<!-- MANDATORY: Defines a group of properties that allows the product to use an OpenID 
             Connect identity provider for user authentication.  -->
<!-- Set the values for this group of properties to allow the product access to your existing 
             OpenID connect identity provider. This external resource must already exist in your 
             environment and be configured to use for authentication.  -->
<crn:instance name="MANDATORY" class="TSP_OIDC_MSIdentity">
	<!-- identityProviderType: Specifies the implementation of an OpenID Connect identity 
               provider.  -->
	<crn:parameter name="identityProviderType">
		<crn:value xsi:type="xsd:string">MSIdentity</crn:value>
	</crn:parameter>
	<!-- id: Specifies a unique identifier for the authentication namespace.  -->
	<!-- Use the namespace identifier to distinguish between multiple namespaces. Each namespace 
               must have a unique identifier. When you select a namespace to use for authentication 
               in the run-time environment, the identifier is used by the IBM Cognos components. 
               Changing the namespace ID after the service has been started may invalidate the object 
               security policies and the Cognos group and role memberships. The use of the colon 
               in the Namespace ID is not supported.  -->
	<crn:parameter name="id">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
	<!-- oidcDiscEndpoint: Specifies the OpenID Connect discovery endpoint  -->
	<!-- The discovery endpoint is used to retrieve the OpenID Connect configuration that 
               includes the authorization endpoint, token endpoint, jwks endpoint, and issuer.  -->
	<crn:parameter name="oidcDiscEndpoint">
		<crn:value xsi:type="cfg:anyPathURI">https://login.microsoftonline.com:443/{tenantid}/v2.0/.well-known/openid-configuration</crn:value>
	</crn:parameter>
	<!-- clientId: Specifies the OpenID Connect client identifier  -->
	<!-- The client identity that is assigned to the application by the OpenID Connect identity 
               provider.  -->
	<crn:parameter name="clientId">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
	<!-- clientSecret: Specifies the client secret that is assigned to the application by 
               the OpenID Connect identity provider.  -->
	<!-- The client secret that is assigned to the application by the OpenID Connect identity 
               provider.  -->
	<crn:parameter name="clientSecret">
		<crn:value xsi:type="xsd:string" encrypted="true"></crn:value>
	</crn:parameter>
	<!-- returnUrl: Return URL that is configured with the OpenID Connect identity provider.  -->
	<!-- The return URL is invoked by the OpenID Connect identity provider after successfully 
               authenticating a user. The URL format is https://dispatcherHOST:dispatcherPORT/bi/completeAuth.jsp 
               or https://webserverHOST:webserverPORT/ibmcognos/bi/completeAuth.jsp. This URL completes 
               Cognos Analytics authentication using the OpenID Connect identity provider.  -->
	<crn:parameter name="returnUrl">
		<crn:value xsi:type="cfg:anyPathURI">https://host:443/bi/completeAuth.jsp</crn:value>
	</crn:parameter>
	<!-- selectableForAuth: Specifies whether the namespace is selectable for authentication.  -->
	<!-- If this property is set to true, the namespace will be available for authentication 
               in the logon page namespace selection prompt. Set this value to false if the namespace 
               should not be available for selection on the logon page.  -->
	<crn:parameter name="selectableForAuth">
		<crn:value xsi:type="xsd:boolean">true</crn:value>
	</crn:parameter>
	<!-- advancedProperties: Specifies a set of advanced properties.  -->
	<!-- The user needs to provide the name and the value for each advanced property.  -->
	<crn:parameter name="advancedProperties" opaque="true">
		<crn:value xsi:type="cfg:array"/>
	</crn:parameter>
	<!-- claimName: Specifies the name of the claim that will be provided to the target namespace.  -->
	<!-- A string that represents the name of the claim from the id_token that will be provided 
               to the target namespace. This value must be a single string value in the id_token 
               and must exist for all account objects.  -->
	<crn:parameter name="claimName">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
	<!-- trustedEnvName: Specifies the environment variable name that will be used to transfer 
               the claim to the target namespace.  -->
	<!-- A string that represents the environment variable name that will be used to transfer 
               the claim to the target namespace. This value is dependent on the target namespace 
               type and corresponds to how the target namespace will obtain the user's identity. 
               For example, the LDAP and Active Directory namespace types both expect the user's 
               identity to be passed in the REMOTE_USER environment variable.  -->
	<crn:parameter name="trustedEnvName">
		<crn:value xsi:type="xsd:string">REMOTE_USER</crn:value>
	</crn:parameter>
	<!-- redirectNsID: Specifies the namespace ID that will be invoked with the claim obtained 
               from the OpenID identity provider.  -->
	<!-- A string that represents the ID of the namespace that will be invoked with the claim 
               obtained from the OpenID identity provider. This value must match the namespace ID 
               of a configured namespace (e.g., LDAP, AD, etc).  -->
	<crn:parameter name="redirectNsID">
		<crn:value xsi:type="xsd:string">MANDATORY</crn:value>
	</crn:parameter>
</crn:instance>