---
# Configuration example for syncing from a typical MS AD domain controller
# the name 'ad-domain-example' is used for various parameters

udm:
    uri: "https://ucs-master.example.com/univention/udm/"
    user: "Administrator"
    password: "supersecret"
    ca_cert: "/etc/ssl/certs/ca-certificates.crt"
    skip_writes: false
    # FIX ME! Use more suitable attributes for storing primary keys
    user_ou: "ou=ad-domain-example"
    user_pkey_property: "univentionObjectIdentifier"
    group_ou: "ou=ad-domain-example"
    group_pkey_property: "univentionObjectIdentifier"

source:
    ldap_uri: "ldaps://dc1.ad-domain.example.com"
    bind_dn: "CN=Administrator,CN=Users,DC=ad-domain,DC=example,DC=com"
    bind_pw: "supersecret"
    ca_cert: "/etc/ssl/certs/ca-certificates.crt"
    timeout: 5
    search_pagesize: 500
    # search paramaters for groups
    group_base: "OU=UCS-Users,DC=ad-domain,DC=example,DC=com"
    group_scope: "sub"
    #group_filter: "(&(objectClass=group)(!(|(isCriticalSystemObject=TRUE)(cn=Domain *)(cn=* Controllers))))"
    # search paramaters for users
    user_base: "OU=UCS-Users,DC=ad-domain,DC=example,DC=com"
    user_scope: "sub"
    user_filter: "(&(objectClass=user)(sAMAccountType=805306368)(givenName=*)(sn=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))"
    user_attrs:
        - "objectGUID"
        - "sAMAccountName"
        - "givenName"
        - "description"
        - "sn"
        - "ou"
        - "o"
        - "street"
        - "l"
        - "postalCode"
        - "st"
        - "c"
        - "telephoneNumber"
        - "mobile"
        - "employeeNumber"
        - "employeeType"
        - "proxyAddresses"
    user_trans:
        # function sequences to sanitize input values
        sanitizer:
            objectGUID:
              - udm_directory_connector.sanitize:guid2uuid
            telephoneNumber:
              - udm_directory_connector.sanitize:phone_sanitizer
            mobile:
              - udm_directory_connector.sanitize:phone_sanitizer
            mobileTelephoneNumber:
              - udm_directory_connector.sanitize:phone_sanitizer
            homePhone:
              - udm_directory_connector.sanitize:phone_sanitizer
            homeTelephoneNumber:
              - udm_directory_connector.sanitize:phone_sanitizer
            facsimileTelephoneNumber:
              - udm_directory_connector.sanitize:phone_sanitizer
            fax:
              - udm_directory_connector.sanitize:phone_sanitizer
            mail:
              - udm_directory_connector.sanitize:mail_sanitizer
              - bytes.lower
            mailPrimaryAddress:
              - udm_directory_connector.sanitize:mail_sanitizer
              - bytes.lower
            mailLocalAddress:
              - udm_directory_connector.sanitize:mail_sanitizer
              - bytes.lower
            mailAlternativeAddress:
              - udm_directory_connector.sanitize:mail_sanitizer
              - bytes.lower
        # attributes to be renamed (dict-key is UDM property name)
        rename_attrs:
            # the primary key property <- attribute mapping
            univentionSourceIdentifier: "objectGUID"
            # the e-mail address for contact addressbooks (mailbox not managed by UCS)
            "e-mail": "mail"
            username: "sAMAccountName"
            firstname: "givenName"
            lastname: "sn"
            mobileTelephoneNumber: "mobile"
            organisation: "o"
            phone: "telephoneNumber"
            city: "l"
            country: "c"
            postcode: "postalCode"
        # attributes set to a fixed attribute value list no matter what
        # typically those are not mentioned in search_attrs
        #fixed_attrs:
        #    primaryGroup:
        #        - "cn=Domain Users,cn=groups,dc=ucs-4,dc=local"
        # single-valued(!) attributes which will be composed from other attributes no matter what
        # the 1st attr value of referenced attrs is used
        # composing stops at first completed variant (no KeyError)
        # Note: Composed attributes must not depend on each other!
        #compose_attrs:
        #    # the primary e-mail address for a mailbox managed by UCS (e.g. for OX)
        #    mailPrimaryAddress:
        #      - "{e-mail}"
        # List of attributes to be removed after compose pass
        remove_attrs:
            - "objectGUID"
            - "objectSid"
            - "proxyAddresses"
        # mapping defined per attribute type for deleting certain attribute values
        remove_values:
            telephoneNumber:
                - "+49"
                - "+49 ???"
                - "0"
        # mapping defined per attribute type for efficiently replacing certain attribute values
        replace_values:
            c:
                "Deutschland": "DE"
                "Bundesrepublik Deutschland": "DE"
                "Frankreich": "FR"
        # decompose attribute values into potentially multiple other attributes
        # by using name-based regex matching
        # first regex-match terminates processing!
        decompose_attrs:
            proxyAddresses:
                - "^SMTP:(?P<mail>.+)$"
                - "^smtp:(?P<mailAlternativeAddress>.+)$"

    group_trans:
        # attributes to be renamed
        rename_attrs:
            # the primary key property <- attribute mapping
            univentionSourceIdentifier: "objectGUID"
            name: "cn"
            users: "member"
        # List of attributes to be removed after compose pass
        remove_attrs:
            - "objectGUID"
            - "objectSid"
