{
    // The array of connection factories which will be used by the Rest2LDAP
    // Servlet and authentication filter.
    "ldapConnectionFactories" : {
        // Unauthenticated connections used for performing bind requests.
        "bind" : {
            // Indicates whether LDAP connections should be secured using
            // SSL or StartTLS. Acceptable values are:
            //
            // "none"     - use plain LDAP connections (default)
            // "ssl"      - secure connection using LDAPS
            // "startTLS" - secure connection using LDAP+StartTLS
            //
            "connectionSecurity"       : "none",

            // Specifies the policy for trusting server certificates exchanged
            // during SSL/StartTLS negotiation. This setting and the following
            // trust policy settings will be ignored if there is no connection
            // security. Acceptable values are:
            //
            // "trustAll" - blindly trust all server certificates (default)
            // "jvm"      - only certificates signed by the authorities
            //              associated with the host JVM will be accepted
            // "file"     - use a file-based trust store for validating
            //              certificates. This option requires the following
            //              "fileBasedTrustManager*" settings to be configured.
            //
            "trustManager"             : "trustAll",

            // File based trust manager configuration (see above).
            "fileBasedTrustManagerType"     : "JKS",
            "fileBasedTrustManagerFile"     : "/path/to/truststore",
            "fileBasedTrustManagerPassword" : "password",

            // Re-usable pool of 24 connections per server.
            "connectionPoolSize"       : 24,

            // Check pooled connections are alive every 30 seconds with a 500ms
            // heart beat timeout.
            "heartBeatIntervalSeconds"    : 30,
            "heartBeatTimeoutMilliSeconds" : 500,

            // The preferred load-balancing pool.
            "primaryLDAPServers"       : [
                {
                    "hostname" : "localhost",
                    "port"     : 1389
                }
            ],
            // The fail-over load-balancing pool (optional).
            "secondaryLDAPServers"     : [
                // Empty.
            ]
        },

        // Authenticated connections which will be used for searches during
        // authentication and proxied operations (if enabled). This factory
        // will re-use the server "bind" configuration.
        "root" : {
            "inheritFrom"    : "bind",

            // Defines how authentication should be performed. Only "simple"
            // authentication is supported at the moment.
            // If the OAuth 2.0 authorization policy is configured below,
            // then the directory service must be configured
            // to allow the user configured here to perform proxied authorization.
            "authentication" : {
                "simple" : {
                    "bindDN"       : "cn=directory manager",
                    "bindPassword" : "password"
                }
            }
        }
    },

    "authorization": {
		// The authorization policies to use. Supported policies are "anonymous", "basic" and "oauth2".
        "policies": [ "basic" ],

        // Perform all operations using a pre-authorization connection. 
        "anonymous": {
            // Specify the connection factory to use to perform LDAP operations.
            // If missing, the "root" factory will be used.
            "ldapConnectionFactory": "root"
        },

		// Use HTTP Basic authentication's information to bind to the LDAP server.
		"basic": {
			// Indicates whether the filter should allow alternative authentication
			// and, if so, which HTTP headers it should obtain the username and
			// password from.
			"supportAltAuthentication"        : true,
			"altAuthenticationUsernameHeader" : "X-OpenIDM-Username",
			"altAuthenticationPasswordHeader" : "X-OpenIDM-Password",

			// Define which LDAP bind mechanism to use
			// Supported mechanisms are "simple", "sasl-plain", "search"
			"bind": "search",

			// Bind to the LDAP server using the DN built from the HTTP Basic's username
			"simple": {
				// Connection factory used to perform the bind operation.
				// If missing, "bind" factory will be used.
				"ldapConnectionFactory": "bind",

				// The Bind DN Template containing a single %s which will be replaced by the authenticating
				// user's name. (i.e: uid=%s,ou=People,dc=example,dc=com)
				// If missing, "%s" is used.
				"bindDNTemplate": "uid=%s,ou=People,dc=example,dc=com"
			},

			// Bind to the LDAP server using a SASL Plain request
			"sasl-plain": {
				// Connection factory used to perform the bind operation.
				// If missing, "bind" factory will be used.
			    "ldapConnectionFactory": "bind",

				// Authentication identity template containing a single %s which will be replaced by the authenticating
                // user's name. (i.e: u:%s)
				"authzIdTemplate": "u:%s"
			},
			
			// Bind to the LDAP server using the resulting DN of a search request. 
			"search": {
				// Connection factory used to perform the search operation.
				// If missing, "root" factory will be used.
				"searchLDAPConnectionFactory": "root",
				
				// Connection factory used to perform the bind operation.
				// If missing, "bind" factory will be used.
				"bindLDAPConnectionFactory": "bind",
			
                // The %s filter format parameters will be substituted with the client-provided username, 
                // using LDAP filter string character escaping.
                "baseDN"         : "ou=people,dc=example,dc=com",
                "scope"          : "sub", // Or "one".
                "filterTemplate" : "(&(uid=%s)(objectClass=inetOrgPerson))"
			}
			// TODO: support for HTTP sessions?
		},

        // Use OAuth2 authorization method. If used, LDAP requests will be performed with proxied authorization control.
        // This field is optional.
        "oauth2": {
			// Access tokens associated realm.
			// This attribute is optional and has a string syntax.
			"realm": "myrealm",

            // Defines the list of required scopes required to access the service.
            // This field is required and cannot be empty.
            "requiredScopes": [ "read", "write", "uid" ],

			// Specify the resolver to use to resolve OAuth2 access token.
			// This attribute is required and its value must be one of "openam", "rfc7662", "cts".
			// Note that the JSON object corresponding to this attribute value must be present
			// and well formed in the "oauth2" JSON attribute.
			"resolver": "openam",

            // The default authzIdTemplate demonstrates how an authorization DN may be constructed
			// from the "uid" field in the following example OAuth2 token introspection response:
            // {
            //     "token": "access_token_string",
            //     "uid" : "user.2",
			//     "userName" : [ "user.2" ]
            // }
			// This attribute is required and has a string syntax.
			// It must start with either 'dn:' or 'u:'.
			// Note: For the CTS resolver, the following placeholder "{userName/0}" must be part of the template string,
			//       e.g "authzIdTemplate": "dn:uid={userName/0},ou=People,dc=example,dc=com"
            "authzIdTemplate": "dn:uid={uid},ou=People,dc=example,dc=com",

            // Configures caching of access token introspection results.
            // This attribute is optional, if it is not present, no token caching will be performed.
            "accessTokenCache": {
                // Indicates whether the access token caching should be used.
                // This attribute is optional (default value is false) and must have a boolean syntax.
                "enabled": false,

                // Specifies the maximal caching duration for an access token.
                // Once this delay is over, token will be refreshed from an access token resolver (see "oauth2/resolver")
                // This attribute is optional, its default value is "5 minutes".
                // The duration syntax supports all human readable notations from day ("days", "day", "d")
                // to nanosecond ("nanoseconds", "nanosecond", "nanosec", "nanos", "nano", "ns")
                // Any negative or zero values are incorrect.
                "cacheExpiration": "5 minutes"
            },

            // The OpenAM access token resolver configuration.
            // This attribute must be present if the "oauth2/resolver" is equal to "openam".
            // If "oauth2/resolver" is set to another resolver, this attribute will be ignored.
            "openam": {
                // Defines the OpenAM endpoint URL where the request should be sent.
                // This attribute is required and must have a string syntax.
                "endpointURL": "http://openam.example.com:8080/openam/oauth2/tokeninfo"
            },

            // The RFC-7662 (see https://tools.ietf.org/html/rfc7662) access token resolver configuration.
            // This attribute must be present if the "oauth2/resolver" is equal to "rfc7662".
            // If "oauth2/resolver" is set to another resolver, this attribute will be ignored.
            "rfc7662": {
                // Defines the token introspection endpoint URL where the request should be sent.
                // This attribute is required and must have a string syntax.
                "endpointURL": "http:/example.com/introspect",

				// Token introspect endpoint requires authentication.
				// It should support HTTP basic authorization (a base64-encoded string of clientId:clientSecret)
				// These attributes are mandatory.
				"clientId": "client_id",
				"clientSecret": "client_secret"
            },

            // The CTS access token resolver.
            // This attribute must be present if the "oauth2/resolver" is equal to "cts".
            // If "oauth2/resolver" is set to another resolver, this attribute will be ignored.
			// Note: You can use {userName/0} in authzIdTemplate configuration to access
			//       user id from the default CTS access token content config.
            "cts": {
				// The connection factory to use to access CTS.
				// This value is only used in gateway mode.
				// This attribute must reference a connection factory defined in the "ldapConnectionFactories" section.
				// Default value: "root" (i.e the root connection factory will be used to access the CTS).
				"ldapConnectionFactory": "root",

                // The access token base DN.
                // This attribute is required and must have a string syntax.
                "baseDN": "ou=famrecords,ou=openam-session,ou=tokens,dc=example,dc=com"
            },

            // ONLY FOR TEST PURPOSE: A File based access token resolver
            // This attribute must be present if the "oauth2/resolver" is equal to "file".
            // If "oauth2/resolver" is set to another resolver, this attribute will be ignored.
            "file": {
                // Directory containing token files.
                // You can test the rest2ldap OAuth2 authorization support by providing some json token files under
                // the directory set in the configuration below.
                // File names must be equal to the token strings.
				// The file content must a JSON object with the following attributes:
				// 'scope', 'expireTime' and all the field(s) needed to resolve the authzIdTemplate.
                "folderPath": "/path/to/test/folder"
            }
        }
    },


	// The REST APIs and their LDAP attribute mappings.
	"mappings" : {
	    "/users" : {
			"baseDN"              : "ou=people,dc=example,dc=com",
			"readOnUpdatePolicy"  : "controls",
			"useSubtreeDelete"    : false,
			"usePermissiveModify" : true,
			"etagAttribute"       : "etag",
			"namingStrategy"      : {
			    "strategy"    : "clientDNNaming",
			    "dnAttribute" : "uid"
			},
			"additionalLDAPAttributes" : [
			    {
					"type" : "objectClass",
					"values" : [
					    "top",
					    "person",
					    "organizationalPerson",
				    	"inetOrgPerson"
					]
			    }
			],
			"attributes" : {
			    "schemas"     : { "constant" : [ "urn:scim:schemas:core:1.0" ] },
			    "_id"         : { "simple"   : { "ldapAttribute" : "uid", "isSingleValued" : true, "isRequired" : true, "writability" : "createOnly" } },
			    "_rev"        : { "simple"   : { "ldapAttribute" : "etag", "isSingleValued" : true, "writability" : "readOnly" } },
			    "userName"    : { "simple"   : { "ldapAttribute" : "mail", "isSingleValued" : true, "writability" : "readOnly" } },
			    "displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "isRequired" : true } },
			    "name"        : { "object"   : {
					"givenName"  : { "simple" : { "ldapAttribute" : "givenName", "isSingleValued" : true } },
					"familyName" : { "simple" : { "ldapAttribute" : "sn", "isSingleValued" : true, "isRequired" : true } }
			    } },
			    "manager"     : { "reference" : {
					"ldapAttribute" : "manager",
					"baseDN"        : "ou=people,dc=example,dc=com",
					"primaryKey"    : "uid",
					"mapper"         : { "object" : {
					    "_id"         : { "simple"   : { "ldapAttribute" : "uid", "isSingleValued" : true, "isRequired" : true } },
					    "displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "writability" : "readOnlyDiscardWrites" } }
					} }
			    } },
			    "groups"     : { "reference" : {
					"ldapAttribute" : "isMemberOf",
					"baseDN"        : "ou=groups,dc=example,dc=com",
					"writability"   : "readOnly",
					"primaryKey"    : "cn",
					"mapper"        : { "object" : {
					    "_id"         : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true } }
					} }
			    } },
			    "contactInformation" : { "object" : {
					"telephoneNumber" : { "simple" : { "ldapAttribute" : "telephoneNumber", "isSingleValued" : true } },
					"emailAddress"    : { "simple" : { "ldapAttribute" : "mail", "isSingleValued" : true } }
			    } },
			    "meta"        : { "object" : {
					"created"      : { "simple" : { "ldapAttribute" : "createTimestamp", "isSingleValued" : true, "writability" : "readOnly" } },
					"lastModified" : { "simple" : { "ldapAttribute" : "modifyTimestamp", "isSingleValued" : true, "writability" : "readOnly" } }
			    } }
			}
	    },
	    "/groups" : {
			"baseDN"              : "ou=groups,dc=example,dc=com",
			"readOnUpdatePolicy"  : "controls",
			"useSubtreeDelete"    : false,
			"usePermissiveModify" : true,
			"etagAttribute"       : "etag",
			"namingStrategy"      : {
				"strategy"    : "clientDNNaming",
				"dnAttribute" : "cn"
			},
			"additionalLDAPAttributes" : [
				{
					"type" : "objectClass",
					"values" : [
						"top",
						"groupOfUniqueNames"
					]
				}
			],
			"attributes" : {
				"schemas"     : { "constant" : [ "urn:scim:schemas:core:1.0" ] },
				"_id"         : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "isRequired" : true, "writability" : "createOnly" } },
				"_rev"        : { "simple"   : { "ldapAttribute" : "etag", "isSingleValued" : true, "writability" : "readOnly" } },
				"displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "isRequired" : true, "writability" : "readOnly" } },
				"members"    : { "reference" : {
					"ldapAttribute" : "uniqueMember",
					"baseDN"        : "dc=example,dc=com",
					"primaryKey"    : "uid",
					"mapper"        : { "object" : {
						"_id"         : { "simple"   : { "ldapAttribute" : "uid", "isSingleValued" : true, "isRequired" : true } },
						"displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "writability" : "readOnlyDiscardWrites" } }
					} }
				} },
				"meta"        : { "object" : {
					"created"      : { "simple" : { "ldapAttribute" : "createTimestamp", "isSingleValued" : true, "writability" : "readOnly" } },
					"lastModified" : { "simple" : { "ldapAttribute" : "modifyTimestamp", "isSingleValued" : true, "writability" : "readOnly" } }
				} }
			}
	    }
	}
}