<?xml version="1.0" encoding="utf-8"?>

<creole>
    <files>
        <file filelist='saslauthd-ldap' name='/etc/eole/apparmor.local.d/usr.sbin.slapd' source='apparmor_saslauthd_usr.sbin.slapd'/>
        <file filelist='saslauthd' name='/etc/saslauthd.conf'/>
        <file filelist='saslauthd' name='/etc/default/saslauthd' source='default_saslauthd' del_comment='#'/>
        <file filelist='saslauthd' name='/etc/eole/saslauthd.conf' source='eole_saslauthd.conf' rm='True'/>
        <file filelist='saslauthd-ldap' name='/etc/ldap/sasl2/slapd.conf' source='saslauth_slapd.conf'/>
        <service servicelist='saslauthd'>saslauthd</service>
    </files>
    <variables>
        <family name='services'>
            <variable name='saslauthd_needed' type='oui/non' description='Le service saslauthd est utilisé' hidden='True'/>
        </family>
        <family name='openldap'>
            <variable name='ldap_sasl_auth_delegation' type='oui/non' description='Utiliser la délégation d’authentification SASL'>
                <value>non</value>
            </variable>
        </family>
        <family name='saslauthd' icon='key'>
            <variable name='sasl_mechanism' type='string' description='Méthode de validation du mot de passe' hidden='True'>
                <value>ldap</value>
            </variable>
            <variable name='sasl_ldap_auth_local' type='oui/non' description='Utiliser l’annuaire AD local'>
                <value>oui</value>
            </variable>
            <variable name='sasl_ldap_auth_realm' type='domain' description='Domaine du serveur d’authentification' mandatory='True'/>
            <variable name='sasl_ldap_auth_server' type='domain' description='Adresse du serveur d’authentification' mandatory='True'/>
            <variable name='sasl_ldap_auth_cacert' type='filename' description='Chemin du certificat racine du serveur d’authentification' mandatory='True'/>
            <variable name='sasl_ldap_reader' type='string' description='Compte de connexion à l’annuaire de saslauthd' mandatory='True'>
                <value>sasl-reader</value>
            </variable>
	    <variable name='sasl_ldap_reader_password' type='password' description='Mot de passe de connexion à l’annuaire' mandatory='True'/>
        </family>
    </variables>
    <constraints>
        <auto name='calc_multi_condition' target='saslauthd_needed'>
            <param>oui</param>
            <param name='operator'>OR</param>
            <param type='eole' name='condition_1'>ldap_sasl_auth_delegation</param>
            <param name='condition_2'>non</param>
            <param name='match'>oui</param>
            <param name='mismatch'>non</param>
        </auto>

        <condition name='disabled_if_in' source='saslauthd_needed'>
            <param>non</param>
            <target type='family'>saslauthd</target>
            <target type='servicelist'>saslauthd</target>
            <target type='filelist'>saslauthd</target>
        </condition>
        <condition name='disabled_if_in' source='ldap_sasl_auth_delegation'>
            <param>non</param>
            <target type='filelist'>saslauthd-ldap</target>
        </condition>

        <check name='valid_enum' target='sasl_mechanism'>
            <param>['ldap']</param>
        </check>

        <condition name='disabled_if_not_in' source='sasl_mechanism'>
            <param>ldap</param>
            <target>sasl_ldap_auth_local</target>
        </condition>

        <condition name='disabled_if_in' source='sasl_ldap_auth_local' fallback='True'>
            <param>oui</param>
            <target>sasl_ldap_auth_server</target>
            <target>sasl_ldap_auth_realm</target>
            <target>sasl_ldap_auth_cacert</target>
            <target>sasl_ldap_reader_password</target>
        </condition>

        <fill name='calc_val_first_value' target='sasl_ldap_auth_server'>
            <param type='eole'>ad_server_fullname</param>
            <param>None</param>
        </fill>

        <fill name='calc_val_first_value' target='sasl_ldap_auth_realm'>
            <param type='eole' optional='True' hidden='False'>ad_realm</param>
            <param type='eole' optional='True' hidden='False'>ad_domain</param>
            <param>None</param>
        </fill>
    </constraints>
    <help>
        <family name='saslauthd'>Configuration de la délégation d’authentification SASL</family>
        <variable name='ldap_sasl_auth_delegation'>Les mots de passe ne seront plus stockés dans l’annuaire LDAP et l’authentification se fera en interrogeant un annuaire distant.</variable>
        <variable name='sasl_ldap_auth_server'>Le serveur d’authentification est le serveur qui disposent des mots de passe auprès duquel saslauthd va valider les informations d’authentification</variable>
        <variable name='sasl_ldap_reader'>Le compte de connexion est un compte qui est créé dans le CN Users</variable>
    </help>
</creole>
