<!--
  ~ Copyright (c) 2021, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
  ~
  ~ WSO2 Inc. licenses this file to you under the Apache License,
  ~ Version 2.0 (the "License"); you may not use this file except
  ~ in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~ http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing,
  ~ software distributed under the License is distributed on an
  ~ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
  ~ KIND, either express or implied.  See the License for the
  ~ specific language governing permissions and limitations
  ~ under the License.
  ~
  -->

<ClaimConfig>
    <Dialects>
        <Dialect dialectURI="http://wso2.org/claims">
            <Claim>
                <ClaimURI>http://wso2.org/claims/roles</ClaimURI>
                <DisplayName>Roles</DisplayName>
                <AttributeID>roles</AttributeID>
                <Description>Roles</Description>
                <SupportedByDefault/>
                <ReadOnly />
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/groups</ClaimURI>
                <DisplayName>Groups</DisplayName>
                <AttributeID>groups</AttributeID>
                <Description>Groups</Description>
                <SupportedByDefault />
                <ReadOnly />
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/role</ClaimURI>
                <DisplayName>Roles and groups</DisplayName>
                <AttributeID>role</AttributeID>
                <Description>Include both userstore groups and internal roles</Description>
                <ReadOnly />
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/identity/userSourceId</ClaimURI>
                <DisplayName>User Source ID</DisplayName>
                <!-- If user store based identity store is used, a proper mapped attribute
                in your user store must be configured for this. -->
                <AttributeID>userSourceId</AttributeID>
                <Description>Claim to represent the provisioned IDP ID of the user.</Description>
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/websiteurl</ClaimURI>
                <DisplayName>Website URL</DisplayName>
                <AttributeID>websiteUrl</AttributeID>
                <Description>Website URL</Description>
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/metadata.version</ClaimURI>
                <DisplayName>User Metadata - Version</DisplayName>
                <AttributeID>meta.version</AttributeID>
                <Description>User Account Metadata - Version</Description>
                <ReadOnly />
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/identity/enabledAuthenticators</ClaimURI>
                <DisplayName>Enabled Authenticators</DisplayName>
                <!-- If user store based identity store is used, a proper mapped attribute
                in your user store must be configured for this. -->
                <AttributeID>enabledAuthenticators</AttributeID>
                <Description>Claim to represent enabled second factor authenticators in My Account.</Description>
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/identity/backupCodeEnabled</ClaimURI>
                <DisplayName>Backup Code Enabled</DisplayName>
                <!-- If user store based identity store is used, a proper mapped attribute
                in your user store must be configured for this. -->
                <AttributeID>backupCodeEnabled</AttributeID>
                <Description>Claim to represent whether user has configured Backup Code authenticator</Description>
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/identity/backupCodes</ClaimURI>
                <DisplayName>Backup Codes</DisplayName>
                <!-- If user store based identity store is used, a proper mapped attribute
                in your user store must be configured for this. -->
                <AttributeID>backupCodes</AttributeID>
                <Description>Claim to store Backup Codes of the user</Description>
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/identity/failedBackupCodeAttempts</ClaimURI>
                <DisplayName>Failed Backup Code Attempts</DisplayName>
                <!-- If user store based identity store is used, a proper mapped attribute
                in your user store must be configured for this. -->
                <AttributeID>failedBackupCodeAttempts</AttributeID>
                <Description>Claim to store failed Backup Code Attempts</Description>
            </Claim>
            <Claim>
                <ClaimURI>http://wso2.org/claims/identity/totpEnabled</ClaimURI>
                <DisplayName>TOTP Enabled</DisplayName>
                <AttributeID>totpEnabled</AttributeID>
                <Description>Claim to represent whether user has configured TOTP Authenticator</Description>
            </Claim>
        </Dialect>
        <Dialect dialectURI="urn:ietf:params:scim:schemas:core:2.0:User">
            <Claim>
                <ClaimURI>urn:ietf:params:scim:schemas:core:2.0:User:roles.default</ClaimURI>
                <DisplayName>Roles</DisplayName>
                <AttributeID>roles</AttributeID>
                <Description>Roles</Description>
                <DisplayOrder>5</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/roles</MappedLocalClaim>
            </Claim>
        </Dialect>
        <Dialect dialectURI="http://wso2.org/oidc/claim">
            <Claim>
                <ClaimURI>username</ClaimURI>
                <DisplayName>Username</DisplayName>
                <AttributeID>uid</AttributeID>
                <Description>Username of the End-User</Description>
                <Required />
                <DisplayOrder>1</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/username</MappedLocalClaim>
            </Claim>
            <Claim>
                <ClaimURI>sub</ClaimURI>
                <DisplayName>Subject</DisplayName>
                <AttributeID>scimId</AttributeID>
                <Description>Identifier for the End-User at the Issuer</Description>
                <Required />
                <DisplayOrder>1</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/userid</MappedLocalClaim>
            </Claim>
            <Claim>
                <ClaimURI>groups</ClaimURI>
                <DisplayName>User Groups</DisplayName>
                <AttributeID>role</AttributeID>
                <Description>List of group names that have been assigned to the principal. This typically will require a mapping at the application container level to application deployment roles.</Description>
                <DisplayOrder>12</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/groups</MappedLocalClaim>
            </Claim>
            <Claim>
                <ClaimURI>roles</ClaimURI>
                <DisplayName>User Roles</DisplayName>
                <AttributeID>roles</AttributeID>
                <Description>List of role names that have been assigned to the principal. This typically will require a mapping at the application container level to application deployment roles.</Description>
                <DisplayOrder>13</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/roles</MappedLocalClaim>
            </Claim>
            <Claim>
                <ClaimURI>website</ClaimURI>
                <DisplayName>Website URL</DisplayName>
                <AttributeID>websiteUrl</AttributeID>
                <Description>URL of the End-User's Web page or blog. This Web page SHOULD contain information published by the End-User or an organization that the End-User is affiliated with.</Description>
                <DisplayOrder>10</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/websiteurl</MappedLocalClaim>
            </Claim>
        </Dialect>
        <Dialect dialectURI="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User">
            <Claim>
                <ClaimURI>urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:userSourceId</ClaimURI>
                <DisplayName>User Source ID</DisplayName>
                <AttributeID>userSourceId</AttributeID>
                <Description>User Provisioned IDP ID</Description>
                <Required />
                <DisplayOrder>1</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/identity/userSourceId</MappedLocalClaim>
            </Claim>
            <Claim>
                <ClaimURI>urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:backupCodeEnabled</ClaimURI>
                <DisplayName>Backup Code Enabled</DisplayName>
                <AttributeID>backupCodeEnable</AttributeID>
                <Description>Whether user has configured backup code authenticator or not.</Description>
                <Required />
                <DisplayOrder>1</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/identity/backupCodeEnabled</MappedLocalClaim>
            </Claim>
            <Claim>
                <ClaimURI>urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:failedBackupCodeAttempts</ClaimURI>
                <DisplayName>Failed Backup Code Attempts</DisplayName>
                <AttributeID>failedBackupCodeAttempts</AttributeID>
                <Description>Number of failed backup code attempts</Description>
                <Required />
                <DisplayOrder>1</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/identity/failedBackupCodeAttempts</MappedLocalClaim>
            </Claim>
            <Claim>
                <ClaimURI>urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:totpEnabled</ClaimURI>
                <DisplayName>TOTP Enabled</DisplayName>
                <AttributeID>totpEnabled</AttributeID>
                <Description>TOTP Authenticator Enabled</Description>
                <Required />
                <DisplayOrder>1</DisplayOrder>
                <SupportedByDefault />
                <MappedLocalClaim>http://wso2.org/claims/identity/totpEnabled</MappedLocalClaim>
            </Claim>
        </Dialect>
    </Dialects>
</ClaimConfig>
