<?xml version="1.0" encoding="UTF-8"?><driver-configuration dn="Dynamic ACL.Driver Set.Provisioning.services" driver-set-dn="Driver Set.Provisioning.services" name="Dynamic ACL">
	<attributes>
		<configuration-manifest>
			<manifest name="eDirectory">
				<capability name="password-subscribe"/>
				<capability name="password-publish"/>
				<capability name="password-check"/>
			</manifest>
		</configuration-manifest>
		<driver-filter-xml>
			<filter>
				<filter-class class-name="User" publisher="ignore" publisher-create-homedir="true" publisher-track-template-member="false" subscriber="sync">
					<filter-attr attr-name="CN" merge-authority="default" publisher="sync" publisher-optimize-modify="true" subscriber="sync"/>
					<filter-attr attr-name="GUID" subscriber="sync"/>
					<filter-attr attr-name="ACL" merge-authority="default" publisher="ignore" publisher-optimize-modify="true" subscriber="sync"/>
					<filter-attr attr-name="publishDescription" merge-authority="default" publisher="ignore" publisher-optimize-modify="true" subscriber="sync"/>
				</filter-class>
			</filter>
		</driver-filter-xml>
		<driver-image>R0lGODlhYgBPANU/AHZxaZOLeP///7Orls3GuMW9rRYWFeRVVAICAv4BDdbW1enp6NnTyaachrq5uD09Pa+mkr62pIaEgfT080NDQ8jHx6yijFBQUN/c1ZuZmKakoePj4ykoJvv6+GVkYYF8cveEh/wnMO3q5Z+Xf9LMwefi27mwnfa0tO/u7erm4bCuq1hTSFBMQ2FdVERBOjY1Mf0THo6Mi/Px7/j4+P38/Pb19S8uLD88Nut1dPVBRyIhH/v7+uWmoR4eHvqcnv///yH5BAEAAD8ALAAAAABiAE8AAAb/wJ9wSCwaj8ikcplcVCQeio3zaH00mBpzy+16t4oPB4EwUB+2HtnQcnzf8LgR9VFzAJrKRjZbKBwSFGQXFXKGh0sKL2UZGwKPkJEyDg9lGoiYmRU6CB4okaCgMxkGCBmZqHEYYzGhrqAVpSqptFw0ghKgKBUaEh8fMXmfkQ5lCrXISRkIFzORFTEAHxIx1TESGRWgy83J3kM1OgbajxMqANQZGirsKhoZMQ41kDuCs9/eEp2RKsAZKg4qVCBBQqADFRkcPGM2A8kTDxcoSJxIsaLFixgzZmRhBgOkCsA0BFSAYYPJDRgUVHCgQQGkGhQMYDCioEUpBD1y6tzJs6fP/59Ag/Z4QE4AimoiSWBYgGJCjRoTUCzAQMKBAxmQYiC4RERFKRuNUMiAOqGs2bNo06pdy3btM2wOSGxAUWMHjbs0dtRAsaGqy0fFPBBxYMCAhB2vEitezLixhhgqKmBAMYNGKBozUGAQCAmDjgdDMKhR2Li06dOhMiRUsKCGZVc0avgpKuOFDSE7ACBotTgqit/AgwsfThyFiAXIkytfIAB5ihQbXj8KJhkF4sQ7NBed8YCDlg0GbDBPvEHFNQno01OzVo2a+vfpf8n/BQBAi/stVuhnwb/FhEiQ6TGBdLBNsEFRNXSHwg8qIJBLYg58IA186rHHHoW+zEdffRzW5//Bhx7ctwJpj6wjl2uKxbbBX0a9wMECP3yAAImhVCBNDOpooOOO76jG4487qiakauwFEIAERhqpIQAeqECMCicSeFkNJkGiQA8vwNhCDyyCsgB66lglUAUEFGDVQexYZeaZZ7bj5gAQaACBBRY0MEIDdTZgZwAjBCBhAJEoENkGA6Zo4HgCNHgBjBf04IgrEf4TF0kYpMTApWSWWUABBHWaqaabbhpBBCaUagKcEEBQ6gAWjHBnnx+IAMkk1V33SnYbOPOIPhIs2CiikYwSjAMKbJDCAiKkUEIJlSrAQKcEEEDCpZd2SoK00YYaKqmmmkBqnSPQ2WcEgRLbmpSQxMb/FCQo2GCACg396koNOMa1wAR2oXtatASghtlsuj6i0mSVXZbZMI8oWsgP8oZCbx6TOVWWDMY9xywG1F67qbTPRitAtgJoO+qoJswJwQADnIoyBA0EoEGwCshFV7536fWbrTKwsoEQDYNC76BPzVCWcSIke3G114LKbwEhb9q0qCOzOieddJ48agMf0CjAiks19ZRvWEXiATNu8NwDsC/9w8AGNcwwwwknUFy0spUiXSYOB+SNg9OhPl3AqH9PTTWdeLJqpwQkiLLASciJZet0COigwc5mo/1IDavl6vYBOPyWLN11d1zAAQmUfkCpTZMLtbd/Vz24BSdDAOsvTJ9G/4NWBmRDRM+RYE5sCm7PEEICIBRtdOiik246ygJE4PTIIxdgAuywC45yq0raNwLCiykwdg8xVNDQELynbe4MHQifAAw4lFD00Zdmq3wCBzCfMrnQO1+A4NXPeSq42WvBO7gXig0AQA1gccCCdne2ea0GeOkbnukwoCz4aWx+9RsAKPK3Kf7BDmURYJmd+uQnAKigBR64gpMiMQEPlMIATaqADIxQvsutZgHoU1/p6MeAZYXugjvMoABWNkRvect5rLLAqU42gG/pyVUk/ICNQqQfUMioBxcQiQLGV4QaCsB3rEFfByS4wxyc4GIYA6LpTiaAqbXxZEeMQBJXlrICJP9xhK4y0gboEyJQuPAfFVjgEbwIRhx2YIw7LOMJkFcmDDKPiUOcmhEHl6omhvCJr4IiCrIHAD/2QAUDUgIhbyhGMiYyBDwIXSODCKc22k9wpaJaJU0gvTxBMZMziCKgxGaAsomygQ4jZQd2YMpT8oBaq1weBIZov8EZLlVMRKKe7ETNV9EgjwFogB97yYRRnu+QZIRBIhMQAhAkb4c4IMEyUaZB1CgGinrapi+T4M0wgrN07MPBONmnxgTggAAWiCQ7KQmuBqjqYxHI0zTvhElXNWAAI5BnN4HpM1LuAJHr80EK9JlI9kXLkRpk58qqxkQ8sZEArIJnNW+JpwjsEhL/LpwnEuqJw4uSsXgpAIE4E7k3DJ6KmeyEZjRL5TwBMKBMI1vV1PBYqpc+IqYTtdwXLYpR4hmnBDrtaN6CiDpIujMxoyJABCLKS5kOkqK9sygxdwgComG1mDulH+rYyUyq6emDJ5PeNFNmxFVpkJYkSKhEl0DTylQVBHJTlg+KyVUTALWuhMOTBUBoR6qxLlRLFEADaNmywf5SqoWcwQ7WWjrEzm1ZPGCsXB1L1+tNU7JWq+z9CiDWbMmxjZvqbFmj6sDzjfamchOBD3mQg3HSb1SPhVNkTUpZlNFSWnaMwLP+JgATlEm3MOUmYdFqvjDm5aZR+dzFiDvOA1DXuZG0/6tk6/g3500rcBAgwFGZFgESFAC7T9XuZ3sbxt+yNbzHwxh5g4hclQF1TtNMlXU19V456skEHQsZAyKAXwFAdbugJeV3/+s50F1qdAQmVyRWdrI6TbaJ2Xqvt1pl0AIc9WMTrvCF9xvM8224tBOQwWl/SADlHaDAPyWxCKNJEPlKz8F3HcClYJxQp1pYv/Tkrg3PJwAahAAGWAZBjnXs4WqB2LzkMhUzU0W4D0r3UnIk1Wsf6mIBTKvJno1yhqlMgxP4wAdnnNiOMXbURv6YvqQCqomrR0s0D0B6snPoCCBQX6PG2MkzljN/cSiA0e7AbRMjWpeTpin8BXqJefpgof8ZcMSUwlOJTKtUQsmaXbPSUMpTpfNogze0PVcrW30j2RDLXLU6MgADSB0AHu80WaYJ96grbDVvaxzGr7pCzM52BbNQqs3dYnjSzqhZ+oSWY+PBr2OdJlnJ1Ctq2mJABBj4m7CnSScQEqBSdqy2sq/NbEpX+aK0Du6mce28UQkZjkc0N8bKlMQPzla+wGZVnGcK69BWuWb51nQJOAbubZEKVWSGpnNdfFT7qoyoG5sWvEu28LNKFQWkfIS2ubMGD1CwBAagADJxrW7l8toCfAJsx48c8mklTSmILvmr59zshx+SOzZwACkeoCy13RpUcrT54GT0ARTbV3rPtZbS0t3/SmvTuKJUjsEDLqCCQz7gATnWwFY8cIMYYKAFF/DAC0ZQgA/cwAYeWBkAXHSDEaihBxyIAAE+YAMbAIC2eGeBDVpwA1JF4AaH7/q8v57W87lQAhdAALzOPjEEAEArAMDAIlzQgrojYAUsQAALBjC2F6yAAxa4AQJcsAITtGD2qW9BBMjAghboAwADCIAp7LhMr0u63grwvFU+0wHOR8XzJfC86HvQ5/AYaREDMMALpo6AD5xM9dOTPQRmD00zWMAFBriW5PPr6i42/IbFsMHZHwCA5qN9AhXYSgqk/4IXdKwMhTcFA3B63Fd1A+gBCZV6FqB603R7wgcA0nJbxsdw/1I1A1rkBw5SZSRwUWc3AynwADIhAvznf9cSHqMyAqdifnUyADICfNn3AhTGAQYwAqrHUDRYCgOgFIEldO4nVTQAEKxRA7oRgBxoACDYS8Yxgh0jfOGBACejG2aAAHVCBhzwC5FTCh5AgywATy6geiK3PzzIQFIlAIIiIDQACG6XFxnwCxmQAjomAiaEAdcAbhBwHyiIMiOgHwBwMnm4ApsFAR6wAh/gKiwAAAblPPoQAE3kcWFIPo7yCjUQEJNhFyqXF9s2ATOgb0dTZPKVVCQmNbKEYhB1J4dWJibwAS6CJ9ZVAB4RCTbRfkTgAVySGAtALHsgWqO1bTNQAzLQi/8V40N8di2/1l4qkzIY12ur6Dym2Co0+AJ8YlAm0IqRQAE9AItDUAdaowsKUCxi0Yu+6DnOgRI/pDGiolRCpVB6oipGJjtJYoNQZAFdonI9oAPHsAQN8iDYwRcbsBzK8RwbAIyW8iycZnHQE3ChEoGo4lym0kQMQECAgQAPMBNLAB46MIbRdpEY6YqeByNLQAO6gY8ZGZIhWQzVyEVKgAE2oHkiuZIXqQBj8AH1uAWE0X2PwpI2yRgyoAFq4AEVQANe4AApyQHxUCwnUZRGeZRImZRKuZRMiRIVkAGC0AkOMAFvsAEScBNCkZVauZVcqRNkQAHhQ5WqoAEfQAHzd5YzaJmWarmWbNmWbjl/cZcQG7ADmdAHKbGNeJmXermXfNmXfvmXfjkXPokPhFmYhnmYqBAEADsNCg==</driver-image>
		<log-events inherit="true"/>
		<trace-file value="/home/traces/idv-to-acl/trace.log"/>
		<trace-size-limit value="0"/>
		<trace-level value="4"/>
		<driver-trace-level inherit="true"/>
		<log-limit inherit="true"/>
		<java-module value="com.novell.nds.dirxml.driver.nds.DriverShimImpl"/>
		<driver-cache-limit value="0"/>
		<shim-auth-server value="192.168.1.100:8196"/>
		<driver-start-option no-resync="false" value="2"/>
		<shim-config-info-xml>
			<driver-config/>
		</shim-config-info-xml>
		<global-config-values>
			<configuration-values>
				<definitions>
					<definition display-name="Connected System or Driver Name" name="ConnectedSystemName" type="string">
						<description>The name of the connected system, application or Identity Manager driver. This value is used by the e-mail notification templates.</description>
						<value xml:space="preserve">ACL</value>
					</definition>
					<definition display-name="ldapProxyUser" dn-space="dirxml" dn-type="slash" name="ldapProxyUser" type="dn">
						<description>ldapProxyUser</description>
						<value>\STYX-TREE\services\admins\ldapProxy</value>
					</definition>
				</definitions>
			</configuration-values>
		</global-config-values>
		<mapping-rule dn="MappingRule-1.Dynamic ACL.Driver Set.Provisioning.services"/>
	</attributes>
	<children>
		<publisher name="Publisher">
			<attributes>
				<matching-rule dn="Matching Rule.Publisher.Dynamic ACL.Driver Set.Provisioning.services"/>
				<placement-rule dn="Placement Rule.Publisher.Dynamic ACL.Driver Set.Provisioning.services"/>
			</attributes>
			<children>
				<rule name="Matching Rule">
					<policy>
						<rule>
							<description>Match based on name and placement</description>
							<conditions>
								<and>
									<if-src-dn op="in-subtree">idvault</if-src-dn>
								</and>
							</conditions>
							<actions>
								<do-find-matching-object scope="entry">
									<arg-dn>
										<token-text xml:space="preserve">idvault\</token-text>
										<token-unmatched-src-dn convert="true"/>
									</arg-dn>
								</do-find-matching-object>
							</actions>
						</rule>
					</policy>
				</rule>
				<rule name="Placement Rule">
					<policy>
						<rule>
							<description>Mirror Structure</description>
							<conditions>
								<or>
									<if-src-dn op="in-subtree" xml:space="preserve">idvault</if-src-dn>
								</or>
							</conditions>
							<actions>
								<do-set-op-dest-dn>
									<arg-dn>
										<token-text xml:space="preserve">idvault</token-text>
										<token-text xml:space="preserve">\</token-text>
										<token-unmatched-src-dn convert="true"/>
									</arg-dn>
								</do-set-op-dest-dn>
							</actions>
						</rule>
					</policy>
				</rule>
			</children>
		</publisher>
		<subscriber name="Subscriber">
			<attributes>
				<event-transformation-rule dn="Set ACL's for user objects.Subscriber.Dynamic ACL.Driver Set.Provisioning.services"/>
			</attributes>
			<children>
				<rule name="Set ACL's for user objects">
					<policy>
						<description>This policy will set the ACL's correctly for a user object.</description>
						<rule>
							<description>Grant ACL to user object when attribute was set to true</description>
							<comment xml:space="preserve">Grant ACL to user object when attribute was set to true</comment>
							<conditions>
								<and>
									<if-class-name mode="nocase" op="equal">User</if-class-name>
									<if-op-attr mode="nocase" name="publishDescription" op="changing-to">true</if-op-attr>
								</and>
							</conditions>
							<actions>
								<do-add-src-attr-value class-name="User" name="ACL">
									<arg-value type="structured">
										<arg-component name="protectedName">
											<token-text xml:space="preserve">[Entry Rights]</token-text>
										</arg-component>
										<arg-component name="trustee">
											<token-global-variable name="ldapProxyUser"/>
										</arg-component>
										<arg-component name="privileges">
											<token-text xml:space="preserve">1</token-text>
										</arg-component>
									</arg-value>
								</do-add-src-attr-value>
								<do-add-src-attr-value class-name="User" name="ACL">
									<arg-value type="structured">
										<arg-component name="protectedName">
											<token-text xml:space="preserve">[All Attributes Rights]</token-text>
										</arg-component>
										<arg-component name="trustee">
											<token-global-variable name="ldapProxyUser"/>
										</arg-component>
										<arg-component name="privileges">
											<token-text xml:space="preserve">1</token-text>
										</arg-component>
									</arg-value>
								</do-add-src-attr-value>
								<do-add-src-attr-value class-name="User" name="ACL">
									<arg-value type="structured">
										<arg-component name="protectedName">
											<token-text xml:space="preserve">Description</token-text>
										</arg-component>
										<arg-component name="trustee">
											<token-global-variable name="ldapProxyUser"/>
										</arg-component>
										<arg-component name="privileges">
											<token-text xml:space="preserve">3</token-text>
										</arg-component>
									</arg-value>
								</do-add-src-attr-value>
							</actions>
						</rule>
						<rule>
							<description>Revoke ACL to user object when attribute was set to true</description>
							<comment xml:space="preserve">Revoke ACL to user object when attribute was set to true</comment>
							<conditions>
								<and>
									<if-class-name mode="nocase" op="equal">User</if-class-name>
									<if-op-attr mode="nocase" name="publishDescription" op="changing-to">false</if-op-attr>
								</and>
							</conditions>
							<actions>
								<do-add-src-attr-value class-name="User" name="ACL">
									<arg-value type="structured">
										<arg-component name="protectedName">
											<token-text xml:space="preserve">[Entry Rights]</token-text>
										</arg-component>
										<arg-component name="trustee">
											<token-global-variable name="ldapProxyUser"/>
										</arg-component>
										<arg-component name="privileges">
											<token-text xml:space="preserve">1</token-text>
										</arg-component>
									</arg-value>
								</do-add-src-attr-value>
								<do-add-src-attr-value class-name="User" name="ACL">
									<arg-value type="structured">
										<arg-component name="protectedName">
											<token-text xml:space="preserve">[All Attributes Rights]</token-text>
										</arg-component>
										<arg-component name="trustee">
											<token-global-variable name="ldapProxyUser"/>
										</arg-component>
										<arg-component name="privileges">
											<token-text xml:space="preserve">1</token-text>
										</arg-component>
									</arg-value>
								</do-add-src-attr-value>
								<do-add-src-attr-value class-name="User" name="ACL">
									<arg-value type="structured">
										<arg-component name="protectedName">
											<token-text xml:space="preserve">Description</token-text>
										</arg-component>
										<arg-component name="trustee">
											<token-global-variable name="ldapProxyUser"/>
										</arg-component>
										<arg-component name="privileges">
											<token-text xml:space="preserve">1</token-text>
										</arg-component>
									</arg-value>
								</do-add-src-attr-value>
							</actions>
						</rule>
						<rule>
							<description>Veto events in order to stop processing!</description>
							<comment xml:space="preserve">Veto events in order to stop processing!</comment>
							<conditions>
								<and>
									<if-class-name mode="nocase" op="equal">User</if-class-name>
								</and>
							</conditions>
							<actions>
								<do-veto/>
							</actions>
						</rule>
					</policy>
				</rule>
			</children>
		</subscriber>
		<rule name="MappingRule">
			<attr-name-map/>
		</rule>
		<rule name="MappingRule-1">
			<attr-name-map/>
		</rule>
	</children>
</driver-configuration>