<commit_before><?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2016 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
 
<objects xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
         xmlns:c='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
         xmlns:org='http://midpoint.evolveum.com/xml/ns/public/common/org-3'>

	<role oid="08bd752e-1cf1-11e6-90a3-a3ad27be3da2">
		<name>System Administrator</name>
		<description>Permission to access the system with system administrator privileges. Non-requestable role. This role has to be explicitly assigned by IDM administrator.</description>
		<requestable>false</requestable>
		<roleType>operational</roleType>
	</role>

	<role oid="9ff31e4c-1cf3-11e6-bc5d-0727c08b96ed">
		<name>Contributor</name>
		<description>Contributor to Evolveum projects. Requestable role with an approver.</description>
		<inducement>
			<description>Automatically include write privileges to the wiki.</description>
			<targetRef oid="08bd752e-1cf1-11e6-90a3-a3ad27be3da2" type="RoleType" /> <!-- Wiki Contributor -->
		</inducement>
		<requestable>true</requestable>
		<approverRef oid="00000000-ee88-6666-0000-000000000002" type="UserType" /> <!-- semancik -->
		<roleType>business</roleType>
	</role>
	
	<role oid="a73b0386-1cf3-11e6-ac6e-dfedc87cdda3">
		<name>Blogger</name>
		<description>Author of Evolveum blog posts. Requestable role with an approver.</description>
		<requestable>true</requestable>
		<approverRef oid="00000000-ee88-6666-0000-000000000010" type="UserType" /> <!-- vera -->
		<roleType>business</roleType>
	</role>
	
	<role oid="ad1fd0ce-1cf3-11e6-8a68-fbf7c6fc2f97">
		<name>Wiki Contributor</name>
		<description>Write access to the wiki. This role is requestable, but it has no approver. Therefore anyone requesting it will get it automatically.</description>
		<requestable>true</requestable>
		<roleType>application</roleType>
	</role>
	
	<role oid="b613c706-3889-11e6-b175-d78cc67d7066">
		<name>Delegated Identity Administrator</name>
		<description>Allows full identity administration for organizations where the user is a manager.</description>
		<authorization>
	    	<name>gui-access</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#usersAll</action>
	        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgAll</action>
	    </authorization>
		<authorization>
	    	<name>autz-read</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
	    	<object>
	    		<orgRelation>
	    			<subjectRelation>org:manager</subjectRelation>
	    			<scope>allDescendants</scope>
	    			<includeReferenceOrg>true</includeReferenceOrg>
	    		</orgRelation>
	    	</object>
	    </authorization>
	    <authorization>
	    	<name>autz-write</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
	    	<object>
	    		<orgRelation>
	    			<subjectRelation>org:manager</subjectRelation>
	    		</orgRelation>
	    	</object>
	    </authorization>
	    <authorization>
	    	<name>autz-shadow</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
	    	<object>
	    		<type>ShadowType</type>
	    		<owner>
	    			<orgRelation>
		    			<subjectRelation>org:manager</subjectRelation>
		    		</orgRelation>
	    		</owner>
	    	</object>
	    </authorization>
		<roleType>application</roleType>
	</role>
	
</objects><commit_msg>Sample for weak identity administrator<commit_after><?xml version="1.0" encoding="UTF-8"?>
<!--
  ~ Copyright (c) 2016 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->
 
<objects xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
         xmlns:c='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
         xmlns:org='http://midpoint.evolveum.com/xml/ns/public/common/org-3'>

	<role oid="08bd752e-1cf1-11e6-90a3-a3ad27be3da2">
		<name>System Administrator</name>
		<description>Permission to access the system with system administrator privileges. Non-requestable role. This role has to be explicitly assigned by IDM administrator.</description>
		<requestable>false</requestable>
		<roleType>operational</roleType>
	</role>

	<role oid="9ff31e4c-1cf3-11e6-bc5d-0727c08b96ed">
		<name>Contributor</name>
		<description>Contributor to Evolveum projects. Requestable role with an approver.</description>
		<inducement>
			<description>Automatically include write privileges to the wiki.</description>
			<targetRef oid="08bd752e-1cf1-11e6-90a3-a3ad27be3da2" type="RoleType" /> <!-- Wiki Contributor -->
		</inducement>
		<requestable>true</requestable>
		<approverRef oid="00000000-ee88-6666-0000-000000000002" type="UserType" /> <!-- semancik -->
		<roleType>business</roleType>
	</role>
	
	<role oid="a73b0386-1cf3-11e6-ac6e-dfedc87cdda3">
		<name>Blogger</name>
		<description>Author of Evolveum blog posts. Requestable role with an approver.</description>
		<requestable>true</requestable>
		<approverRef oid="00000000-ee88-6666-0000-000000000010" type="UserType" /> <!-- vera -->
		<roleType>business</roleType>
	</role>
	
	<role oid="ad1fd0ce-1cf3-11e6-8a68-fbf7c6fc2f97">
		<name>Wiki Contributor</name>
		<description>Write access to the wiki. This role is requestable, but it has no approver. Therefore anyone requesting it will get it automatically.</description>
		<requestable>true</requestable>
		<roleType>application</roleType>
	</role>
	
	<role oid="b613c706-3889-11e6-b175-d78cc67d7066">
		<name>Delegated Identity Administrator</name>
		<description>Allows full identity administration for organizations where the user is a manager.</description>
		<authorization>
	    	<name>gui-access</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#usersAll</action>
	        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgAll</action>
	    </authorization>
		<authorization>
	    	<name>autz-read</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
	    	<object>
	    		<orgRelation>
	    			<subjectRelation>org:manager</subjectRelation>
	    			<scope>allDescendants</scope>
	    			<includeReferenceOrg>true</includeReferenceOrg>
	    		</orgRelation>
	    	</object>
	    </authorization>
	    <authorization>
	    	<name>autz-write</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
	    	<object>
	    		<orgRelation>
	    			<subjectRelation>org:manager</subjectRelation>
	    		</orgRelation>
	    	</object>
	    </authorization>
	    <authorization>
	    	<name>autz-shadow</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#add</action>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#delete</action>
	    	<object>
	    		<type>ShadowType</type>
	    		<owner>
	    			<orgRelation>
		    			<subjectRelation>org:manager</subjectRelation>
		    		</orgRelation>
	    		</owner>
	    	</object>
	    </authorization>
		<roleType>application</roleType>
	</role>
	
	<role oid="9ebe365e-baf7-11e6-bf9d-8b7318f64996">
		<name>Weak Identity Administrator</name>
		<description>Allows some identity administration.</description>
		<authorization>
	    	<name>gui-access</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#usersAll</action>
	        <action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-ui-3#orgAll</action>
	    </authorization>
		<authorization>
	    	<name>autz-read</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#read</action>
	    	<item>c:name</item>
	    	<item>fullName</item>
	    	<item>activation/administrativeStatus</item>
	    	<item>activation/effectiveStatus</item>
	    	<item>activation/validFrom</item>
	    	<item>activation/validTo</item>
	    	<item>assignment</item>
	    </authorization>
		<authorization>
	    	<name>modify some</name>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
	    	<object>
	    		<type>UserType</type>
	    	</object>
	    	<item>description</item>
	    	<item>activation/administrativeStatus</item>
	    	<item>activation/validFrom</item>
	    	<item>activation/validTo</item>
	    </authorization>
	    <authorization>
	    	<name>modify-some-operational-exec</name>
	    	<description>Required, these are operational properties that midPoint changes automatically</description>
	    	<action>http://midpoint.evolveum.com/xml/ns/public/security/authorization-model-3#modify</action>
	    	<phase>execution</phase>
	    	<object>
	    		<type>UserType</type>
	    	</object>
	    	<item>activation/validityStatus</item>
	    	<item>activation/validityChangeTimestamp</item>
	    	<item>activation/effectiveStatus</item>
	    	<item>activation/disableTimestamp</item>
	    	<item>activation/disableReason</item>
	    	<item>activation/enableTimestamp</item>
	    	<item>activation/archiveTimestamp</item>
	    	<item>activation/validityChangeTimestamp</item>
	    </authorization>
		<roleType>application</roleType>
	</role>
	
</objects>
{'fraction_non_alphanumeric': 0.13982378854625552, 'fraction_numerical': 0.03594713656387665, 'mean_word_length': 3.8199575371549894, 'pattern_counts': {'":': 0, '<': 335, '<?xml version=': 2, '>': 335, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 39}, 'pii_count': 0, 'substrings_counts': 8, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6407610', 'n_tokens_mistral': 4265, 'n_tokens_neox': 3790, 'n_words': 589}