<!-- *********************************************************************** -->
<!-- Entitlement Configuration DTD                                           -->
<!-- Novell Inc.                                                             -->
<!-- 1800 South Novell Place                                                 -->
<!-- Provo, UT 84606-6194                                                    -->
<!-- Version=2.0.0                                                           -->
<!-- Copyright 2009 Novell, Inc.  All rights reserved                        -->
<!-- *********************************************************************** -->
<!--
	Entitlement configuration definition stored in the XmlData attribute of a
	DirXML-Resource object.
-->

<!--Accepted source types for parameter -->
<!ENTITY % SOURCE_TYPE "read-attr | search-attr | src-dn | association | external | connection" >
<!--Acceptable filter types -->
<!ENTITY % FILTER_TYPE "include | exclude" >
<!--Acceptable sources for filer expression targets -->
<!ENTITY % FILTER_SOURCE "read-attr | src-dn | association" >
<!--Boolean states -->
<!ENTITY % Boolean "true | false" >
<!--Acceptable entitlement parameter formats -->
<!ENTITY % PARAM_FORMAT "legacy | idm4" >
<!--Acceptable resource mapping states when mapping authorizations to roles/resources with IDM4/RMA -->
<!ENTITY % RES_MPNG_STATE "add | pending" >
<!--Acceptable entitlement type names -->
<!ENTITY % ENT_TYPE_NAME "account | group | other" >

<!--Root element.
	
	entitlements			List of entitlements used in this driver configuration.
	connections				List of connections (Logical Systems for SAP) used in this driver configuration -->
<!ELEMENT entitlement-configuration ( 
	entitlements?,
	connections?)>

<!--modified				Date/Time the configuration file was modified 
	rbpm-time-out			RBPM configuration parameter
	rbpm-refresh-rate		RBPM configuration parameter
	min-driver-version		Minimum required shim version. This should only be used in conjunction
							with @driver-type to indicate to the UI agent which driver and version
							are expected for the configuration to work.
	driver-type				Minimum required shim version. This should only be used in conjunction
							with @min-driver-version to indicate to the UI agent which driver and 
							version	are expected for the configuration to work.	-->
<!ATTLIST entitlement-configuration
	modified				CDATA	#REQUIRED
	rbpm-time-out			CDATA	#IMPLIED
	rbpm-refresh-rate		CDATA	#IMPLIED
	min-driver-version		CDATA	#IMPLIED
	driver-type				CDATA	#IMPLIED
	> 

<!--List of entitlements used in this driver configuration.
	
	entitlement				Describes an entitlement -->
<!ELEMENT entitlements (  
	entitlement*)
	>

<!--Describes an entitlement
	
	type					Defines entitlement type and display lables
	parameters				List of parameters to build the nrfEntittlementRef parameter value
	filters					List of filters to include or exclude query results
	query-xml				Common query modifications that should be applied to all generated queires for this entitlement 
	member-assignment-query			Only applicable if the entitlement type name is “account”.
	member-assignment-extensions	Only applicable if the entitlement type name is “group”.
	query-extensions		Always applicable. Allows the predefined query to be extended.
	account					Only applicable if the entitlement type name is “account”. -->
<!ELEMENT entitlement (
	type?,
	parameters?,
    	filters?,
	query-xml?,
	member-assignment-query?,
	member-assignment-extensions?,
	query-extensions?,
	account?,
	native-value?
	)>

<!--name					The IDV name of the entitlement.
	dn						The LDAP DN of the entitlement object in the IDV
	role-mapping			Flag inditcating whether or not this entitlement should be included in the role mapping
	resource-mapping		Flag inditcating whether or not this entitlement should be included in the resource mapping
	resource-mapping-state	Indicating whether resource associations should be added effective immediately or pending approval
	-->
	<!ATTLIST entitlement 
	name					CDATA				#IMPLIED 
	dn						CDATA				#REQUIRED 
	role-mapping 			(%Boolean;)			"true" 
	resource-mapping 		(%Boolean;)			"true" 
	resource-mapping-state	(%RES_MPNG_STATE;)	"add" 
	parameter-format		(%PARAM_FORMAT;)	"idm4" 
	>
	
<!--Defines entitlement type and display lables
	
	display-name			List of display names for different languages of this entitlement
	sub-type				List of sub-types for the given entitlement For example a SAP role 
							may be a 'composite' or 'single' role -->
<!ELEMENT type (
	display-name?,
	sub-type?)
	>

<!--name					The name provides a non-localized identifier for the type. Typically 
							the name should resemble or be equal to the English display name of 
							type. Type names don't have to be unique per managed system. There can 
							be two or more entitlements with the same same type name defined for 
							the same managed system (driver).
	id						The ID (id) identifies a type uniquely per managed system. There cannot 
							be two entitlements with the same same type ID defined for the same 
							managed system (driver).
	category				The category helps grouping different entitlements with the same type 
							name into categories. E.g. Active Directory supports multiple different 
							types of groupings: local groups, security groups, and distributions 
							lists. All are of type name “group” but have different categories 
							“security grouping”, “security grouping”, and “other grouping”.-->
<!ATTLIST type
 	name					(%ENT_TYPE_NAME;)	"group"
 	id						CDATA				#REQUIRED
 	category				CDATA				#REQUIRED
 	>

<!--List of sub-types for the given entitlement For example a SAP role may be a 'composite' or 'single' role
	
	display-name			Sub-type values for a specific language	-->
<!ELEMENT sub-type (
	display-name*)>

<!--source-name				Attribute name for sub-type source attribute. Used only when source is 
							a read or search attr
	source					The source of the sub-type value -->
<!ATTLIST sub-type
	source-name				CDATA			#REQUIRED
	source					(%SOURCE_TYPE;) #REQUIRED
	>

<!--Declare the display names for various languages
	
	value					Value for a specific language -->	
<!ELEMENT display-name ( 	
	value*)>

<!--Value element. Can hold any value depending on context.	-->
<!ELEMENT value (
	#PCDATA)>	

<!--langCode				The two ISO language code (ie "en", "de") -->
<!ATTLIST value					
	langCode				CDATA	#REQUIRED
	> 

<!--List of parameters to build the nrfEntittlementRef parameter value
	
	parameter				Declares a component of the parameter value -->
<!ELEMENT parameters (
	parameter*)
	>

<!-- Declares a component of the parameter value -->
<!ELEMENT parameter (#PCDATA)>

<!--name					The name component of the parameter name/value pair
	mandatory				Flag indicating whether the parameter is mandatory
	source-name				Attribute name for source type
	source					Indicates where the data for the parameter value must be taken from -->
<!ATTLIST parameter					
	name					CDATA			#REQUIRED
	mandatory				(%Boolean;)		"true"
	source-name				CDATA			#IMPLIED
	source					(%SOURCE_TYPE;)	#REQUIRED
	> 

<!-- Declares a component of the native-value -->
<!ELEMENT native-value (#PCDATA)>

<!--
    source					Indicates where the data for the native-value must be taken from
    source-name				  	Attribute name for source type
-->
<!ATTLIST native-value					
	source					(%SOURCE_TYPE;)	#REQUIRED
    	source-name				CDATA			#IMPLIED
	>

<!--List of filters to include or exclude query results

	filter					Declares a filter to apply to the query results -->
<!ELEMENT filters (
	filter*)>

<!--type					The type of the filters: include or exclude -->
<!ATTLIST filters					
	type					(%FILTER_TYPE;)		"include"
	> 

<!--Declares a filter to apply to the query results -->
<!ELEMENT filter (#PCDATA)>

<!--regex					The regular expression to apply to the query result
	source-name				Attribute name for source type READ_ATTR
	source					The source of the value which the regEx should be applied -->
<!ATTLIST filter					
	regex					CDATA				#REQUIRED
	source-name 			CDATA				#REQUIRED
	source					(%FILTER_SOURCE;)	#REQUIRED
	>

<!--List of connections (Logical Systems for SAP) used in this driver configuration 

	connection				Declares a connection (logical system) -->
<!ELEMENT connections (
	connection*)
	>

<!--Declares a connection (logical system). This is only applicable for drivers supporting fanout.
	
	query-attr				XML attribute/value to add to the base entitlement query element
	query-xml				XML fragment to be added to the base query element
	query-instance			XML element indicating a separate entitlement query -->
<!ELEMENT connection (
	query-attr*,
	query-xml*,
	query-instance*)
	>

<!--name					The connection identifier --> 
<!ATTLIST connection					
	name					CDATA #REQUIRED
	> 

<!-- Xml attribute/value to add to the base entitlement query element -->					
<!ELEMENT query-attr (#PCDATA)>

<!--name					The name of the attribute to add to the entitlement query --> 
<!ATTLIST query-attr					
	name					CDATA #REQUIRED
	> 

<!-- XML fragment to be added to the base query element -->
<!ELEMENT query-xml			(ANY)>

<!--Only applicable if the entitlement type name is “account”.
	The IDM Data Collection Service (DCS) has the requirement to be able to obtain member 
	assignment information from managed and unmanaged accounts. Because member assignment 
	information can be bulky (groups and roles can potentially have many assigned members), 
	the query extensions to retrieve this information are optional and have to be added by 
	the querying agent on an as-needed basis.
	Member assignment information is available on both account and group entitlements but 
	it has to be retrieved slightly differently.
	For entitlement with type name "account" the content of the query-xml child node of
	the member-assignment-query node is expected to be a full query definition and replaces
	the potentially existing query defined in the entitlement XML. -->
<!ELEMENT member-assignment-query (
	query-attr*,
	query-xml*
	)>
	
<!--Only applicable if the entitlement type name is “group”.
	The IDM Data Collection Service (DCS) has the requirement to be able to obtain member 
	assignment information from managed and unmanaged accounts. Because member assignment 
	information can be bulky (groups and roles can potentially have many assigned members), 
	the query extensions to retrieve this information are optional and have to be added by 
	the querying agent on an as-needed basis.
	Member assignment information is available on both account and group entitlements but 
	it has to be retrieved slightly differently.
	For entitlement with type name "group" the content of the query-xml child node of
	the member-assignment-query node is expected to be extensions to the existing query 
	defined in the entitlement XML like e.g. search-attr or read-attr nodes. -->
<!ELEMENT member-assignment-extensions (
	query-attr*,
	query-xml*
	)>

<!--The IDM Data Collection Service (DCS) has the requirement to be able to obtain additional 
	information from the managed system than is defined on the base query and the extensions 
	for role and resource mapping. Therefore, the query extensions to retrieve this 
	information are optional and have to be added by the querying agent on an as-needed basis.
	Query extensions are supported on all entitlements.-->
<!ELEMENT query-extensions (
	query-attr*,
	query-xml*
	)>

<!-- Xml element indicating a separate entitlement query -->
<!ELEMENT query-instance (
	query-attr*, 
	query-xml*)>  

<!--langCode				The two character language code	-->
<!ATTLIST query-instance					
	langCode	CDATA #REQUIRED
	> 

<!--Only applicable if the entitlement type name is account.
	The purpose of this extension is to instruct the querying agent how to interpret the 
	results of a membership-assignment-query of an entitlement with type name account.
	The extensions are noted in a new account child node of the entitlement node in the 
	entitlements section. The account node groups the account extension instructions. The 
	account-id node informs the querying agent where an ID of the account in the managed 
	system can be obtained from. Multiple account-id nodes are allowed per account node. 
	The account-status node instructs the querying agent which attribute indicates the account 
	status (enabled/disabled) and what the syntax is. The attributes on the account-id and 
	account-status nodes work similar to the attributes on the parameter node.  -->
<!ELEMENT account (
	account-id+,
	account-status?
 	)>
 
<!--Instructs the querying agent how to retrieve account id information from the managed 
	system -->
<!ELEMENT account-id (ANY) >
 
<!--source-name				Attribute name for source type
 	source					Indicates where the data must be taken from -->
<!ATTLIST account-id 
 	source-name				CDATA			#IMPLIED
 	source					(%SOURCE_TYPE;)	#REQUIRED
 	>
 
<!--Instructs the querying agent how to retrieve active/inactive status information from the 
	managed system -->
<!ELEMENT account-status (ANY) >

 
<!--source-name				Attribute name for source type
	source					Indicates where the data must be taken from
	active					Defines the value indicating the account is active
	inactive				Defines the value indicating the account is inactive -->
<!ATTLIST account-status 
	source-name				CDATA			#IMPLIED
	source					(%SOURCE_TYPE;)	#REQUIRED
	active					CDATA			#REQUIRED
	inactive				CDATA			#REQUIRED
>