<?xml version="1.0" encoding="UTF-8"?>
<sdo:datagraph xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:config="http://www.ibm.com/websphere/wim/config" xmlns:sdo="commonj.sdo"
	xsi:schemaLocation="commonj.sdo datagraph.xsd ">
  <config:configurationProvider maxPagingResults="500" maxSearchResults="4500" maxTotalPagingResults="1000"
      pagedCacheTimeOut="900" pagingEntityObject="true" searchTimeOut="600000" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
	xsi:schemaLocation="http://www.ibm.com/websphere/wim/config wimconfig.xsd ">
    <config:dynamicModel xsdFileName="wimdatagraph.xsd"/>
    <config:supportedEntityTypes defaultParent="cn=users,dc=yourco,dc=com" name="PersonAccount">
      <config:rdnProperties>cn</config:rdnProperties>
    </config:supportedEntityTypes>
    <config:supportedEntityTypes defaultParent="cn=groups,dc=yourco,dc=com" name="Group">
      <config:rdnProperties>cn</config:rdnProperties>
    </config:supportedEntityTypes>
    <config:supportedEntityTypes defaultParent="cn=users,dc=yourco,dc=com" name="OrgContainer">
      <config:rdnProperties>o</config:rdnProperties>
      <config:rdnProperties>ou</config:rdnProperties>
      <config:rdnProperties>dc</config:rdnProperties>
      <config:rdnProperties>cn</config:rdnProperties>
    </config:supportedEntityTypes>
    <config:repositories xsi:type="config:LdapRepositoryType" id="LDAP1" supportPaging="true"
        supportSorting="false" ldapServerType="AD2003">
      <config:baseEntries name="cn=users,dc=yourco,dc=com" nameInRepository="CN=People,DC=wim,DC=ibm,DC=com"/>
      <config:baseEntries name="cn=groups,dc=yourco,dc=com" nameInRepository="CN=Groups,DC=wim,DC=ibm,DC=com"/>
	  <config:loginProperties>uid</config:loginProperties>
      <config:ldapServerConfiguration>
        <config:ldapServers bindDN="CN=BINDDN" bindPassword="BIND_PASSWORD" sslEnabled="false">
          <config:connections host="HOST_NAME" port="389"/>
        </config:ldapServers>
      </config:ldapServerConfiguration>
      <config:ldapEntityTypes name="PersonAccount" searchFilter="(ObjectCategory=Person)">
        <config:objectClasses>user</config:objectClasses>
        <config:searchBases>CN=People,DC=wim,DC=ibm,DC=com</config:searchBases>
      </config:ldapEntityTypes>
      <config:ldapEntityTypes name="Group" searchFilter="(ObjectCategory=Group)">
        <config:objectClasses>group</config:objectClasses>
        <config:searchBases>CN=Groups,DC=wim,DC=ibm,DC=com</config:searchBases>
      </config:ldapEntityTypes>
      <config:ldapEntityTypes name="OrgContainer">
        <config:rdnAttributes name="o" objectClass="organization"/>
        <config:rdnAttributes name="ou" objectClass="organizationalunit"/>
        <config:rdnAttributes name="dc" objectClass="domain"/>
        <config:rdnAttributes name="cn" objectClass="container"/>
        <config:objectClasses>organization</config:objectClasses>
        <config:objectClasses>organizationalUnit</config:objectClasses>
        <config:objectClasses>domain</config:objectClasses>
        <config:objectClasses>container</config:objectClasses>
      </config:ldapEntityTypes>
      <config:groupConfiguration>
		<config:memberAttributes name="member" objectClass="group" scope="direct"/>
      </config:groupConfiguration>
      <config:attributeConfiguration>
        <config:attributes name="userAccountControl" defaultValue="544">
			<config:entityTypes>PersonAccount</config:entityTypes>
		</config:attributes>
        <config:attributes name="samAccountName" propertyName="uid">
			<config:entityTypes>PersonAccount</config:entityTypes>
		</config:attributes>
        <config:attributes name="samAccountName" defaultAttribute="cn">
			<config:entityTypes>Group</config:entityTypes>
		</config:attributes>
        <config:attributes name="groupType" defaultValue="8">
			<config:entityTypes>Group</config:entityTypes>
		</config:attributes>
        <config:attributes name="unicodePwd" propertyName="password" syntax="unicodePwd"/>
        <config:attributes name="cn" propertyName="displayName" >
	    	<config:entityTypes>Group</config:entityTypes>
        </config:attributes>
        <config:attributes name="cn" propertyName="cn" >
	    	<config:entityTypes>Group</config:entityTypes>
        </config:attributes>

		<config:propertiesNotSupported name="description"/>
		<config:propertiesNotSupported name="jpegPhoto"/>
		<config:propertiesNotSupported name="labeledURI"/>
		<config:propertiesNotSupported name="carLicense"/>
		<config:propertiesNotSupported name="pager"/>
		<config:propertiesNotSupported name="roomNumber"/>
		<config:propertiesNotSupported name="localityName"/>
		<config:propertiesNotSupported name="stateOrProvinceName"/>
		<config:propertiesNotSupported name="countryName"/>
		<config:propertiesNotSupported name="employeeNumber"/>
		<config:propertiesNotSupported name="employeeType"/>
		<config:propertiesNotSupported name="businessCategory"/>
		<config:propertiesNotSupported name="departmentNumber"/>
        <config:propertiesNotSupported name="homeAddress"/>
        <config:propertiesNotSupported name="businessAddress"/>
      </config:attributeConfiguration>
      <config:contextPool initPoolSize="1" maxPoolSize="10" poolTimeOut="0" prefPoolSize="5"/>
      <config:cacheConfiguration>
        <config:attributesCache cacheSize="4000" cacheTimeOut="1200"
            enabled="true"/>
        <config:searchResultsCache cacheSize="2000" cacheTimeOut="600" enabled="true"/>
      </config:cacheConfiguration>
    </config:repositories>
    <config:realmConfiguration defaultRealm="YourCo">
      		<config:realms
      			name="YourCo"
      			securityUse="active"
    			delimiter="/">
      				<config:participatingBaseEntries name="cn=users,dc=yourco,dc=com"/>
					<config:participatingBaseEntries name="cn=groups,dc=yourco,dc=com"/>
					<config:defaultParents entityTypeName="PersonAccount" parentUniqueName="cn=users,dc=yourco,dc=com"/>
			        <config:defaultParents entityTypeName="Group" parentUniqueName="cn=groups,dc=yourco,dc=com"/>
				    <config:defaultParents entityTypeName="OrgContainer" parentUniqueName="cn=users,dc=yourco,dc=com"/>
				    <config:uniqueUserIdMapping propertyForInput="uniqueName" propertyForOutput="uniqueName"/>
					<config:userSecurityNameMapping propertyForInput="principalName" propertyForOutput="externalName"/>
					<config:userDisplayNameMapping propertyForInput="principalName" propertyForOutput="principalName"/>
					<config:uniqueGroupIdMapping propertyForInput="uniqueName" propertyForOutput="uniqueName"/>
					<config:groupSecurityNameMapping propertyForInput="cn" propertyForOutput="externalName"/>
					<config:groupDisplayNameMapping propertyForInput="cn" propertyForOutput="cn"/>	
      		</config:realms> 
    </config:realmConfiguration>
    <config:pluginManagerConfiguration>
      <config:topicSubscriberList/>
      <config:topicRegistrationList>
        <config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.create">
          <config:preExit>
            <config:notificationSubscriberList/>
            <config:modificationSubscriberList/>
          </config:preExit>
          <config:postExit>
            <config:modificationSubscriberList/>
            <config:notificationSubscriberList/>
          </config:postExit>
        </config:topicEmitter>
        <config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.delete">
          <config:preExit>
            <config:notificationSubscriberList/>
            <config:modificationSubscriberList/>
          </config:preExit>
          <config:postExit>
            <config:modificationSubscriberList/>
            <config:notificationSubscriberList/>
          </config:postExit>
        </config:topicEmitter>
        <config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.login">
          <config:preExit>
            <config:notificationSubscriberList/>
            <config:modificationSubscriberList/>
          </config:preExit>
          <config:postExit>
            <config:modificationSubscriberList/>
            <config:notificationSubscriberList/>
          </config:postExit>
        </config:topicEmitter>
        <config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.search">
          <config:preExit>
            <config:notificationSubscriberList/>
            <config:modificationSubscriberList/>
          </config:preExit>
          <config:postExit>
            <config:modificationSubscriberList/>
            <config:notificationSubscriberList/>
          </config:postExit>
        </config:topicEmitter>
        <config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.update">
          <config:preExit>
            <config:notificationSubscriberList/>
            <config:modificationSubscriberList/>
          </config:preExit>
          <config:postExit>
            <config:modificationSubscriberList/>
            <config:notificationSubscriberList/>
          </config:postExit>
        </config:topicEmitter>
        <config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.get">
          <config:preExit>
            <config:notificationSubscriberList/>
            <config:modificationSubscriberList/>
          </config:preExit>
          <config:postExit>
            <config:modificationSubscriberList/>
            <config:notificationSubscriberList/>
          </config:postExit>
        </config:topicEmitter>
      </config:topicRegistrationList>
    </config:pluginManagerConfiguration>
    <config:authorization
        isSecurityEnabled="true" useSystemJACCProvider="false" importPolicyFromFile="true"
        isAttributeGroupingEnabled="true" defaultAttributeGroup="default" 
        jaccPolicyClass="com.ibm.sec.authz.provider.CommonAuthzPolicy" 
        jaccRoleMappingClass="com.ibm.sec.authz.provider.CommonAuthzRoleMapping" 
        jaccPolicyConfigFactoryClass="com.ibm.sec.authz.provider.CommonAuthzPolicyConfigurationFactory" 
        jaccRoleMappingConfigFactoryClass="com.ibm.sec.authz.provider.CommonAuthzRoleMappingConfigurationFactory"
        jaccRoleToPermissionPolicyId="WIM Policy"
        jaccPrincipalToRolePolicyId="WIM Policy"
        jaccRoleToPermissionPolicyFileName="wim-policy.xml"
        jaccPrincipalToRolePolicyFileName="wim-rolemapping.xml">
        <config:attributeGroups>
            <config:groupName>general</config:groupName>
            <config:attributeNames>cn</config:attributeNames>
            <config:attributeNames>sn</config:attributeNames>
            <config:attributeNames>uid</config:attributeNames>
        </config:attributeGroups>
        <config:attributeGroups>
            <config:groupName>sensitive</config:groupName>
            <config:attributeNames>password</config:attributeNames>
        </config:attributeGroups>
        <config:attributeGroups>
            <config:groupName>unchecked</config:groupName>
            <config:attributeNames>identifier</config:attributeNames>
            <config:attributeNames>createTimestamp</config:attributeNames>
            <config:attributeNames>modifyTimestamp</config:attributeNames>
            <config:attributeNames>entitlementInfo</config:attributeNames>
        </config:attributeGroups>
    </config:authorization>
  </config:configurationProvider>
</sdo:datagraph>
