<!-- MANDATORY: Defines a group of properties that allows the product to use an OpenID 
             Connect identity provider for user authentication.  -->
<!-- Set the values for this group of properties to allow the product access to your existing 
             OpenID Connect identity provider. This external resource must already exist in your 
             environment and be configured to use for authentication.  -->
<crn:instance name="MANDATORY" class="OIDC_IBMCloudId">
	<!-- identityProviderType: Specifies the implementation of an OpenID Connect identity 
               provider.  -->
	<crn:parameter name="identityProviderType">
		<crn:value xsi:type="xsd:string">IBMCloudId</crn:value>
	</crn:parameter>
	<!-- id: Specifies a unique identifier for the authentication namespace.  -->
	<!-- Use the namespace identifier to distinguish between multiple namespaces. Each namespace 
               must have a unique identifier. When you select a namespace to use for authentication 
               in the run-time environment, the identifier is used by the IBM Cognos components. 
               Changing the namespace ID after the service has been started may invalidate the object 
               security policies and the Cognos group and role memberships. The use of the colon 
               in the Namespace ID is not supported.  -->
	<crn:parameter name="id">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
	<!-- oidcDiscEndpoint: Specifies the OpenID Connect discovery endpoint  -->
	<!-- The discovery endpoint is used to retrieve the OpenID Connect configuration that 
               includes the authorization endpoint, token endpoint, jwks endpoint, and issuer.  -->
	<crn:parameter name="oidcDiscEndpoint">
		<crn:value xsi:type="cfg:anyPathURI">https://login.ibm.com:443/oidc/endpoint/default/.well-known/openid-configuration</crn:value>
	</crn:parameter>
	<!-- clientId: Specifies the OpenID Connect client identifier  -->
	<!-- The client identity that is assigned to the application by the OpenID Connect identity 
               provider.  -->
	<crn:parameter name="clientId">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
	<!-- clientSecret: Specifies the client secret that is assigned to the application by 
               the OpenID Connect identity provider.  -->
	<!-- The client secret that is assigned to the application by the OpenID Connect identity 
               provider.  -->
	<crn:parameter name="clientSecret">
		<crn:value xsi:type="xsd:string" encrypted="true"></crn:value>
	</crn:parameter>
	<!-- returnUrl: Return URL that is configured with the OpenID Connect identity provider.  -->
	<!-- The return URL is invoked by the OpenID Connect identity provider after successfully 
               authenticating a user. The URL format is https://dispatcherHOST:dispatcherPORT/bi/completeAuth.jsp 
               or https://webserverHOST:webserverPORT/ibmcognos/bi/completeAuth.jsp. This URL completes 
               Cognos Analytics authentication using the OpenID Connect identity provider.  -->
	<crn:parameter name="returnUrl">
		<crn:value xsi:type="cfg:anyPathURI">https://host:443/bi/completeAuth.jsp</crn:value>
	</crn:parameter>
	<!-- selectableForAuth: Specifies whether the namespace is selectable for authentication.  -->
	<!-- If this property is set to true, the namespace will be available for authentication 
               in the logon page namespace selection prompt. Set this value to false if the namespace 
               should not be available for selection on the logon page.  -->
	<crn:parameter name="selectableForAuth">
		<crn:value xsi:type="xsd:boolean">true</crn:value>
	</crn:parameter>
	<!-- advancedProperties: Specifies a set of advanced properties.  -->
	<!-- The user needs to provide the name and the value for each advanced property.  -->
	<crn:parameter name="advancedProperties" opaque="true">
		<crn:value xsi:type="cfg:array"/>
	</crn:parameter>
	<!-- accountCamidProperty: Specifies the value used to uniquely identify account objects.  -->
	<!-- Specify either an existing Content Manager account object model property (e.g., email, 
               username, defaultName, etc) or the name of a configured custom property. A claim 
               must be returned for all accounts from the Identity Provider for either the Content 
               Manager account object model property or the configured custom property. The value 
               selected must be unique across all account objects. The value selected should be 
               constant over time with a low probability of needing to be changed. NOTE: this value 
               should not be changed after initial namespace configuration.  -->
	<crn:parameter name="accountCamidProperty">
		<crn:value xsi:type="xsd:string">email</crn:value>
	</crn:parameter>
	<!-- customProperties: Specifies a set of custom properties.  -->
	<!-- Use this set of custom properties to define additional account information. The "name" 
               field corresponds to the property name set in the account while the "value" corresponds 
               to the claim name in the id_token.  -->
	<crn:parameter name="customProperties" opaque="true">
		<crn:value xsi:type="cfg:array"/>
	</crn:parameter>
	<!-- tenantIdMapping: Specifies how namespace users are mapped to tenant IDs.  -->
	<!-- Specifying a value for this parameter enables multitenancy. The tenant ID for a user 
               can be determined using a pattern or a tenant provider class. The pattern is a AAA 
               service search path to a property which defines a tenant ID. The search path must 
               be relative to a user account. For example: '~/ancestors[2]/defaultName'. A tenant 
               provider class is Java class which implements the the ITenantProvider interface. 
               For more details please consult the installation and configuration guide.  -->
	<crn:parameter name="tenantIdMapping" opaque="true">
		<crn:value xsi:type="cfg:tenancyInfo">
			<crn:item name="pattern" xsi:type="xsd:string"/>
		</crn:value>
	</crn:parameter>
	<!-- tenantBoundingSetMapping: Specifies how the tenant bounding set is determined for 
               a user.  -->
	<!-- This parameter is used when multitenancy is enabled. The tenant bounding set for 
               a user can be determined using a pattern or a tenant bounding set provider class. 
               The pattern is a AAA service search path to a property which defines a tenant bounding 
               set. The search path must be relative to a user account. For example: '˜/parameters/boundingSet'. 
               A tenant bounding set provider class is Java class which implements the the IBoundingSetProvider 
               interface. For more details please consult the installation and configuration guide.  -->
	<crn:parameter name="tenantBoundingSetMapping" opaque="true">
		<crn:value xsi:type="cfg:tenancyInfo">
			<crn:item name="pattern" xsi:type="xsd:string"/>
		</crn:value>
	</crn:parameter>
</crn:instance>