated
subjectApi.source.jdbc.internalAttributes = searchAttribute0


#########################################
## Configuration for source id: ldap-servicedn
## Source configName: ldap_servicedn
#########################################
subjectApi.source.ldap_servicedn.id = ldap-servicedn

# this is a friendly name for the source
subjectApi.source.ldap_servicedn.name = Service Dns from LDAP

# type is not used all that much.  Can have multiple types, comma separate.  Can be person, group, application
subjectApi.source.ldap_servicedn.types = person, group, application

subjectApi.source.ldap_servicedn.param.ldapServerId.value=nonPersonLdap

# the adapter class implements the interface: edu.internet2.middleware.subject.Source
# adapter class must extend: edu.internet2.middleware.subject.provider.BaseSourceAdapter
# edu.internet2.middleware.grouper.subj.GrouperJdbcSourceAdapter2  :  if doing JDBC this should be used if possible.  All subject data in one table/view.
# edu.internet2.middleware.grouper.subj.GrouperJdbcSourceAdapter   :  oldest JDBC source.  Put freeform queries in here
# edu.internet2.middleware.grouper.subj.GrouperJndiSourceAdapter   :  used for LDAP
#  subjectApi.source.ldap_servicedn.adapterClass = edu.internet2.middleware.grouper.subj.GrouperJndiSourceAdapter
subjectApi.source.ldap_servicedn.adapterClass = edu.internet2.middleware.subject.provider.LdapSourceAdapterLegacy

# e.g. com.sun.jndi.ldap.LdapCtxFactory
subjectApi.source.ldap_servicedn.param.INITIAL_CONTEXT_FACTORY.value = com.sun.jndi.ldap.LdapCtxFactory

# e.g. ldap://localhost:389
subjectApi.source.ldap_servicedn.param.PROVIDER_URL.value = ldaps://test-ldap.rutgers.edu:636

# e.g. simple, none, sasl_mech
subjectApi.source.ldap_servicedn.param.SECURITY_AUTHENTICATION.value = simple

# e.g. cn=Manager,dc=example,dc=edu                                                            
subjectApi.source.ldap_servicedn.param.SECURITY_PRINCIPAL.value = uid=service-dn,ou=Special Users,dc=rutgers,dc=edu

# can be a password or a filename of the encrypted password
subjectApi.source.ldap_servicedn.param.SECURITY_CREDENTIALS.value = secret

# ldap attribute which is the subject id.  e.g. exampleEduRegID   Each subject has one and only one subject id.  Generally it is opaque and permanent.
subjectApi.source.ldap_servicedn.param.SubjectID_AttributeType.value = uid

# if the subject id should be changed to lower case after reading from datastore.  true or false
subjectApi.source.ldap_servicedn.param.SubjectID_formatToLowerCase.value = false

# attribute which is the subject name
subjectApi.source.ldap_servicedn.param.Name_AttributeType.value = cn

# attribute which is the subject description
subjectApi.source.ldap_servicedn.param.Description_AttributeType.value = ou

# This virtual attribute index 0 is accessible via: subject.getAttributeValue("searchAttribute0");
subjectApi.source.ldap_servicedn.param.subjectVirtualAttribute_0_searchAttribute0.value = ${subjectUtils.defaultIfBlank(subject.getAttributeValueOrCommaSeparated('uid'), "")},${subjectUtils.defaultIfBlank(subject.getAttributeValueOrCommaSeparated('cn'), "")},${subjectUtils.defaultIfBlank(subject.getAttributeValueOrCommaSeparated('exampleEduRegId'), "")}

# the 1st sort attribute for lists on screen that are derived from member table (e.g. search for member in group)
# you can have up to 5 sort attributes 
subjectApi.source.ldap_servicedn.param.sortAttribute0.value = cn

# the 1st search attribute for lists on screen that are derived from member table (e.g. search for member in group)
# you can have up to 5 search attributes 
subjectApi.source.ldap_servicedn.param.searchAttribute0.value = searchAttribute0

#searchSubject: find a subject by ID.  ID is generally an opaque and permanent identifier, e.g. 12345678.
#  Each subject has one and only on ID.  Returns one result when searching for one ID.

# sql is the sql to search for the subject by id.  %TERM% will be subsituted by the id searched for
subjectApi.source.ldap_servicedn.search.searchSubject.param.filter.value = (& (uid=%TERM%))

# Scope Values can be: OBJECT_SCOPE, ONELEVEL_SCOPE, SUBTREE_SCOPE
subjectApi.source.ldap_servicedn.search.searchSubject.param.scope.value = SUBTREE_SCOPE

# base dn to search in
subjectApi.source.ldap_servicedn.search.searchSubject.param.base.value = ou=Special Users,dc=rutgers,dc=edu

#searchSubjectByIdentifier: find a subject by identifier.  Identifier is anything that uniquely
#  identifies the user, e.g. jsmith or jsmith@institution.edu.
#  Subjects can have multiple identifiers.  Note: it is nice to have if identifiers are unique
#  even across sources.  Returns one result when searching for one identifier.

# sql is the sql to search for the subject by identifier.  %TERM% will be subsituted by the identifier searched for
subjectApi.source.ldap_servicedn.search.searchSubjectByIdentifier.param.filter.value = (& (uid=%TERM%))

# Scope Values can be: OBJECT_SCOPE, ONELEVEL_SCOPE, SUBTREE_SCOPE
subjectApi.source.ldap_servicedn.search.searchSubjectByIdentifier.param.scope.value = SUBTREE_SCOPE

# base dn to search in
subjectApi.source.ldap_servicedn.search.searchSubjectByIdentifier.param.base.value = ou=Special Users,dc=rutgers,dc=edu

#   search: find subjects by free form search.  Returns multiple results.

# sql is the sql to search for the subject by free form search.  %TERM% will be subsituted by the text searched for
subjectApi.source.ldap_servicedn.search.search.param.filter.value = (& (|(|(uid=%TERM%)(cn=*%TERM%*))))

# Scope Values can be: OBJECT_SCOPE, ONELEVEL_SCOPE, SUBTREE_SCOPE
subjectApi.source.ldap_servicedn.search.search.param.scope.value = SUBTREE_SCOPE

# base dn to search in
subjectApi.source.ldap_servicedn.search.search.param.base.value = ou=Special Users,dc=rutgers,dc=edu

# attributes from ldap object to become subject attributes.  comma separated
subjectApi.source.ldap_servicedn.attributes = cn, sn, uid, ou

# internal attributes are used by grouper only not exposed to code that uses subjects.  comma separated
subjectApi.source.ldap_servicedn.internalAttributes = searchAttribute0

