#    Copyright 2013 Red Hat, Inc. and/or its affiliates.
#
#    This file is part of jcliff.
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.

name=security
getContents=/subsystem=security:read-resource(recursive=true)
client.preprocess.strip=/security

prefix.modify=modify:/
modify.rule.1=/subsystem=security${cmdpath(${path(..)})}:write-attribute(name=${name(.)},value=${value(.)})

prefix.remove=remove:/
remove.rule.1=/subsystem=security${cmdpath(${path(.)})}:remove
remove.refresh=true

prefix.undefine=undefine:/
undefine.rule.1=/subsystem=security${cmdpath(${path(..)})}:undefine-attribute(name=${name(.)})
undefine.refresh=true


match.addSecurityDomain=add:/security-domain/*
addSecurityDomain.precedence=50
addSecurityDomain.rule.1=/subsystem=security/security-domain=${name(.)}:add
addSecurityDomain.refresh=true

match.addAuth=add:/security-domain/*/authentication/*
addAuth.rule.1=/subsystem=security/security-domain=${name(../..)}/authentication=${name(.)}:add
addAuth.precedence=60
addAuth.refresh=true

match.addAudit=add:/security-domain/*/audit/*
addAudit.rule.1=/subsystem=security/security-domain=${name(../..)}/audit=${name(.)}:add
addAudit.precedence=70
addAudit.refresh=true

match.addAuditProvider=add:/security-domain/*/audit/*/provider-module/*
addAuditProvider.rule.1=/subsystem=security/security-domain=${name(../../../..)}/audit=${name(../..)}/provider-module=${name(.)}:add(code=${value(code)})
addAuditProvider.precedence=80
addAuditProvider.refresh=true

match.addJsse=add:/security-domain/*/jsse/*
addJsse.rule.1=/subsystem=security/security-domain=${name(../..)}/jsse=${name(.)}:add
addJsse.precedence=85
addJsse.refresh=true

match.addJsseKeyStore=add:/security-domain/*/jsse/*/keystore/*
addJsseKeyStore.rule.1=/subsystem=security/security-domain=${name(../../../..)}/jsse=${name(../..)}:write-attribute(name=keystore,value=${value(..)}

match.modifyJsseKeyStore=modify:/security-domain/*/jsse/*/keystore/*
modifyJsseKeyStore.rule.1=/subsystem=security/security-domain=${name(../../../..)}/jsse=${name(../..)}:write-attribute(name=keystore,value=${value(..)}

match.addJsseTrustStore=add:/security-domain/*/jsse/*/truststore/*
addJsseTrustStore.rule.1=/subsystem=security/security-domain=${name(../../../..)}/jsse=${name(../..)}:write-attribute(name=truststore,value=${value(..)}

match.modifyJsseTrustStore=modify:/security-domain/*/jsse/*/truststore/*
modifyJsseTrustStore.rule.1=/subsystem=security/security-domain=${name(../../../..)}/jsse=${name(../..)}:write-attribute(name=truststore,value=${value(..)}

match.addMapping=add:/security-domain/*/mapping/*
addMapping.rule.1=/subsystem=security/security-domain=${name(../..)}/mapping=${name(.)}:add
addMapping.precedence=90
addMapping.refresh=true

match.addMappingModule=add:/security-domain/*/mapping/*/mapping-module/*
addMappingModule.rule.1=/subsystem=security/security-domain=${name(../../../..)}/mapping=${name(../..)}/mapping-module=${name(.)}:add(code=${value(code)},type=${value(type)})
addMappingModule.precedence=100
addMappingModule.refresh=true

match.updateMappingModuleOptions=add:/security-domain/*/mapping/*/mapping-module/*/module-options/*
updateMappingModuleOptions.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/mapping=${name(../../../..)}/mapping-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)})
updateMappingModuleOptions.precedence=110
updateMappingModuleOptions.refresh=true

match.updateMappingModuleOptions2=remove:/security-domain/*/mapping/*/mapping-module/*/module-options/*
updateMappingModuleOptions2.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/mapping=${name(../../../..)}/mapping-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)})
updateMappingModuleOptions2.precedence=110
updateMappingModuleOptions2.refresh=true

match.updateMappingModuleOptions3=modify:/security-domain/*/mapping/*/mapping-module/*/module-options/*
updateMappingModuleOptions3.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/mapping=${name(../../../..)}/mapping-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)})
updateMappingModuleOptions3.precedence=110
updateMappingModuleOptions3.refresh=true


match.ignoreModifyLoginModules=modify:/security-domain/*/authentication/*/login-modules
match.ignoreAddLoginModules=add:/security-domain/*/authentication/*/login-modules/*
match.ignoreListAddLoginModules=listAdd:/security-domain/*/authentication/*/login-modules
match.ignoreListRemoveLoginModules=listRemove:/security-domain/*/authentication/*/login-modules
match.ignoreListAddLoginModulesAttr=listAdd:/security-domain/*/authentication/*/login-modules/*
match.ignoreListRemoveLoginModulesAttr=listRemove:/security-domain/*/authentication/*/login-modules/*

match.addLoginModule=add:/security-domain/*/authentication/*/login-module/*
addLoginModule.rule.1=/subsystem=security/security-domain=${name(../../../..)}/authentication=${name(../..)}/login-module=${name(.)}:add(code=${value(code)},flag=${value(flag)})
addLoginModule.precedence=70
addLoginMOdule.refresh=true


match.updateLoginModuleOptions=add:/security-domain/*/authentication/*/login-module/*/module-options/*
updateLoginModuleOptions.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/authentication=${name(../../../..)}/login-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)})
updateLoginModuleOptions.precedence=80
updateLoginModuleOptions.refresh=true

match.updateLoginModuleOptions2=remove:/security-domain/*/authentication/*/login-module/*/module-options/*
updateLoginModuleOptions2.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/authentication=${name(../../../..)}/login-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)})
updateLoginModuleOptions2.precedence=80
updateLoginModuleOptions2.refresh=true

match.updateLoginModuleOptions3=modify:/security-domain/*/authentication/*/login-module/*/module-options/*
updateLoginModuleOptions3.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/authentication=${name(../../../..)}/login-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)})
updateLoginModuleOptions3.precedence=80
updateLoginModuleOptions3.refresh=true


match.addLoginModuleStack=add:/security-domain/*/authentication/*/login-module-stack/*
addLoginModuleStack.rule.1=/subsystem=security/security-domain=${name(../../../..)}/authentication=${name(../..)}/login-module-stack=${name(.)}:add
addLoginModuleStack.refresh=true
addLoginModuleStack.precedence=200

match.removeLoginModuleStack=remove:/security-domain/*/authentication/*/login-module-stack/*
removeLoginModuleStack.rule.1=/subsystem=security/security-domain=${name(../../../..)}/authentication=${name(../..)}/login-module-stack=${name(.)}:remove
removeLoginModuleStack.rule.2=:reload
removeLoginModuleStack.refresh=true
removeLoginModuletack.precedence=200

match.addLoginModuleToStack=add:/security-domain/*/authentication/*/login-module-stack/*/login-module/*
addLoginModuleToStack.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/authentication=${name(../../../..)}/login-module-stack=${name(../..)}/login-module=${name(.)}:add(code=${value(code)},flag=${value(flag)})
addLoginModuleToStack.refresh=true
addLoginModuleToStack.precedence=250

match.removeLoginModuleFromStack=remove:/security-domain/*/authentication/*/login-module-stack/*/login-module/*
removeLoginModuleFromStack.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/authentication=${name(../../../..)}/login-module-stack=${name(../..)}/login-module=${name(.)}:remove
removeLoginModuleFromStack.refresh=true
removeLoginModuleFromStack.precedence=250

match.modifyLoginModuleToStack=modify:/security-domain/*/authentication/*/login-module-stack/*/login-module/*
modifyLoginModuleToStack.rule.1=/subsystem=security/security-domain=${name(../../../../../..)}/authentication=${name(../../../..)}/login-module-stack=${name(../..)}/login-module=${name(.)}:write-attribute(name=${name(.)},value=${value(.)})
modifyLoginModuleToStack.precedence=255

match.addLoginModuleStackProp=add:/security-domain/*/authentication/*/login-module-stack/*/login-module/*/module-options/*
addLoginModuleStackProp.rule.1=/subsystem=security/security-domain=${name(../../../../../../../..)}/authentication=${name(../../../../../..)}/login-module-stack=${name(../../../..)}/login-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)}
addLoginModuleStackProp.precedence=300

match.removeLoginModuleStackProp=remove:security-domain/*/authentication/*/login-module-stack/*/login-module/*/module-options/*
removeLoginModuleStackProp.rule.1=/subsystem=security/security-domain=${name(../../../../../../../..)}/authentication=${name(../../../../../..)}/login-module-stack=${name(../../../..)}/login-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)}
removeLoginModuleStackProp.precedence=300

match.modifyLoginModuleStackProp=modify:/security-domain/*/authentication/*/login-module-stack/*/login-module/*/module-options/*
modifyLoginModuleStackProp.rule.1=/subsystem=security/security-domain=${name(../../../../../../../..)}/authentication=${name(../../../../../..)}/login-module-stack=${name(../../../..)}/login-module=${name(../..)}:write-attribute(name=module-options,value=${value(..)}
modifyLoginModuleStackProp.precedence=300
