<?xml version="1.0" encoding="UTF-8"?>
<policy>
	<description>Payloads for subscribe to password changes</description>
	<rule disabled="true">
		<description>Add operation-data element to password subscribe operations (if needed)</description>
		<conditions>
			<and>
				<if-operation op="equal">add</if-operation>
				<if-password op="available"/>
				<if-xpath op="not-true">operation-data</if-xpath>
			</and>
			<and>
				<if-operation op="equal">modify-password</if-operation>
				<if-xpath op="not-true">operation-data</if-xpath>
			</and>
		</conditions>
		<actions>
			<!-- Add a operation data payload element to pick up result of a password operation -->
			<do-append-xml-element expression="." name="operation-data"/>
		</actions>
	</rule>
	<rule disabled="true">
		<description>Add payload data to modify-password subscribe operations</description>
		<conditions>
			<and>
				<if-operation op="equal">modify-password</if-operation>
				<if-xpath op="true">self::modify-password[@event-id != 'pwd-publish-failed']</if-xpath>
			</and>
		</conditions>
		<actions>
			<!-- Add a operation data payload element to pick up result of a password operation -->
			<do-append-xml-element expression="operation-data" name="sso-sync-data"/>
			<do-append-xml-element expression="operation-data/sso-sync-data" name="sso-target-user-dn"/>
			<do-append-xml-text expression="operation-data/sso-sync-data/sso-target-user-dn">
				<arg-string>
					<token-src-attr name="DirXML-ADContext"/>
				</arg-string>
			</do-append-xml-text>
			<do-append-xml-element expression="operation-data/sso-sync-data" name="sso-app-username"/>
			<do-append-xml-text expression="operation-data/sso-sync-data/sso-app-username">
				<arg-string>
					<token-src-attr name="CN"/>
				</arg-string>
			</do-append-xml-text>
			<do-append-xml-element expression="operation-data/sso-sync-data" name="password"/>
			<do-append-xml-text expression="operation-data/sso-sync-data/password">
				<arg-string>
					<token-password/>
				</arg-string>
			</do-append-xml-text>
		</actions>
	</rule>
	<rule disabled="true">
		<description>Add payload data to add subscribe operations</description>
		<conditions>
			<and>
				<if-operation op="equal">add</if-operation>
				<if-password op="available"/>
			</and>
		</conditions>
		<actions>
			<!-- Add a operation data payload element to pick up result of a password operation -->
			<do-append-xml-element expression="operation-data" name="sso-sync-data"/>
			<do-append-xml-element expression="operation-data/sso-sync-data" name="sso-target-user-dn"/>
			<do-append-xml-text expression="operation-data/sso-sync-data/sso-target-user-dn">
				<arg-string>
					<token-src-attr name="DirXML-ADContext"/>
				</arg-string>
			</do-append-xml-text>
			<do-append-xml-element expression="operation-data/sso-sync-data" name="sso-app-username"/>
			<do-append-xml-text expression="operation-data/sso-sync-data/sso-app-username">
				<arg-string>
					<token-src-attr name="CN"/>
				</arg-string>
			</do-append-xml-text>
			<do-append-xml-element expression="operation-data/sso-sync-data" name="password"/>
			<do-append-xml-text expression="operation-data/sso-sync-data/password">
				<arg-string>
					<token-password/>
				</arg-string>
			</do-append-xml-text>
			<do-append-xml-element expression="operation-data/sso-sync-data" name="nsl-set-passphrase-answer"/>
			<do-append-xml-text expression="operation-data/sso-sync-data/nsl-set-passphrase-answer">
				<arg-string>
					<token-src-attr name="workforceID"/>
				</arg-string>
			</do-append-xml-text>
		</actions>
	</rule>
</policy>
