{
  // This file defines an example Rest2Ldap API mapping exposing users, POSIX users, and groups, as follows:
  //
  // /api/users/{uid} - users beneath ou=people,dc=example,dc=com, e.g. "/api/users/bjensen"
  // /api/groups/{cn} - groups beneath ou=groups,dc=example,dc=com, e.g. "/api/groups/administrators"
  //
  "version": "1.0",
  // This section defines all of the resources, their inheritance, and relationships.
  "resourceTypes": {
    // This resource represents the entry point into the user/group API. It only defines sub-resources and
    // does not have any properties itself. Template variables are permitted within the URL and DN templates.
    "example-v1": {
      "subResources": {
        "users": {
          "type": "collection",
          "dnTemplate": "ou=people,dc=example,dc=com",
          "resource": "frapi:opendj:rest2ldap:user:1.0",
          "namingStrategy": {
            "type": "clientDnNaming",
            "dnAttribute": "uid"
          }
        },
        "groups": {
          "type": "collection",
          "dnTemplate": "ou=groups,dc=example,dc=com",
          "resource": "frapi:opendj:rest2ldap:group:1.0",
          "namingStrategy": {
            "type": "clientDnNaming",
            "dnAttribute": "cn"
          }
        },
        // subentry-subresource
        // This subresource definition maps JSON resources under /api/subentries
        // to subentries under dc=example,dc=com.
        "subentries" : {
          "type": "collection",
          "dnTemplate": "dc=example,dc=com",
          "resource": "examples:subentry:1.0",
          "namingStrategy": {
            "type": "clientDnNaming",
            "dnAttribute": "cn"
          }
        }
        // subentry-subresource
      }
    },
    // This resource will act as the common parent of all resources that have a JSON representation.
    "frapi:opendj:rest2ldap:object:1.0": {
      "isAbstract": true,
      "objectClasses": [ "top" ],
      "properties": {
        // This property will store type information in a resource's JSON representation. It is the
        // equivalent of the "objectClass" attribute, except that it is single valued and will contain
        // the resource type name, e.g. "frapi:opendj:rest2ldap:user:1.0" or "frapi:opendj:rest2ldap:group:1.0".
        "_schema": {
          "type": "resourceType"
        },
        "_rev": {
          "type": "simple",
          "ldapAttribute": "etag",
          "writability": "readOnly"
        },
        "_meta": {
          "type": "object",
          "properties": {
            "created": {
              "type": "simple",
              "ldapAttribute": "createTimestamp",
              "writability": "readOnly"
            },
            "lastModified": {
              "type": "simple",
              "ldapAttribute": "modifyTimestamp",
              "writability": "readOnly"
            }
          }
        }
      }
    },
    // A "user" resource includes property mapping for the inetOrgPerson LDAP object class and is identified by
    // the "uid" LDAP attribute. Users have a single sub-type representing users with POSIX account information.
    "frapi:opendj:rest2ldap:user:1.0": {
      "superType": "frapi:opendj:rest2ldap:object:1.0",
      "objectClasses": [ "person", "organizationalPerson", "inetOrgPerson" ],
      "supportedActions": [ "modifyPassword", "resetPassword" ],
      "properties": {
        "_id": {
          "type": "simple",
          "ldapAttribute": "uid",
          "isRequired": true,
          "writability": "createOnly"
        },
        // user-pwp-fields
        // Administrators can read the current password policy.
        "pwdPolicy": {
          "type": "reference",
          "baseDn": "..,..",
          "ldapAttribute": "pwdPolicySubentry",
          "primaryKey": "cn",
          "searchFilter": "(&(objectclass=subentry)(objectclass=pwdPolicy))",
          "mapper": {
            "type": "object",
            "properties": {
              "_id": {
                "type": "simple",
                "ldapAttribute": "cn",
                "writability": "readOnlyDiscardWrites"
              }
            }
          }
        },
        // Administrators can set a new password policy.
        "newPwdPolicy": {
          "type": "reference",
          "baseDn": "..,..",
          "ldapAttribute": "ds-pwp-password-policy-dn",
          "primaryKey": "cn",
          "searchFilter": "(&(objectclass=subentry)(objectclass=pwdPolicy))",
          "mapper": {
            "type": "object",
            "properties": {
              "_id": {
                "type": "simple",
                "ldapAttribute": "cn",
                "isRequired": true
              }
            }
          }
        },
        // user-pwp-fields
        "userName": {
          "type": "simple",
          "ldapAttribute": "mail"
        },
        "displayName": {
          "type": "simple",
          "ldapAttribute": "cn",
          "isMultiValued": true,
          "isRequired": true
        },
        "name": {
          "type": "object",
          "properties": {
            "givenName": {
              "type": "simple"
            },
            "familyName": {
              "type": "simple",
              "ldapAttribute": "sn",
              "isRequired": true
            }
          }
        },
        "description": {
          "type": "simple"
        },
        "manager": {
          "type": "reference",
          "resourcePath": ".."
        },
        "reports": {
          "type": "reverseReference",
          "resourcePath": "..",
          "propertyName": "manager"
        },
        "groups": {
          "type": "reference",
          "resourcePath": "../../groups",
          "ldapAttribute": "isMemberOf",
          "isMultiValued": true,
          "writability": "readOnly"
        },
        "contactInformation": {
          "type": "object",
          "properties": {
            "telephoneNumber": {
              "type": "simple"
            },
            "emailAddress": {
              "type": "simple",
              "ldapAttribute": "mail"
            }
          }
        }
      }
    },
    // A user with POSIX account information.
    "frapi:opendj:rest2ldap:posixUser:1.0": {
      "superType": "frapi:opendj:rest2ldap:user:1.0",
      "objectClasses": [ "posixAccount" ],
      "properties": {
        "uidNumber": {
          "type": "simple",
          "isRequired": true
        },
        "gidNumber": {
          "type": "simple",
          "isRequired": true
        },
        "homeDirectory": {
          "type": "simple",
          "isRequired": true
        },
        "loginShell": {
          "type": "simple"
        },
        "gecos": {
          "type": "simple"
        }
      }
    },
    // A "group" resource includes property mapping for the inetOrgPerson LDAP object class and is identified by
    // the "uid" LDAP attribute. Users have a single sub-type representing users with POSIX account information.
    "frapi:opendj:rest2ldap:group:1.0": {
      "superType": "frapi:opendj:rest2ldap:object:1.0",
      "objectClasses": [ "groupOfUniqueNames" ],
      "properties": {
        "_id": {
          "type": "simple",
          "ldapAttribute": "cn",
          "isRequired": true,
          "writability": "createOnly"
        },
        "displayName": {
          "type": "simple",
          "ldapAttribute": "cn",
          "isRequired": true,
          "writability": "readOnly"
        },
        "description": {
          "type": "simple"
        },
        "members": {
          "type": "reference",
          "resourcePath": "../../users",
          "ldapAttribute": "uniqueMember",
          "isMultiValued": true
        }
      }
    },
    // subentry-types
    // A subentry resource maps to a subentry object.
    "examples:subentry:1.0": {
      "superType": "frapi:opendj:rest2ldap:object:1.0",
      "isAbstract": true,
      "objectClasses": [ "top", "subentry" ],
      "properties": {
        "_id": {
          "type": "simple",
          "ldapAttribute": "cn",
          "isRequired": true,
          "writability": "createOnly"
        },
        "subtreeSpecification": {
          "type": "simple"
        }
      }
    },
    // A passwordPolicy resource maps to a subentry password policy object.
    // This mapping uses the LDAP attribute names,
    // except for passwordValidator which maps to the validator in the configuration.
    "examples:passwordPolicy:1.0": {
      "superType": "examples:subentry:1.0",
      "objectClasses": [ "pwdPolicy", "pwdValidatorPolicy", "subentry" ],
      "properties": {
        "pwdAttribute": {
          "type": "simple",
          "isRequired": true
        },
        "pwdAllowUserChange": {
          "type": "simple"
        },
        "pwdCheckQuality": {
          "type": "simple"
        },
        "pwdExpireWarning": {
          "type": "simple"
        },
        "pwdFailureCountInterval": {
          "type": "simple"
        },
        "pwdGraceAuthNLimit": {
          "type": "simple"
        },
        "pwdInHistory": {
          "type": "simple"
        },
        "pwdLockout": {
          "type": "simple"
        },
        "pwdLockoutDuration": {
          "type": "simple"
        },
        "pwdMaxAge": {
          "type": "simple"
        },
        "pwdMaxFailure": {
          "type": "simple"
        },
        "pwdMinAge": {
          "type": "simple"
        },
        "pwdMinLength": {
          "type": "simple"
        },
        "pwdMustChange": {
          "type": "simple"
        },
        "pwdSafeModify": {
          "type": "simple"
        },
        "passwordValidator" : {
          "type": "reference",
          "baseDn": "cn=Password Validators,cn=config",
          "ldapAttribute": "ds-cfg-password-validator",
          "primaryKey": "cn",
          "isMultiValued": true,
          "mapper": {
            "type": "object",
            "properties": {
              "_id": {
                "type": "simple",
                "ldapAttribute": "cn",
                "isRequired": true
              }
            }
          }
        }
      }
      // subentry-types
    }
  }
}