{
    // The array of connection factories which will be used by the Rest2LDAP
    // Servlet and authentication filter.
    "ldapConnectionFactories" : {
        // Unauthenticated connections used for performing bind requests.
        "bind" : {
            // Indicates whether LDAP connections should be secured using
            // SSL or StartTLS. Acceptable values are:
            //
            // "none"     - use plain LDAP connections (default)
            // "ssl"      - secure connection using LDAPS
            // "startTLS" - secure connection using LDAP+StartTLS
            //
            "connectionSecurity"       : "none",

            // Specifies the policy for trusting server certificates exchanged
            // during SSL/StartTLS negotiation. This setting and the following
            // trust policy settings will be ignored if there is no connection
            // security. Acceptable values are:
            //
            // "trustAll" - blindly trust all server certificates (default)
            // "jvm"      - only certificates signed by the authorities
            //              associated with the host JVM will be accepted
            // "file"     - use a file-based trust store for validating
            //              certificates. This option requires the following
            //              "fileBasedTrustManager*" settings to be configured.
            //
            "trustManager"             : "trustAll",

            // File based trust manager configuration (see above).
            "fileBasedTrustManagerType"     : "JKS",
            "fileBasedTrustManagerFile"     : "/path/to/truststore",
            "fileBasedTrustManagerPassword" : "password",

            // Re-usable pool of 24 connections per server.
            "connectionPoolSize"       : 24,

            // Check pooled connections are alive every 30 seconds with a 500ms
            // heart beat timeout.
            "heartBeatIntervalSeconds"    : 30,
            "heartBeatTimeoutMilliSeconds" : 500,

            // The preferred load-balancing pool.
            "primaryLDAPServers"       : [
                {
                    "hostname" : "localhost",
                    "port"     : 1389
                }
            ],
            // The fail-over load-balancing pool (optional).
            "secondaryLDAPServers"     : [
                // Empty.
            ]
        },

        // Authenticated connections which will be used for searches during
        // authentication and proxied operations (if enabled). This factory
        // will re-use the server "default" configuration.
        "root" : {
            "inheritFrom"    : "bind",

            // Defines how authentication should be performed. Only "simple"
            // authentication is supported at the moment.
            "authentication" : {
                "simple" : {
                    "bindDN"       : "cn=directory manager",
                    "bindPassword" : "password"
                }
            }
        }
    },

    "authorization": { 
		// The authorization policies to use. Supported policies are "anonymous", "basic" and "oauth2".
        "policies": [ "basic" ],

        // Perform all operations using a pre-authorization connection. 
        "anonymous": {
            // Specify the connection factory to use to perform LDAP operations.
            // If missing, "root" factory will be used.
            "ldapConnectionFactory": "root"
        },

		// Use HTTP Basic authentication's information to bind to the LDAP server.
		"basic": {
			// Indicates whether the filter should allow alternative authentication
			// and, if so, which HTTP headers it should obtain the username and
			// password from.
			"supportAltAuthentication"        : true,
			"altAuthenticationUsernameHeader" : "X-OpenIDM-Username",
			"altAuthenticationPasswordHeader" : "X-OpenIDM-Password",

			// Define which LDAP bind mechanism to use
			// Supported mechanisms are "simple", "sasl-plain", "search"
			"bind": "search",

			// Bind to the LDAP server using the DN built from the HTTP Basic's username
			"simple": {
				// Connection factory used to perform the bind operation.
				// If missing, "bind" factory will be used.
				"ldapConnectionFactory": "bind",

				// The Bind DN Template containing a single %s which will be replaced by the authenticating
				// user's name. (i.e: uid=%s,ou=People,dc=example,dc=com)
				// If missing, "%s" is used.
				"bindDNTemplate": "uid=%s,ou=People,dc=example,dc=com"
			},

			// Bind to the LDAP server using a SASL Plain request
			"sasl-plain": {
				// Connection factory used to perform the bind operation.
				// If missing, "bind" factory will be used.
			    "ldapConnectionFactory": "bind",

				// Authentication identity template containing a single %s which will be replaced by the authenticating
                // user's name. (i.e: u:%s)
				"authcIdTemplate": "u:%s"
			},
			
			// Bind to the LDAP server using the resulting DN of a search request. 
			"search": {
				// Connection factory used to perform the search operation.
				// If missing, "root" factory will be used.
				"searchLDAPConnectionFactory": "root",
				
				// Connection factory used to perform the bind operation.
				// If missing, "bind" factory will be used.
				"bindLDAPConnectionFactory": "bind",
			
                // The %s filter format parameters will be substituted with the client-provided username, 
                // using LDAP filter string character escaping.
                "baseDN"         : "ou=people,dc=example,dc=com",
                "scope"          : "sub", // Or "one".
                "filterTemplate" : "(&(uid=%s)(objectClass=inetOrgPerson))"
			}
			// TODO: support for HTTP sessions?
		}
    },


	// The REST APIs and their LDAP attribute mappings.
	"mappings" : {
	    "/users" : {
			"baseDN"              : "ou=people,dc=example,dc=com",
			"readOnUpdatePolicy"  : "controls",
			"useSubtreeDelete"    : false,
			"usePermissiveModify" : true,
			"etagAttribute"       : "etag",
			"namingStrategy"      : {
			    "strategy"    : "clientDNNaming",
			    "dnAttribute" : "uid"
			},
			"additionalLDAPAttributes" : [
			    {
					"type" : "objectClass",
					"values" : [
					    "top",
					    "person",
					    "organizationalPerson",
				    	"inetOrgPerson"
					]
			    }
			],
			"attributes" : {
			    "schemas"     : { "constant" : [ "urn:scim:schemas:core:1.0" ] },
			    "_id"         : { "simple"   : { "ldapAttribute" : "uid", "isSingleValued" : true, "isRequired" : true, "writability" : "createOnly" } },
			    "_rev"        : { "simple"   : { "ldapAttribute" : "etag", "isSingleValued" : true, "writability" : "readOnly" } },
			    "userName"    : { "simple"   : { "ldapAttribute" : "mail", "isSingleValued" : true, "writability" : "readOnly" } },
			    "displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "isRequired" : true } },
			    "name"        : { "object"   : {
					"givenName"  : { "simple" : { "ldapAttribute" : "givenName", "isSingleValued" : true } },
					"familyName" : { "simple" : { "ldapAttribute" : "sn", "isSingleValued" : true, "isRequired" : true } }
			    } },
			    "manager"     : { "reference" : {
					"ldapAttribute" : "manager",
					"baseDN"        : "ou=people,dc=example,dc=com",
					"primaryKey"    : "uid",
					"mapper"         : { "object" : {
					    "_id"         : { "simple"   : { "ldapAttribute" : "uid", "isSingleValued" : true, "isRequired" : true } },
					    "displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "writability" : "readOnlyDiscardWrites" } }
					} }
			    } },
			    "groups"     : { "reference" : {
					"ldapAttribute" : "isMemberOf",
					"baseDN"        : "ou=groups,dc=example,dc=com",
					"writability"   : "readOnly",
					"primaryKey"    : "cn",
					"mapper"        : { "object" : {
					    "_id"         : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true } }
					} }
			    } },
			    "contactInformation" : { "object" : {
					"telephoneNumber" : { "simple" : { "ldapAttribute" : "telephoneNumber", "isSingleValued" : true } },
					"emailAddress"    : { "simple" : { "ldapAttribute" : "mail", "isSingleValued" : true } }
			    } },
			    "meta"        : { "object" : {
					"created"      : { "simple" : { "ldapAttribute" : "createTimestamp", "isSingleValued" : true, "writability" : "readOnly" } },
					"lastModified" : { "simple" : { "ldapAttribute" : "modifyTimestamp", "isSingleValued" : true, "writability" : "readOnly" } }
			    } }
			}
	    },
	    "/groups" : {
			"baseDN"              : "ou=groups,dc=example,dc=com",
			"readOnUpdatePolicy"  : "controls",
			"useSubtreeDelete"    : false,
			"usePermissiveModify" : true,
			"etagAttribute"       : "etag",
			"namingStrategy"      : {
				"strategy"    : "clientDNNaming",
				"dnAttribute" : "cn"
			},
			"additionalLDAPAttributes" : [
				{
					"type" : "objectClass",
					"values" : [
						"top",
						"groupOfUniqueNames"
					]
				}
			],
			"attributes" : {
				"schemas"     : { "constant" : [ "urn:scim:schemas:core:1.0" ] },
				"_id"         : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "isRequired" : true, "writability" : "createOnly" } },
				"_rev"        : { "simple"   : { "ldapAttribute" : "etag", "isSingleValued" : true, "writability" : "readOnly" } },
				"displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "isRequired" : true, "writability" : "readOnly" } },
				"members"    : { "reference" : {
					"ldapAttribute" : "uniqueMember",
					"baseDN"        : "dc=example,dc=com",
					"primaryKey"    : "uid",
					"mapper"        : { "object" : {
						"_id"         : { "simple"   : { "ldapAttribute" : "uid", "isSingleValued" : true, "isRequired" : true } },
						"displayName" : { "simple"   : { "ldapAttribute" : "cn", "isSingleValued" : true, "writability" : "readOnlyDiscardWrites" } }
					} }
				} },
				"meta"        : { "object" : {
					"created"      : { "simple" : { "ldapAttribute" : "createTimestamp", "isSingleValued" : true, "writability" : "readOnly" } },
					"lastModified" : { "simple" : { "ldapAttribute" : "modifyTimestamp", "isSingleValued" : true, "writability" : "readOnly" } }
				} }
			}
	    }
	}
}