<?xml version="1.0" encoding="UTF-8"?>
<sdo:datagraph xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:config="http://www.ibm.com/websphere/wim/config" xmlns:sdo="commonj.sdo"
	xsi:schemaLocation="commonj.sdo datagraph.xsd ">
  <config:configurationProvider maxPagingResults="500" maxSearchResults="4500" maxTotalPagingResults="1000"
      pagedCacheTimeOut="900" pagingEntityObject="true" searchTimeOut="600000" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
	xsi:schemaLocation="http://www.ibm.com/websphere/wim/config wimconfig.xsd ">
    <config:dynamicModel xsdFileName="wimdatagraph.xsd"/>
    <config:supportedEntityTypes defaultParent="cn=users,dc=yourco,dc=com" name="PersonAccount">
      <config:rdnProperties>uid</config:rdnProperties>
    </config:supportedEntityTypes>
    <config:supportedEntityTypes defaultParent="cn=groups,dc=yourco,dc=com" name="Group">
      <config:rdnProperties>cn</config:rdnProperties>
    </config:supportedEntityTypes>
    <config:supportedEntityTypes defaultParent="cn=users,dc=yourco,dc=com" name="OrgContainer">
      <config:rdnProperties>o</config:rdnProperties>
      <config:rdnProperties>ou</config:rdnProperties>
      <config:rdnProperties>dc</config:rdnProperties>
      <config:rdnProperties>cn</config:rdnProperties>
    </config:supportedEntityTypes>
    <config:repositories xsi:type="config:LdapRepositoryType" id="LDAP1" supportPaging="true"
        supportSorting="false" ldapServerType="IDS51">
      <config:baseEntries name="cn=users,dc=yourco,dc=com"/>
      <config:baseEntries name="cn=groups,dc=yourco,dc=com"/>
      <config:ldapServerConfiguration>
        <config:ldapServers bindDN="CN=BINDDN" bindPassword="BIND_PASSWORD" sslEnabled="false">
          <config:connections host="HOST_NAME" port="389"/>
        </config:ldapServers>
      </config:ldapServerConfiguration>
      <config:ldapEntityTypes name="PersonAccount">
        <config:objectClasses>inetOrgPerson</config:objectClasses>
        <config:searchBases>cn=users,dc=yourco,dc=com</config:searchBases>
      </config:ldapEntityTypes>
      <config:ldapEntityTypes name="Group">
        <config:objectClasses>groupOfNames</config:objectClasses>
        <config:objectClassesForCreate>groupOfNames</config:objectClassesForCreate>
        <config:searchBases>cn=groups,dc=yourco,dc=com</config:searchBases>
      </config:ldapEntityTypes>
      <config:ldapEntityTypes name="OrgContainer">
        <config:rdnAttributes name="o" objectClass="organization"/>
        <config:rdnAttributes name="ou" objectClass="organizationalunit"/>
        <config:rdnAttributes name="dc" objectClass="domain"/>
        <config:rdnAttributes name="cn" objectClass="container"/>
        <config:objectClasses>organization</config:objectClasses>
        <config:objectClasses>organizationalUnit</config:objectClasses>
        <config:objectClasses>domain</config:objectClasses>
        <config:objectClasses>container</config:objectClasses>
      </config:ldapEntityTypes>
      <config:groupConfiguration>
        <config:memberAttributes dummyMember="uid=dummuy" name="member" objectClass="groupOfNames"/>
      </config:groupConfiguration>
      <config:attributeConfiguration>
        <config:attributes name="userPassword" propertyName="password"/>
        <config:attributes name="cn" propertyName="displayName">
          <config:entityTypes>Group</config:entityTypes>
        </config:attributes>
        <config:attributes name="cn" propertyName="cn">
          <config:entityTypes>Group</config:entityTypes>
        </config:attributes>
        <config:propertiesNotSupported name="homeAddress"/>
        <config:propertiesNotSupported name="businessAddress"/>
      </config:attributeConfiguration>
      <config:contextPool enabled="true" initPoolSize="1" maxPoolSize="10" poolTimeOut="0" prefPoolSize="5"/>
      <config:cacheConfiguration>
        <config:attributesCache cacheSize="4000" cacheTimeOut="1200"
            enabled="true"/>
        <config:searchResultsCache cacheSize="2000" cacheTimeOut="600" enabled="true"/>
      </config:cacheConfiguration>
    </config:repositories>
    <config:realmConfiguration defaultRealm="YourCo" >
    		<!-- realm definitions -->
      		<config:realms
      			name="YourCo"
      			securityUse="active"
    			delimiter="/">
					<config:participatingBaseEntries name="cn=users,dc=yourco,dc=com"/>
					<config:participatingBaseEntries name="cn=groups,dc=yourco,dc=com"/>
					<config:defaultParents entityTypeName="PersonAccount" parentUniqueName="cn=users,dc=yourco,dc=com"/>
			        <config:defaultParents entityTypeName="Group" parentUniqueName="cn=groups,dc=yourco,dc=com"/>
				    <config:defaultParents entityTypeName="OrgContainer" parentUniqueName="cn=users,dc=yourco,dc=com"/>
				    <config:uniqueUserIdMapping propertyForInput="uniqueName" propertyForOutput="uniqueName"/>
					<config:userSecurityNameMapping propertyForInput="principalName" propertyForOutput="externalName"/>
					<config:userDisplayNameMapping propertyForInput="principalName" propertyForOutput="principalName"/>
					<config:uniqueGroupIdMapping propertyForInput="uniqueName" propertyForOutput="uniqueName"/>
					<config:groupSecurityNameMapping propertyForInput="cn" propertyForOutput="externalName"/>
					<config:groupDisplayNameMapping propertyForInput="cn" propertyForOutput="cn"/>	
      		</config:realms> 
      	
  </config:realmConfiguration>
  
    <config:pluginManagerConfiguration>
      <config:topicSubscriberList>
      </config:topicSubscriberList>
      <config:topicRegistrationList>
			<config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.create">
				<config:preExit>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
				</config:preExit>
				<config:postExit>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
				</config:postExit>
			</config:topicEmitter>
			<config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.delete">
				<config:preExit>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
				</config:preExit>
				<config:postExit>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
				</config:postExit>
			</config:topicEmitter>
			<config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.login">
				<config:preExit>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
				</config:preExit>
				<config:postExit>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
				</config:postExit>
			</config:topicEmitter>
			<config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.search">
				<config:preExit>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
				</config:preExit>
				<config:postExit>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
				</config:postExit>
			</config:topicEmitter>
			<config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.update">
				<config:preExit>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
				</config:preExit>
				<config:postExit>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
				</config:postExit>
			</config:topicEmitter>
			<config:topicEmitter topicEmitterName="com.ibm.ws.wim.ProfileManager.get">
				<config:preExit>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
				</config:preExit>
				<config:postExit>
					<config:modificationSubscriberList>
					</config:modificationSubscriberList>
					<config:notificationSubscriberList>
					</config:notificationSubscriberList>
				</config:postExit>
			</config:topicEmitter>
      </config:topicRegistrationList>
    </config:pluginManagerConfiguration>
	<!-- Authorization settings -->
    <config:authorization
        isSecurityEnabled="true" useSystemJACCProvider="false" importPolicyFromFile="true"
        isAttributeGroupingEnabled="true" defaultAttributeGroup="default" 
        jaccPolicyClass="com.ibm.sec.authz.provider.CommonAuthzPolicy" 
        jaccRoleMappingClass="com.ibm.sec.authz.provider.CommonAuthzRoleMapping" 
        jaccPolicyConfigFactoryClass="com.ibm.sec.authz.provider.CommonAuthzPolicyConfigurationFactory" 
        jaccRoleMappingConfigFactoryClass="com.ibm.sec.authz.provider.CommonAuthzRoleMappingConfigurationFactory"
        jaccRoleToPermissionPolicyId="WIM Policy"
        jaccPrincipalToRolePolicyId="WIM Policy"
        jaccRoleToPermissionPolicyFileName="wim-policy.xml"
        jaccPrincipalToRolePolicyFileName="wim-rolemapping.xml">
        <config:attributeGroups>
            <config:groupName>general</config:groupName>
            <config:attributeNames>cn</config:attributeNames>
            <config:attributeNames>sn</config:attributeNames>
            <config:attributeNames>uid</config:attributeNames>
        </config:attributeGroups>
        <config:attributeGroups>
            <config:groupName>sensitive</config:groupName>
            <config:attributeNames>password</config:attributeNames>
        </config:attributeGroups>
        <config:attributeGroups>
            <config:groupName>unchecked</config:groupName>
            <config:attributeNames>identifier</config:attributeNames>
            <config:attributeNames>createTimestamp</config:attributeNames>
            <config:attributeNames>modifyTimestamp</config:attributeNames>
            <config:attributeNames>entitlementInfo</config:attributeNames>
        </config:attributeGroups>
    </config:authorization>

  </config:configurationProvider>
</sdo:datagraph>
