common-3.xsd

<?xml version="1.0" encoding="UTF-8"?>

<!--
  ~ Copyright (c) 2010-2014 Evolveum
  ~
  ~ Licensed under the Apache License, Version 2.0 (the "License");
  ~ you may not use this file except in compliance with the License.
  ~ You may obtain a copy of the License at
  ~
  ~     http://www.apache.org/licenses/LICENSE-2.0
  ~
  ~ Unless required by applicable law or agreed to in writing, software
  ~ distributed under the License is distributed on an "AS IS" BASIS,
  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  ~ See the License for the specific language governing permissions and
  ~ limitations under the License.
  -->

<xsd:schema targetNamespace="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:tns="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:xsd="http://www.w3.org/2001/XMLSchema"
            xmlns:c="http://midpoint.evolveum.com/xml/ns/public/common/common-3"
            xmlns:cap="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3"
            xmlns:a="http://prism.evolveum.com/xml/ns/public/annotation-3"
            xmlns:t="http://prism.evolveum.com/xml/ns/public/types-3"
            xmlns:q="http://prism.evolveum.com/xml/ns/public/query-3"
            xmlns:icfs="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3"
            xmlns:xjc="http://java.sun.com/xml/ns/jaxb/xjc"
            xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"
            xmlns:jaxb="http://java.sun.com/xml/ns/jaxb"
            elementFormDefault="qualified"
            jaxb:extensionBindingPrefixes="xjc"
            jaxb:version="2.0">

    <xsd:annotation>
        <xsd:documentation>
            <p>
            This is a common schema for midPoint project. It contains all the
            data types that the stock midPoint is using
            This file contains more that a common schema in fact. It contains
            all the objects, even parts of what is known as identity schema and
            model schema in midPoint.
            </p>

            See
            <a href="https://wiki.evolveum.com/display/midPoint/Data+Model">https://wiki.evolveum.com/display/midPoint/Data+Model</a>
            for more details.

            <p>Version: 3.2-SNAPSHOT</p>

            <p>Recommended namespace prefix: (default), c</p>
        </xsd:documentation>
        <xsd:appinfo>
            <jaxb:globalBindings>
                <xjc:typeSubstitution type="complex"/>
                <xjc:serializable uid="201105211233"/>
            </jaxb:globalBindings>
        </xsd:appinfo>
    </xsd:annotation>

    <xsd:import namespace="http://www.w3.org/2001/XMLSchema" 
    			schemaLocation="http://www.w3.org/2001/XMLSchema">
        <xsd:annotation>
            <xsd:documentation>
                Importing the schema of XSD schema definition explicitly. This causes that we can use "strict" matching
                for the xsd:schema elements used in runtime.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:import>

    <xsd:import namespace="http://www.w3.org/2001/04/xmlenc#" 
    			schemaLocation="http://www.w3.org/2001/04/xmlenc">
        <xsd:annotation>
            <xsd:documentation>
                The XML Encryption schema. Used for "protected" data types (property encryption).
            </xsd:documentation>
        </xsd:annotation>
    </xsd:import>


    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/annotation-3" 
    			schemaLocation="http://prism.evolveum.com/xml/ns/public/annotation-3">
        <xsd:annotation>
            <xsd:documentation>
                Common prism annotations used in various XSD schemas.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:import>
    
    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/types-3"
    			schemaLocation="http://prism.evolveum.com/xml/ns/public/types-3">
        <xsd:annotation>
            <xsd:documentation>
                Prism data types.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:import>
    
<!--      <xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3" -->
<!--     			schemaLocation="http://midpoint.evolveum.com/xml/ns/public/resource/capabilities-3"> -->
<!--         <xsd:annotation> -->
<!--             <xsd:documentation> -->
<!--                 Capabilities -->
<!--             </xsd:documentation> -->
<!--         </xsd:annotation> -->
<!--     </xsd:import> -->

    <xsd:import namespace="http://prism.evolveum.com/xml/ns/public/query-3" 
    			schemaLocation="http://prism.evolveum.com/xml/ns/public/query-3">
        <xsd:annotation>
            <xsd:documentation>
                Prism data types.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:import>
    
    <xsd:import namespace="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3" 
    			schemaLocation="http://midpoint.evolveum.com/xml/ns/public/connector/icf-1/resource-schema-3">
        <xsd:annotation>
            <xsd:documentation>
                This is a hack. It should not be here. And it will be gone as soon as we remove a deprecated functionality
                in ResourceObjectPatternType.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:import>

    <!-- ################################## -->
    <!-- ##      Common Schema Layer     ## -->
    <!-- ################################## -->

    <!-- See https://wiki.evolveum.com/display/midPoint/Common+Schema -->

    <xsd:element name="displayName" type="xsd:string">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                Human readable name. This name may be displayed in tools and GUIs
                to provide more pleasant user experience, as the XML data type names
                or object names may look quite frightening.</p>

                <p>
                The "displayName" should contain a value that is readable for almost any
                user. It is never used in the "logic", it is used only for display purposes.
                </p>

                <p>
                The use of national characters is in "displayName" is fully supported.
                </p>

                <p>
                DisplayName is reused in several location, but the meaning is still the same.
                </p>
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>
    
    <xsd:element name="description" type="xsd:string">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                Free-form textual description of the object. It is supposed to describe
                the object or a construct that it is attached to.
                </p>

                <p>
                Anything that the system administrator wants may be here. The system
                will not interpret the information except for displaying it and allow
                user to edit it.
                </p>
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>
 
    <xsd:element name="ignore" type="xsd:boolean" default="true">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                Presence of this element signifies that the structure that contains it should
                be ignored. If this element is present in the attribute definition, the attribute
                should be ignored. If it appears in the object class definition, the entire object
                class should be ignored. "Ignored" means that the system should pretend that the
                structure does not exist at all.
                </p>
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>
 
    <!-- Basic Object Types -->


    <xsd:complexType name="ObjectType" abstract="true">

        <xsd:annotation>
            <xsd:documentation>
                <p>
                Common supertype for all identity objects. Defines basic properties
                that each object must have to live in our system (identifier, name).
                </p>

                <p>
                Objects consists of identifier and name (see definition below)
                and a set of properties represented as XML elements in the
                object's body. The properties are represented as first-level
                XML elements (tags) of the object XML representation and may
                be also contained in other tags (e.g. extension, attributes)
                that are marked by a propertyContainer annotation. The QName
                (namespace and local name) of the element holding the property
                is considered to be a property name.
                </p>

                <p>
                Single-value properties must appear as a none or one instance
                of the XML element holding the value.
                </p>

                <p>
                Multi-value properties must appear as none or more instances of
                the same XML element. Multi-valued properties are regarded as
                unordered sets. Duplicate values are allowed, but duplicates
                should not be preserved by the implementations. The implementations
                should reduce duplicate values to a single value if it is
                possible and efficient.
                </p>

                <p>
                If an element for a specific property does not appear in the
                object it means that the property value is undefined (property
                does not exists). This is a different state as compared to
                passing an empty XML element. Empty XML element means that the
                property exists, but has an empty (null) value. Implementations
                must be able to handle undefined (non-existent) properties, but
                may NOT be able to handle empty (null) values. The use of empty
                (null) values is DISCOURADGED.
                </p>

                <p>
                It is not mandated by this specification how to pass ordered
                lists and multi-value properties with duplicates. However it is
                recommended to use single value properties with appropriate complex
                XML data structures to hold such data.
                </p>

                <p>
                The following XML snippet is an example of the object (omitting
                namespace definitions, but assuming default namespace to be the
                target namespace of this schema definition):
                </p>

                <pre>
                <![CDATA[
        <user oid="d3adm3a4" version="42">
            <name>foobar</name>
            <extension>
              <foo:geekName>F00 B4r</foo:geekName>
              <org:guild>Societus Geekus Europeus</org:guild>
              <org:guild>Basset User Group</org:guild>
              <pet:pet><pet:species>dog</pet:species><pet:breed>basset</pet:breed><pet:name>Doggie</pet:name></pet:pet>
              <pet:pet><pet:species>mouse</pet:species><pet:breed>logitech</pet:breed><pet:name>Mousee</pet:name></pet:pet>
              <com:shoppingPreferences>
                  <com:tShirt><com:size>XXL</com:size><com:color>#000000</com:color></com:tShirt>
                  <com:tie><com:preference>no thanks</com:preference></com:tie>
              </com:shoppingPreferences>
            </extension>
            <fullName>Foo Bar</fullName>
            <givenName>Foo</givenName>
            <familyName>Bar</familyName>
        </user>
]]></pre>
                <p>
                The above example describes an object with identifier "d3adm3a4",
                name "foobar" and type defined by its top-level element User that
                corresponds to URI "http://midpoint.evolveum.com/xml/ns/identity/1#User".
                The object has 7 properties. Three of them are standard
                properties defined by this schema:
                </p>

                <p>
                Standard properties "fullName", "givenName" and "familyName"
                in default namespace. These are single-valued string properties.
                </p>

                <p>
                All the other properties are non-standard "extended" properties,
                but they are considered equal to the standard attributes. They are
                quarantined in the &lt;extension&gt; tag only to avoid XSD unique
                particle attribution (UPA) problems. In the above example the
                non-standard properties are:
                </p>

                <p>
                Property "geekName" in namespace defined by "foo" prefix. This is also
                single-valued string property.
                </p>

                <p>
                Multi-valued non-standard property "guild". It is a string property
                with multiple values. Multiple values are represented by providing
                multiple instances of XML elements in the document.
                Such properties are typically used for roles, groups, etc.
                </p>

                <p>
                Complex property "pet". This property is defined by
                complex XML type, using XML sub-elements to
                represent structured data. Note that the use of XML attributes
                is discouraged in the properties, although it might be possible in
                some cases. This is also multi-valued property.
                </p>

                <p>
                Complex property "shoppingPreferences". This property is using
                complex XML type to form a structure of XML elements to
                represent data. This is a single-valued property.
                Note that the sub-elements "tShirt" and "tie" are NOT considered
                to be properties.
                </p>

                <p>
                QName-URI mapping:
                </p>

                <p>
                For the purpose of this schema and all components that are using it,
                URIs and QNames are considered equivalent. This is required by WWW
                architecture and also helps avoid some drawbacks and bugs in XML-related
                implementations that usually do not deal QNames well.
                </p>

                <p>
                The QNames are mapped to URIs by concatenating namespace URI and a local
                name. If URI does not end with slash (/) or hash (#) character, slash is
                concatenated to the URI before adding the local name. The URI-QName
                mapping is the reverse process.
                </p>

            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:object/>
            </xsd:appinfo>
        </xsd:annotation>
		<xsd:complexContent>
            <xsd:extension base="t:ObjectType">
        <xsd:sequence>
            <xsd:element name="name" type="t:PolyStringType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        Human-readable, mutable name of the object. It
                        may also be an identifier (login name, group name).
                        Should be unique in the respective context of
                        interpretation. E.g. the name of the UserType subtype
                        should be unique in the whole system.
                        The name of the AccountType subtype should be unique in the
                        scope of resource (target system) that it belongs to.
                        </p>

                        <p>
                        This may not be human-readable in a sense to display
                        to a common end-user. It is intended to be displayed to
                        IDM system administrator. Therefore it may contain quite
                        a "ugly" structures such as LDAP DN or URL.
                        </p>

                        <p>
                        Name is considered to be ordinary property of the object.
                        Therefore it can be changed by invoking usual modifyObject
                        operations. However, change of the name may have side
                        effects (rename process).
                        </p>

                        <p>
                		Name is mutable. It can change any time. However, a special
                		handling may be needed in some cases (e.g. "rename" provisioning flow).
                        </p>

                        <p>
                        Although name is specified as optional by this schema, it
                        is in fact mandatory for most object types. The reason for
                        specifying the name as optional is that the name may be
                        generated by the system instead of supplied by the clients.
                        However, all objects stored in the repository must have a name.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                    	<a:displayName>Name</a:displayName>
                    	<a:displayOrder>0</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

            <xsd:element ref="tns:description" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        Free-form textual description of the object.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                    	<a:displayName>Description</a:displayName>
                    	<a:displayOrder>10</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>

			<xsd:element name="fetchResult" type="tns:OperationResultType" minOccurs="0">
				<xsd:annotation>
					<xsd:documentation>
                        <p>
						Result of the operation that fetched this instance of the object.
						It is mostly used to indicate that the object is not complete or
						there is some problem with the object. This is used instead of
						exception if the object is part of larger structures (lists as in
						list/search operations or composite objets). If not present then
						the "SUCCESS" state is assumed.
                        </p>

                        <p>
						This field is TRANSIENT. It must only be used in runtime. It should
						never be stored in the repository.
                        </p>
					</xsd:documentation>
                    <xsd:appinfo>
                        <a:operational/>
                    </xsd:appinfo>
				</xsd:annotation>
			</xsd:element>

            <xsd:element ref="tns:extension" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        Container that provides generic extensibility mechanism.
                        Almost any extension property can be placed in this container.
                        The extension is treated exactly the same as other object
                        properties by the code (storage, modifications, etc), except
                        that the system may not be able to understand their meaning.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
                    	<a:displayName>Extension</a:displayName>
                    	<a:displayOrder>1000</a:displayOrder>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            
	        <xsd:element name="parentOrg" type="tns:OrgType" minOccurs="0" maxOccurs="unbounded">
	            <xsd:annotation>
	                <xsd:appinfo>
	        			<a:objectReference>tns:parentOrgRef</a:objectReference>
	        		</xsd:appinfo>
	            </xsd:annotation>
	        </xsd:element>	
	        <xsd:element name="parentOrgRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
	            <xsd:annotation>
	                <xsd:documentation>
                        <p>
	                    Set of the orgs (organizational units, projects, teams) that the object relates to.
	                    This usually means that the object belongs to them but it may have other meanings as well
	                    (e.g. user manages an organizational unit).
                        </p>
	                </xsd:documentation>
	                <xsd:appinfo>
	        			<a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
	        		</xsd:appinfo>
	            </xsd:annotation>
	        </xsd:element>
	        
	        <xsd:element name="trigger" type="tns:TriggerType" minOccurs="0" maxOccurs="unbounded">
	        </xsd:element>
	        
	        <xsd:element name="metadata" type="tns:MetadataType" minOccurs="0" maxOccurs="1">
	        	<xsd:annotation>
	        		<xsd:documentation>
                        <p>
	        			Meta-data about object creation, modification, etc.
                        </p>
	        		</xsd:documentation>
                    <xsd:appinfo>
                        <a:operational/>
                    </xsd:appinfo>
	        	</xsd:annotation>
	        </xsd:element>
	        
            <xsd:element name="tenantRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        Reference to the tenant to which this object belongs. It is a computed value set automatically
                        by midPoint. It is determined from the organizational structure. Even though this value is
                        compted it is also stored in the repository due to performance reasons.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
            			<a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
            		</xsd:appinfo>
                </xsd:annotation>
            </xsd:element>	       	
            
        </xsd:sequence>
       
        <xsd:attribute name="oid" type="xsd:string" use="optional">
            <xsd:annotation>
                <xsd:documentation>
                    System-wide immutable identifier for the object.
                    Will be probably quite long and not human-readable. It
                    should not be displayed to user. It has no meaning
                    outside of IDM system and should not be directly
                    passed to any third-party systems.

                    This identifier must be unique in the entire system.

                    This attribute is immutable.
                    It cannot be changed. Any operation attempting
                    to change this identifier must fail.

                    OID is not property and therefore cannot be "addressed"
                    in usual operations.

                    OID must be provided for all objects that are persistently
                    stored. There may be detached objects without OID.
                    Such objects have the same structure as normal objects,
                    they are just not stored in the repository. E.g.
                    object that are only stored on resource and are
                    not replicated in the repository. Such objects
                    do not have OID therefore their XML representation
                    cannot contain oid attribute.

                    The OID should be unique in both time and space. That
                    means that OIDs must be unique in the whole system
                    in any moment and should not be re-used. If an object is
                    deleted, the OID of that object should not be used by
                    a new object. The reason is to avoid problems with stale
                    links pointing to a wrong object and appearing valid.
                    However, this is not a strict requirement. Some marginal
                    probability of OID reuse is tolerated. The recommended
                    practice is to add some randomness to the process of
                    OID generation.

                    This attribute is NOT (necessarily) ASN.1 OID and should not
                    be confused with it.

                    The attribute is named "oid" meaning object identifier.
                    It is not named "id" to avoid confusion with xml:id
                    attribute as it is easy to confuse these two if
                    namespace prefix is omitted. The confusion with ASN.1
                    OID id not likely.

                    The oid is XML attribute of this object instead of
                    element because it has special purpose of identifying
                    the object. It is also immutable, therefore we do not
                    need to handle changes to it.
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>

        <xsd:attribute name="version" type="xsd:string" use="optional">
            <xsd:annotation>
                <xsd:documentation>
                    Version for optimistic locking.

                    Contains the version in which this object was read from the
                    repository, fetched from the resource, etc.

                    Type of the version attribute is string, not integer to provide
                    flexibility for various versioning schemes in implementation
                    (e.g. ETags). The type really does not matter, the only
                    things that matters is if the version is the same or different.
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
	</xsd:extension>
	</xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="object" type="tns:ObjectType"/>
    
    <xsd:complexType name="ObjectReferenceType">
        <xsd:annotation>
            <xsd:documentation>
                Reference to an object. It contains OID of the object that it
                refers to.
            </xsd:documentation>
            <xsd:appinfo>
            	<a:objectReference/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="filter" type="q:SearchFilterType" minOccurs="0" maxOccurs="1">
			    <xsd:annotation>
			        <xsd:documentation>
			            Filter that can be used to dynamically lookup the reference OID e.g. during imports.
			            It must not be used for normal operations and references with the filter must not
			            be stored in the repository.
			        </xsd:documentation>
			    </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="oid" type="xsd:string" use="optional">
            <xsd:annotation>
                <xsd:documentation>
                    Target of the reference.

                    Optional only during imports. The objects stored in the repository must have the OID
                    value filled in.
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
        <xsd:attribute name="type" type="xsd:QName" use="optional">
            <xsd:annotation>
                <xsd:documentation>
                    XSD type of the reference target object.

                    It should be provided if the type is known (e.g. when
                    reading object from the repository).

                    The primary reason for this is to have some kind of
                    type safety but especially to be able to use
                    this in the XPaths that specify what references to resolve.
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
        <xsd:attribute name="relation" type="xsd:QName" use="optional">
            <xsd:annotation>
                <xsd:documentation>
                    The relation or a "role" of this reference. It may further specify
                    the meaning of the reference. E.g. it may specify whether the objects
                    linked by the reference are analogous, form a composition, aggregation, etc.
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
    </xsd:complexType>
    <xsd:element name="objectRef" type="tns:ObjectReferenceType"/>

    <xsd:complexType name="ExtensionType">
        <xsd:annotation>
            <xsd:documentation>
                Place for non-standard object properties. The
                elements placed here will be handled exactly
                like the elements in the object body.

                It must NOT contain standard elements.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any minOccurs="0" maxOccurs="unbounded" processContents="lax">
            </xsd:any>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    <xsd:element name="extension" type="tns:ExtensionType" />

    <xsd:complexType name="GenericObjectType">
        <xsd:annotation>
            <xsd:documentation>
                <p>
                Generic object for storing unknown (unexpected) object types.
                </p>

                <p>
                The generic object should be used if there is a need to
                store a custom object (e.g KangarooType) at deployment-time.
                The properties of such custom objects are to be placed in the
                extension part of this object. The schema is not checked or
                enforced for this type of objects if technically possible.
                </p>
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="objectType" type="xsd:anyURI">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Type of the stored object.
                                This attribute contains URI defining the type (class) of
                                stored object. The URI that maps to a QName of an object
                                XML element should be used if possible (see QName
                                mapping above). However this is not mandatory and the
                                implementation must be able to work with any URI.
                                </p>

                                <p>
                                Object type may be changed, but the possible values may
                                be constrained by the implementation. E.g. the implementation
                                may allow to change the object type only to the subtype or
                                supertype, or it may fail if the attributes of the object
                                does not conform to the schema constraints defined for the
                                new type.
                                </p>
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
	<xsd:element name="genericObject" type="tns:GenericObjectType" substitutionGroup="tns:object"/>

	<xsd:complexType name="TriggerType">
       	<xsd:annotation>
    		<xsd:documentation>
    			Defines triggers for an object. Trigger is an action that should take place
                at specified time or under some other condition.
    		</xsd:documentation>
    		<xsd:appinfo>
    			<a:operational>true</a:operational>
    			<a:container/>
    		</xsd:appinfo>
    	</xsd:annotation>
    	<xsd:sequence>
    		<xsd:element name="timestamp" type="xsd:dateTime">
    			<xsd:annotation>
    				<xsd:documentation>
    					The time when a trigger needs to be activated.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="handlerUri" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Handler URI indirectly specifies which class is responsible to handle the task. The handler will
                        to be used to handle trigger activation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
   		</xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
 	</xsd:complexType>

    <xsd:complexType name="MetadataType">
       	<xsd:annotation>
    		<xsd:documentation>
                <p>
    			Meta-data about data creation, modification, etc.
    			It may apply to objects but also parts of the object (e.g. assignments).
                </p>

                <p>
    			Mata-data only apply to successful operations. That is obvious for create, but it also applies
    			to modify. For obvious reasons there are no metadata about delete.
    			We keep no metadata about reading. That would be a huge performance hit.
                </p>

                <p>
    			These data are informational only. They should not be used for security purposes (use auditing
    			subsystem for that). But presence of metadata simplifies system administration and may provide
    			some basic information "at the glance" which may be later confirmed by the audit logs.
                </p>

                <p>
    			Meta-data are also supposed to be searchable. Therefore they may be used to quickly find
    			"candidate" objects for a closer examination.
                </p>
    		</xsd:documentation>
    		<xsd:appinfo>
    			<a:operational>true</a:operational>
    			<a:container/>
                <a:displayName>Metadata</a:displayName>
    		</xsd:appinfo>
    	</xsd:annotation>
    	<xsd:sequence>
    		<xsd:element name="createTimestamp" type="xsd:dateTime" minOccurs="0">
    			<xsd:annotation>
    				<xsd:documentation>
    					The timestamp of data creation. It is set once and should never be changed.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="creatorRef" type="tns:ObjectReferenceType" minOccurs="0">
    			<xsd:annotation>
    				<xsd:documentation>
    					Reference to the user that created the data.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    					<a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="createApproverRef" type="tns:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
    			<xsd:annotation>
    				<xsd:documentation>
    					Reference to the user that approved the creation of the data (if there was such a user).
    					This is multi-value reference therefore multiple approvers may be recorded. However the order and
    					hierarchy of the approvers is lost.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    					<a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="createChannel" type="xsd:anyURI" minOccurs="0" maxOccurs="1">
    			<xsd:annotation>
    				<xsd:documentation>
    					Channel in which the object was created.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="modifyTimestamp" type="xsd:dateTime" minOccurs="0">
    			<xsd:annotation>
    				<xsd:documentation>
    					The timestamp of last data modification. It should be updated to a current time
    					when the object is modified.
    					The modifications that change only operational attributes may not update the
    					modifytimestamp.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="modifierRef" type="tns:ObjectReferenceType" minOccurs="0">
    			<xsd:annotation>
    				<xsd:documentation>
    					Reference to the user that modified the data.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    					<a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="modifyApproverRef" type="tns:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
    			<xsd:annotation>
    				<xsd:documentation>
    					Reference to the user that approved the last modification of the data (if there was such a user).
    					This is multi-value reference therefore multiple approvers may be recorded. Howerver the order and
    					hierarchy of the approvers is lost.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    					<a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="modifyChannel" type="xsd:anyURI" minOccurs="0" maxOccurs="1">
    			<xsd:annotation>
    				<xsd:documentation>
    					Channel in which the object was last modified.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    					<a:indexed>true</a:indexed>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
    	</xsd:sequence>
    </xsd:complexType>


    <!-- Property-related types -->

    <xsd:complexType name="EmptyType">
        <xsd:annotation>
            <xsd:documentation>
                Type that contains nothing.
                Used in WSDL messages that do not return anything to silence the warnings.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:complexType>
    
    <xsd:simpleType name="BeforeAfterType">
        <xsd:annotation>
            <xsd:documentation>
                An enumeration that defines when the activity will be excuted.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="before">
                <xsd:annotation>
                    <xsd:documentation>
                        The activity will be executed before the "main" operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BEFORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="after">
                <xsd:annotation>
                    <xsd:documentation>
                        The activity will be executed after the "main" operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AFTER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    

	<xsd:complexType name="NodeType">
        <xsd:annotation>
            <xsd:documentation>
                Node describes a single installation of midPoint. MidPoint installations can work in cluster.
                The Node objects are the way how the nodes in cluster know about each other.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="nodeIdentifier" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Short, cluster-wide identifier of the node. It may be a hostname or a short number node ID.
                                Very short string is advised as this identifier is used to generate other identifiers
                                (e.g. lightweight IDs), it is used in audit records, etc. 
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="hostname" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Hostname of the node that can be used by other nodes to contact this node over the
                                network.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="jmxPort" type="xsd:int" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Port at which this node can be contacted via JMX.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="lastCheckInTime" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                The time when this node last checked-in.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="running" type="xsd:boolean" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether this node is running, i.e. it can be queried via JMX.
                                (This does not necessarily mean that the scheduler thread and task threads are running!)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="clustered" type="xsd:boolean" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether this node is a part of a cluster. Used to detect misconfigurations.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="internalNodeIdentifier" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Internal (generated) node identifier, used primarily to detect whether
                                the node information was not overwritten by another node.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="executionStatus" type="tns:NodeExecutionStatusType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Actual node status from the point of executing tasks.
                                This field is TRANSIENT. It must only be used in runtime. It should
                                never be stored in the repository.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="errorStatus" type="tns:NodeErrorStatusType">
                        <xsd:annotation>
                            <xsd:documentation>
                                More detailed characterization of the error state.
                                This field is TRANSIENT. It must only be used in runtime. It should
                                never be stored in the repository.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="connectionResult" type="tns:OperationResultType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Result of the operation that connected to this node.
                                This field is TRANSIENT. It must only be used in runtime. It should
                                never be stored in the repository.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:element name="node" type="tns:NodeType" substitutionGroup="c:object"/>

    <xsd:simpleType name="NodeExecutionStatusType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="running">
                <xsd:annotation>
                    <xsd:documentation>
                        Node is running, task scheduler is running.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RUNNING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="paused">
                <xsd:annotation>
                    <xsd:documentation>
                        Node is running, scheduler is paused.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PAUSED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="down">
                <xsd:annotation>
                    <xsd:documentation>
                        Node down (this status is available only for remote nodes, of course).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DOWN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="error">
                <xsd:annotation>
                    <xsd:documentation>
                        Node error (see NodeErrorStatus for more details).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="communicationError">
                <xsd:annotation>
                    <xsd:documentation>
                        Status unknown due to communication error.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="COMMUNICATION_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="NodeErrorStatusType">
        <xsd:annotation>
            <xsd:documentation>
                Status of this node w.r.t. error conditions.
                Generally speaking, if NodeErrorStatus != OK, tasks cannot be scheduled on this node.
                This is a dynamic information, not stored in the repository.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="ok">
                <xsd:annotation>
                    <xsd:documentation>
                        Everything is OK.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="duplicateNodeIdOrName">
                <xsd:annotation>
                    <xsd:documentation>
                        More nodes with the same ID or name (currently ID is the same as name, but in the future they might be different).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DUPLICATE_NODE_ID_OR_NAME"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="nonClusteredNodeWithOthers">
                <xsd:annotation>
                    <xsd:documentation>
                        A non-clustered node runs along other (clustered or non-clustered) nodes.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NON_CLUSTERED_NODE_WITH_OTHERS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="localConfigurationError">
                <xsd:annotation>
                    <xsd:documentation>
                        Local task manager is not configured properly, so it cannot even be started.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOCAL_CONFIGURATION_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="localInitializationError">
                <xsd:annotation>
                    <xsd:documentation>
                        Other kind of initialization error.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOCAL_INITIALIZATION_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="nodeRegistrationFailed">
                <xsd:annotation>
                    <xsd:documentation>
                        It was not possible to register node in repository due to a permanent error.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NODE_REGISTRATION_FAILED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="TaskType">
        <xsd:annotation>
            <xsd:documentation>
                TaskType contains information about a task (either transient or persistent).
                For background information and clarification of various terms used here, please see
                <a href="http://wiki.evolveum.com/display/midPoint/Task+Manager">wiki:Task Manager</a>
                and
                <a href="https://wiki.evolveum.com/display/midPoint/Task">wiki:Task</a>.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="taskIdentifier" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Task (lightweight) identifier. This is an unique identification of any task,
                                regardless whether it is persistent or transient (cf. OID). Therefore this can be used
                                to identify all tasks, e.g. for the purposes of auditing and logging.
                                </p>

                                <p>
                                Task identifier is assigned automatically when the task is created. It is immutable.
                                It is formally set as optional, however it is mandatory for any task to work. Setting
                                it to optional allows creating a task without identifier and generating the identifier
                                during import. However any tasks that live inside midPoint (running or stored in repository)
                                must have valid task identifier.
                                </p>
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="ownerRef" type="tns:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                The user that owns this task. It usually means the user that started the task
                                or a system user that is used to execute the task. The owner will be used to
                                determine access rights of the task, will be used for auditing, etc.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="channel" type="xsd:anyURI" minOccurs="0" maxOccurs="1"/>
                    <xsd:element name="parent" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Parent task, used to implement task hierarchies. A task can have a number of
                                children (subtasks) that carry out some of the work. For example, a parent task
                                can contain a complex model operation, and its subtasks contain individual
                                approvals and/or elementary model operations. If null, this task is a "root-level"
                                task that has no parent.
                                Task identifier (not OID) is used here.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="subtask" type="tns:TaskType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Set of task's subtasks.
                                TRANSIENT attribute. In the repository the parent-child relationship is stored using "parent" property.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:subtaskRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="subtaskRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Set of task's subtasks references.
                                TRANSIENT attribute. In the repository the parent-child relationship is stored using "parent" property.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:TaskType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="dependent" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Dependent tasks, i.e. tasks that wait for the completion of this task.
                                Task identifiers (not OIDs) are used here.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="dependentTask" type="tns:TaskType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Dependent tasks, i.e. tasks that wait for the completion of this task.
                                TRANSIENT attribute. In the repository only the identifiers are stored (see "dependent" attribute).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:dependentTaskRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="dependentTaskRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Dependent tasks references, i.e. tasks that wait for the completion of this task.
                                TRANSIENT attribute. In the repository only the identifiers are stored (see "dependent" attribute).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:TaskType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="executionStatus" type="tns:TaskExecutionStatusType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Execution status provides information about the task overall high-level execution state.
                                It tells whether the task is running/runnable, waits for something or is done.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="waitingReason" type="tns:TaskWaitingReasonType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                What is this task waiting for?
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="node" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Identifier of the node that currently executes this task.
                                (In case of node crash, the value here may be out-of-date.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="nodeAsObserved" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Identifier of the node that executes this task, as observed by querying cluster nodes
                                about tasks that are currently executing.
                                TRANSIENT. This value is not stored in the repository.
                                (It is currently not possible to use it for filtering or sorting.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="category" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Kind of the task, e.g. live sync, reconciliation, workflow, import from resource.
                                Used mainly for the GUI.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="handlerUri" type="xsd:anyURI" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Handler URI indirectly specifies which class is responsible to handle the task. The
                                handler will
                                execute reaction to a task lifecycle events such as executing the task, task heartbeat,
                                etc.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="otherHandlersUriStack" type="tns:UriStack" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                A stack of handlers that should be called after the primary one (handlerUri) finishes.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="result" type="tns:OperationResultType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                OperationResult that is used to compile task results (parent result).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="resultStatus" type="tns:OperationResultStatusType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Top-level state of the 'result' (OperationResultType).
                                It is put here for ease of use - mainly filtering, displaying, and so on.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="objectRef" type="tns:ObjectReferenceType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Object that the task is associated with. Tasks may be associated with a particular
                                objects. For
                                example a "import from resource" task is associated with the resource definition object
                                that it imports from. Similarly
                                for synchronization and reconciliation tasks (cycles).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="lastRunStartTimestamp" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                The time when the task execution was last started.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="lastRunFinishTimestamp" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                The time when the (last) task execution was finished, successfully or unsuccessfully.
                                (If node crashes, this attribute is not updated.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="completionTimestamp" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                The moment when the task was marked as closed. (May be different from
                                lastRunFinishTimestamp, e.g. when task waits for its children to finish
                                and then closes automatically.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="nextRunStartTimestamp" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                The time when the task should start again. (Null if no further execution is scheduled.)
                                TRANSIENT. This value is not stored in the repo, it is queried dynamically.
                                (It is currently not possible to use it for filtering or sorting.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="progress" type="xsd:long" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Relative metric of task progress. The meaning of this attribute
                                is specific to particular task handler.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="stalledSince" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                From which moment is this task stalled (if applicable)?
                                TRANSIENT. This value is not stored in the repo, it is queried dynamically.
                                (It is currently not possible to use it for filtering or sorting.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="expectedTotal" type="xsd:long" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Expected target (goal) value of task progress. Perceived progress
                                is computed as a ratio of progress/expectedTotal. May be null; in that
                                case we just do not know how much progress we should expect.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="recurrence" type="tns:TaskRecurrenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether the task activity is to be executed only once (single-run tasks)
                                or periodically (recurring tasks).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="binding" type="tns:TaskBindingType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether a recurring task is bound tightly to one node (having allocated
                                a thread on this node for the whole time of task execution) or it should
                                by dynamically placed on any suitable node when its execution time comes.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="canRunOnNode" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Whether a task is constrained to be run on a particular node,
                                i.e. it will *not* be executed on a different node.
                                If this attribute is not specified, the task will be executed on any available node.
                                </p>

                                <p>
                                (There may be other constraints on the node(s) where this task may be run,
                                determined e.g. by task handler.)
                                </p>

                                <p>
                                NOTE: This attribute is currently not used; its use is planned.
                                </p>
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="schedule" type="tns:ScheduleType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Task schedule. Specifies when and how often to execute the task.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="threadStopAction" type="tns:ThreadStopActionType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                What is to be done when the thread allocated to this task stops
                                (e.g. via node shutdown or node crash).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:element name="task" type="tns:TaskType" substitutionGroup="c:object"/>

    <xsd:simpleType name="TaskExecutionStatusType">
        <xsd:annotation>
            <xsd:documentation>
                Execution status provides information about the task overall high-level execution state. It tells
                whether the task is running/runnable, waits for something or is done.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="runnable">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is running or is ready to be executed. This state implies that the task is being
                        actively executed by IDM nodes, e.g. there is a thread on one of the IDM nodes that executes the
                        task, or the system needs to allocate such thread, or the task is prepared to be started
                        when a defined time arrives.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RUNNABLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="waiting">
                <xsd:annotation>
                    <xsd:documentation>
                        The IDM system is waiting while the task is being executed on an external node (e.g. external
                        workflow engine) or is waiting for some kind of external signal (e.g. approval in internal
                        workflow). The task may be running on external node or be blocked on IDM node. One way or another,
                        there is no point in allocating a thread to run this task. Other task properties provide more
                        information about the actual "business" state of the task.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WAITING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="suspended">
                <xsd:annotation>
                    <xsd:documentation>
                        The task has been suspended. It waits until an instruction to resume it arrives.
                        After that, it will (usually) go to the RUNNABLE state again. Or, it can be closed
                        in the suspended state as well.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUSPENDED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="closed">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is done. No other changes or progress will happen. The task in this state is considered
                        immutable and the only things that can happen to it is a delete by a cleanup code.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLOSED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="TaskRecurrenceType">
        <xsd:annotation>
            <xsd:documentation>
                Whether the task activity is to be executed only once (single-run tasks)
                or periodically (recurring tasks).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="single">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is executed only once, at the first moment that the schedule
                        specifies. If that moment is in the past, the task will be executed as
                        soon as any execution environment (node) is available.
                        Once the task is finished, it will not be executed again.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SINGLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="recurring">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is executed as many times as the schedule specifies.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RECURRING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="TaskBindingType">
        <xsd:annotation>
            <xsd:documentation>
                Whether a recurring task is bound tightly to one node (having allocated
                a thread on this node for the whole time of task execution) or it should
                by dynamically placed on any suitable node when its execution time comes.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="loose">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is exclusively assigned to a specific node only during its execution.

                        The thread is allocated only for the minimal amount of time.

                        It does not matter which node will execute the task as long as there is an appropriate handler.

                        This is efficient for tasks that take long time to execute and the execution mostly waits
                        (e.g. approvals) or for tasks which have long interval between executions (e.g. reconciliation).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOOSE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="tight">
                <xsd:annotation>
                    <xsd:documentation>
                        Task is exclusively assigned to a specific node from its start to its finish.

                        A thread will be running and allocated for the task all the time.
                        The thread may go to sleep as needed, but during that time the task remains assigned
                        to the node.

                        This is efficient for recurring tasks executed in short intervals, such as live synchronization.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TIGHT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="TaskWaitingReasonType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="otherTasks">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is waiting for other (dependent) tasks - either its subtasks, or tasks explicitly marked
                        as "prerequisites" for this task (via dependentTask property)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OTHER_TASKS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="workflow">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is waiting for a workflow process (that it monitors/shadows) to be finished.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WORKFLOW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="other">
                <xsd:annotation>
                    <xsd:documentation>
                        The task is waiting because of other reason.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OTHER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ThreadStopActionType">
        <xsd:annotation>
            <xsd:documentation>
                What is to be done when the thread allocated to this task stops
                (e.g. via node shutdown or node crash).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="restart">
                <xsd:annotation>
                    <xsd:documentation>
                        The task will be restarted on first node available
                        (i.e. either immediately, if there is a suitable node in the cluster,
                        or later, when a suitable node becomes available).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESTART"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="reschedule">
                <xsd:annotation>
                    <xsd:documentation>
                        The task will be rescheduled according to its schedule
                        (for single-run tasks this is the same as 'restart').
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESCHEDULE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="suspend">
                <xsd:annotation>
                    <xsd:documentation>
                        The task will be suspended.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUSPEND"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="close">
                <xsd:annotation>
                    <xsd:documentation>
                        The task will be closed.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CLOSE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="MisfireActionType">
        <xsd:annotation>
            <xsd:documentation>
                What is to be done when the planned start time arrives without
                the task actually starting.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="executeImmediately">
                <xsd:annotation>
                    <xsd:documentation>
                        The task will be executed immediately.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXECUTE_IMMEDIATELY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="reschedule">
                <xsd:annotation>
                    <xsd:documentation>
                        The task will be rescheduled according to its schedule.
                        This is to be used only for loosely-bound recurring tasks.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESCHEDULE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ScheduleType">
        <xsd:annotation>
            <xsd:documentation>
                Task schedule. Specifies when and how often something should happen.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="earliestStartTime" type="xsd:dateTime" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Earliest time when the task is allowed to start.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="latestStartTime" type="xsd:dateTime" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Latest time when the task is allowed to start.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="latestFinishTime" type="xsd:dateTime" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Latest time when the task is allowed to run.
                        It is the responsibility of the task handler to finish
                        working when this time arrives.

                        NOTE: This attribute is currently not used; its use is planned.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="interval" type="xsd:int" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Interval in seconds between task runs.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="cronLikePattern" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Cron-like pattern specifying time(s) when the task is to be run.
                        Currently only loosely-bound recurring tasks can use this feature.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="misfireAction" type="tns:MisfireActionType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        What is to be done when the planned start time arrives without
                        the task actually starting.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="UriStack">
        <xsd:annotation>
            <xsd:documentation>
                A stack of URIs (used e.g. for managing a stack of handlers to be called when a task is to be run).
                Last URI is considered to be the top of the stack (i.e. the one that will be retrieved first).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="uriStackEntry" type="tns:UriStackEntry" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        An entry of the URI stack.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="UriStackEntry">
        <xsd:annotation>
            <xsd:documentation>
                An entry of the URI stack. It contains the handler URI as well as the schedule under which the handler should be run.
                This allows e.g. to run a "main" handler once, and then run a subhandler under a different schedule (e.g. cyclically).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="handlerUri" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        URI of the task handler.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="recurrence" type="tns:TaskRecurrenceType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Recurrence type of this task (may be null - in that case it is guessed from the schedule).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="schedule" type="tns:ScheduleType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Schedule under which this handler should be executed (may be null).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="binding" type="tns:TaskBindingType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Binding with which this handler should be executed (default = derived from schedule)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="extensionDelta" type="t:ItemDeltaType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        List of deltas that should be put into extension when starting this handler.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="FocusType" abstract="true">
        <xsd:annotation>
            <xsd:documentation>
            	<p>
                    Abstract supertype for all object types that can be focus of midPoint computation.
            	</p>
            </xsd:documentation>
            <xsd:appinfo>
                <a:object/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>

                    <xsd:element name="link" type="tns:ShadowType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:appinfo>
                    			<a:objectReference>tns:linkRef</a:objectReference>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="linkRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Set of shadows linked to this focal object.
                                E.g. a set of accounts linked to a user. This is the set of
                                shadows that belongs to the focal object in a sense
                                that these shadows represents the focal object on the resource.
                                E.g. The set of accounts that represent the same midPoint user (the
                                same physical person, they are "analogous").
                                </p>
                                <p>
                                Links define what the object HAS. The links reflect real state of things (cf. assignment).
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ShadowType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="assignment" type="tns:AssignmentType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Set of object's assignments.
                                Assignments define the privileges and "features" that this object should have, that
                                this object is entitled to. Typical assignment will point to a role or define
                                a construction of an account.
                                </p>
                                <p>
                                Assignments represent what the object SHOULD HAVE. The assignments represent a policy,
                                a desired state of things (cf. linkRef).
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Assignment</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="activation" type="tns:ActivationType" minOccurs="0" maxOccurs="1">
                    </xsd:element>
                    
                    <xsd:element name="iteration" type="xsd:int" minOccurs="0">
                    <xsd:annotation>
                    	<xsd:documentation>
                    		Iteration number. Starts with 0. It is used to iterativelly find unique identifier
                    		for the object.
                    	</xsd:documentation>
                    	<xsd:appinfo>
            				<a:operational>true</a:operational>
            			</xsd:appinfo>
                    </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="iterationToken" type="xsd:string" minOccurs="0">
	                    <xsd:annotation>
	                    	<xsd:documentation>
	                    		Iteration token. String value that is usualy a suffix to the identifier based
	                    		on iteration number. E.g. ".007". It is used to iterativelly find unique identifier
	                    		for the object.
	                    	</xsd:documentation>
	                    	<xsd:appinfo>
	            				<a:operational>true</a:operational>
	            			</xsd:appinfo>
            			</xsd:annotation>
                    </xsd:element>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

	    
    <xsd:complexType name="UserType">
        <xsd:annotation>
            <xsd:documentation>
            	User object represents a physical user of the system.
            	It differs from the account, as account represents a data structure in a target system. One user
            	will typically have many accounts. Properties of User object describe the user as a person. 
            	User object will usually be extended with employee details or customer details, but we define
            	only a handful of the most common properties now. Other properties vary from implementation to
            	implementation can be defined in the schema extension (the in the "extension" element).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:FocusType">
                <xsd:sequence>
                    <xsd:element name="fullName" type="t:PolyStringType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Full name of the user with all the decorations,
                                middle name initials, honorific title and any
                                other structure that is usual in the cultural
                                environment that the system operates in. This
                                element is intended to be displayed to
                                a common user of the system.
                                </p>

                                <p>
                                Examples:
                                    <ul>
                                        <li>cpt. Jack Sparrow</li>
                                        <li>William "Bootstrap" Turner</li>
                                        <li>James W. Random, PhD.</li>
                                        <li>Vladimir Iljic Lenin</li>
                                        <li>Josip Broz Tito</li>
                                        <li>Chuck Norris</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Full Name</a:displayName>
		                    	<a:displayOrder>100</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="givenName" type="t:PolyStringType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Given name of the user. It is usually the first
                                name of the user, but the order of names may
                                differ in various cultural environments. This
                                element will always contain the name that was
                                given to the user at birth or was chosen
                                by the user.
                                </p>

                                <p>
                                Examples:
                                    <ul>
                                        <li>Jack</li>
                                        <li>Chuck</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Given Name</a:displayName>
		                    	<a:displayOrder>110</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="familyName" type="t:PolyStringType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                <p>
                                Family name of the user. It is usually the last
                                name of the user, but the order of names may
                                differ in various cultural environments. This
                                element will always contain the name that was
                                inherited from the family or was assigned
                                to a user by some other means.
                                </p>

                                <p>
                                Examples:
                                    <ul>
                                        <li>Sparrow</li>
                                        <li>Norris</li>
                                    </ul>
                                </p>
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Family Name</a:displayName>
		                    	<a:displayOrder>120</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="additionalName" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Middle name, patronymic, matronymic or any other name of a person. It is usually the
                                middle component of the name, however that may be culture-dependent.

                                Examples: Walker, John, Iljic
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Additional Name</a:displayName>
		                    	<a:displayOrder>130</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="nickName" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Familiar or otherwise informal way to address a person.
                                
                                Examples: Bootstrap, Bobby
                                
                                The meaning of this property is to take part in the formatted full
                                name of the person, e.g. William "Bootstrap" Turner. It is not intended
                                to be used as a username or login name. This value is usually changable
                                by the user itself and it defines how the user wants other to address him. 
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Nickname</a:displayName>
		                    	<a:displayOrder>140</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="honorificPrefix" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Honorific titles that go before the name.

                                Examples: cpt., Ing., Sir

                                This property is single-valued. If more
                                than one title is applicable, they have to be represented in
                                a single string (concatenated) form in the correct order.
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Honorific Prefix</a:displayName>
		                    	<a:displayOrder>150</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="honorificSuffix" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Honorific titles that go after the name.

                                Examples: PhD., KBE

                                This property is single-valued. If more than
                                one title is applicable, they have to be represented in
                                a single string (concatenated) form in the correct order.
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Honorific Suffix</a:displayName>
		                    	<a:displayOrder>160</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="title" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                User's title defining a work position or a primary role in the
                                organization.

                                Examples: CEO, Security Officer, Assistant
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Title</a:displayName>
		                    	<a:displayOrder>170</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="preferredLanguage" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Indicates user's preferred language, usually for the purpose of localizing
                                user interfaces. The format is ISO 639-1 two letter language code and the 
                                ISO 3166-1 two letter country code separated by underscore. If not specified
                                then system default locale is assumed.

                                Examples: en_US, sk_SK
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Preferred Language</a:displayName>
		                    	<a:displayOrder>200</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="locale" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defines user's preference in displaying currency, dates and other items
                                related to location and culture. The format ISO 639-1 two letter language code and the 
                                ISO 3166-1 two letter country code separated by underscore. If not specified
                                then system default locale is assumed.

                                Examples: en_US, sk_SK
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Locale</a:displayName>
		                    	<a:displayOrder>210</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="timezone" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                User's preferred timezone. It is specified in the "tz database" (a.k.a "Olson")
                                format. If not specified then system default timezone is assumed.

                                Examples: Europe/Bratislava
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Timezone</a:displayName>
		                    	<a:displayOrder>220</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="emailAddress" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                E-Mail address of the user. This is the address
                                supposed to be used for communication with the
                                user. E.g. IDM system may send notifications
                                to the e-mail address. It is NOT supposed to be
                                full-featured e-mail address data structure
                                e.g. for the purpose of complex address-book application.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Email Address</a:displayName>
                                <a:displayOrder>300</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="telephoneNumber" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Primary telephone number of the user.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Telephone Number</a:displayName>
                                <a:displayOrder>310</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="employeeNumber" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Unique, business-oriented identifier of the employee.
                                Typically used as correlation identifier and for
                                auditing purposes. Should be immutable, but the
                                specific properties and usage are deployment-specific.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Employee Number</a:displayName>
                                <a:displayOrder>400</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="employeeType" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Employee type specification such as internal employee,
                                external or partner. The specific values are
                                deployment-specific.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Employee Type</a:displayName>
                                <a:displayOrder>410</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="costCenter" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                The name of the cost center.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Cost Center</a:displayName>
                                <a:displayOrder>420</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="organization" type="t:PolyStringType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name or (preferably) immutable identifier of organization that the user belongs to.
                                The format is deployment-specific. This property together with organizationalUnit
                                may be used to provide easy-to-use data about organizational membership of the user.

                                This is multi-valued property to allow membership of a user to several
                                organizations. Please note that midPoint does not maintain ordering in
                                multi-value properties therefore this is not usable to model a complex
                                organization hierarchies. Use OrgType instead.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Organization</a:displayName>
                                <a:displayOrder>430</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="organizationalUnit" type="t:PolyStringType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name or (preferrably) immutable identifier of organizational unit that the user belongs to.
                                The format is deployment-specific. This property together with organization
                                may be used to provide easy-to-use data about organizational membership of the user.

                                This is multi-valued property to allow membership of a user to several
                                organizational units. Please note that midPoint does not maintain ordering in
                                multi-value properties therefore this is not usable to model a complex
                                organization hierachies. Use OrgType instead.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Organizational Unit</a:displayName>
                                <a:displayOrder>440</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="locality" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Primary locality of the user, the place where
                                the user usually works, the country, city or
                                building that he belongs to. The specific meaning
                                and form of this property is deployment-specific.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Locality</a:displayName>
                                <a:displayOrder>450</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="jpegPhoto" type="xsd:base64Binary" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Photo of the user.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Jpeg photo</a:displayName>
                                <a:displayOrder>460</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="credentials" type="tns:CredentialsType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                The set of user's credentials (such as passwords).
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Credentials</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="result" type="tns:OperationResultType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                User's result for the operation. e.g. set by recompute status.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="user" type="tns:UserType" substitutionGroup="c:object"/>


    <xsd:complexType name="CredentialsType">
        <xsd:annotation>
            <xsd:documentation>
                This is a container type for various credentials types: passwords, public keys, one-time password
                scheme identifiers, etc. However, we expect that password will be the most widely used credential
                type and that's actually also the only supported type.

                The reason to "formalize" this structure is the ability to synchronize credentials. If the password
                would be just an ordinary attribute, we cannot automatically synchronize user and account passwords.
                Similarly as other credential types.
                Note: marking password with a special attribute type will not be enough. There may be numerous passwords
                with various meanings, we need to distinguish the "primary" one to synchronize. We also need to store
                user password somewhere.

                This is not perfect. It may change in the future.

                TODO: support for "old password", e.g. some resource need it to change password.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="password" type="tns:PasswordType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>Password</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="securityQuestions" type="tns:SecurityQuestionsCredentialsType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:displayName>Security Questions</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <!-- More credentail types may be here, such as OTP seeds, X.509 credentials, 
				etc. -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    <xsd:element name="credentials" type="tns:CredentialsType"/>
    
    <xsd:complexType name="AbstractCredentialType" abstract="true">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="failedLogins" type="xsd:int" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The number of failed logins. It should be
                        increased after every unsuccessful use of
                        the credential. It may be reset after
                        successful login or a time-out or may not.
                        It depends on the policy setting. If
                        not present, value of zero (0) is assumed.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="lastSuccessfulLogin" type="tns:LoginEventType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of last successful login attempt.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="previousSuccessfulLogin" type="tns:LoginEventType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of successful before the last login attempt.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="lastFailedLogin" type="tns:LoginEventType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of last successful login attempt.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>

    <xsd:complexType name="PasswordType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:AbstractCredentialType">
        		<xsd:sequence>
            		<xsd:element name="value" type="t:ProtectedStringType" minOccurs="0"/>
            	</xsd:sequence>	
        	</xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    
    <xsd:complexType name="SecurityQuestionsCredentialsType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:AbstractCredentialType">
        		<xsd:sequence>
            		<xsd:element name="questionAnswer" type="tns:SecurityQuestionAnswerType" minOccurs="0" maxOccurs="unbounded"/>
            	</xsd:sequence>	
        	</xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    
    <xsd:complexType name="SecurityQuestionAnswerType">
    	<xsd:annotation>
    		<xsd:documentation>
    			Answer to the security question. This is a "personalized" answer and it is supposed to
    			be associated with a single user. However, it may also optionally contain a question.
    			E.g. in case a user specified a custom question.
    		</xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
    	</xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="questionIdentifier" type="xsd:anyURI" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				Identifier of a question that this answer applies to. It is expected to be
        				present only if this is an answer to a "configured question", i.e. a question
        				that is defined in a security policy.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	
        	  	<xsd:element minOccurs="0" maxOccurs="1" name="questionAnswer" type="t:ProtectedStringType">
        		<xsd:annotation>
        			<xsd:documentation>
        				Answer to the question
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	
        	  <xsd:element name="enabled" type="xsd:boolean" minOccurs="0" default="true">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>Flag indicating if this synchronization specification is enabled. If it is not,
                        then the system will ignore this definition.
                        If enabled, the synchronization should start with most recent change
                        after enabling synchronization. It will NOT pull in even the changes that
                        were done during disabled synchronization.</p>

                        <p>If this flag is not present the synchronization is assumed to be enabled.
                        This flag is meant to act as a tool to temporarily disable synchronization without loosing the
                        configuration and and state or for forcing the synchronization engine to "skip" some changes.</p>
                        
                        <p>Note that this is different than disabling/deleting the synchronization task. If the task
                        is stopped, midPoint will not poll for changes at all. This means that the changes will
                        still be "pending" on the resource and once the task is enabled it will pull such changes.
                        On the other hand, disabling synchronization using this flag and leaving the task running will
                        "acknowledge" all changes without doing anything.</p>
                        
                        <p>Also note that disabling synchronization using this flag will disable all the flavors, e.g.
                        it will also disable import from resource.</p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <!--  TODO: sabri  -->
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LoginEventType">
        <xsd:sequence>
            <xsd:element name="timestamp" type="xsd:dateTime" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The date and time of login attempt.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="from" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The source from where the login came. It is supposed to be human-readable,
                        e.g. a hotname, IP address, etc.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AssignmentType">
        <xsd:annotation>
            <xsd:documentation>
                Generic assignments of one object to another object.
                This will usually be assignment of a role to a user, assignment of an
                organizational unit, team or whatever. It may also be used to assign
                role to another role, creating a role hierarchy.

                Assignment is an abstract concept. It can be anything that
                gives the "receptor" object additional access rights, privileges,
                capabilities or similar ability or right. But it may also constraint
                the object with policy, e.g. to implement separation of duties. Roles,
                organizations and privileges in IDM system are examples of assignments.

                The assignment may target either existing IDM object (such as a role)
                or abstract resource account that may or may not exist. In case of resource
                objects it is constrained to accounts, as accounts are the only resource objects
                that can be assigned to a user. Other resource objects (entitlements) can
                be assigned to accounts, but not to users.

                TODO: constraints

            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>Assignment</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        
        	<xsd:element ref="tns:description" minOccurs="0"/>
        
        	<xsd:element ref="tns:extension" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				The assignment extension used to add parameters to the assignment.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	
        	<xsd:element name="metadata" type="tns:MetadataType" minOccurs="0"/>
        
            <xsd:choice>

                <xsd:element name="target" type="tns:ObjectType" minOccurs="0">
                    <xsd:annotation>
                        <xsd:documentation>
                            TODO: target
                        </xsd:documentation>
                        <xsd:appinfo>
                    		<a:objectReference>tns:targetRef</a:objectReference>
                            <a:displayName>Target</a:displayName>
                    	</xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>

                <xsd:element name="targetRef" type="c:ObjectReferenceType" minOccurs="0">
                    <xsd:annotation>
                        <xsd:documentation>
                            TODO: target ref
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>Target</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
                
                <xsd:element name="construction" type="tns:ConstructionType" minOccurs="0">
                    <xsd:annotation>
                        <xsd:documentation>
                            TODO
                        </xsd:documentation>
                        <xsd:appinfo>
                            <a:displayName>Construction</a:displayName>
                        </xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
                
                <xsd:element name="focusMappings" type="tns:MappingsType" minOccurs="0">
                    <xsd:annotation>
                        <xsd:documentation>
                            Set of mappings that are applied to a focus in addition to object template.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>

            </xsd:choice>

            <xsd:element name="activation" type="tns:ActivationType" minOccurs="0"/>

			<xsd:element name="order" type="xsd:int" minOccurs="0"/>
			<xsd:element name="focusType" type="xsd:QName" minOccurs="0"/>
			
			<xsd:element name="tenantRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        Reference to the tenant to which this assignment refers. This is an argument to the target of this
                        assignment. E.g. is if frequently used to parametrize the role which is assigned by this assignment.
                        However the exact interpretation of this value depends on the logic of the target role. It may be
                        significant or it may be entirely ignored.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
            			<a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
                        <a:displayName>Tenant reference</a:displayName>
            		</xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            
            <xsd:element name="condition" type="tns:MappingType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The assignment is applied only if the condition is evaluated to true.
                        If condition is not present, it is assumed to be true.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>

    <xsd:element name="assignment" type="tns:AssignmentType"/>
    
    <xsd:complexType name="MappingsType">
        <xsd:annotation>
            <xsd:documentation>
                Generic set of mappings.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
       	<xsd:sequence>
       		<xsd:element ref="tns:description" minOccurs="0"/>
   			<xsd:element name="mapping" type="tns:MappingType" minOccurs="0" maxOccurs="unbounded">
                   </xsd:element>
       </xsd:sequence>
	</xsd:complexType>

    <xsd:complexType name="ActivationType">
        <xsd:annotation>
            <xsd:documentation>
                Type that defines activation properties. Determines whether something is active
                (and working) or inactive (e.g. disabled).

                It applies to several object types. It may apply to user, account, assignement, etc.
                The data in this type define if the described concept is active, from when it is active
                and until when. The "active" means that it works. If something is not active, it should
                not work or not cause any effect. E.g. inactive user should not be able to log in or run
                any tasks, the non-active role should not be assigned and if assigned it should not be
                taken into account when computing the accounts.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
                <a:displayName>Activation</a:displayName>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="administrativeStatus" type="tns:ActivationStatusType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        This defines the "administrative state", i.e. the administrator's decision.
                        If set, this property overrides any other constraints in the activation type.
                        E.g. if this is set to "enabled" and the object is not yet valid (according to
                        validFrom below), the user should be considered active. If set to "disabled" the
                        user should be considered inactive regardless of other settings.

                        Therefore this property does NOT define an actual state of
                        the object. It is a kind of "manual override".

                        If this property is not present then the other constraints in the activation type
                        should be considered.

                        If not present and there are no other constraints in the activation type or if there
                        is no activation type at all then the values is assumed to be "disabled", i.e. that the
                        described concept is inactive.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>Administrative Status</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="effectiveStatus" type="tns:ActivationStatusType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        This defines the "effective state", i.e. the result of combining several
                        activation settings (administrative status, validity dates, etc.).
                        
                        This holds the result of a computation, therefore it is kind of VIRTUAL property
                        that is recomputed every time. It SHOULD NOT be set directly but it rather should be
                        computed from the values of other activation properties. Therefore it is considered
                        READ ONLY for the high-level code. It may be stored in the repository but in that
                        case it has only an informational value (the effective activation status at the time
                        the object was last updated).

                        If this property is not present then the computation haven't taken place yet.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>Effective Status</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="validFrom" type="xsd:dateTime" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        A date from which is should the object be considered active.
                        Not applied if the "enabled" flag is set to any value.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>Valid From</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="validTo" type="xsd:dateTime" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        A date to which is should the object be considered active.
                        Not applied if the "enabled" flag is set to any value.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>Valid To</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="validityStatus" type="tns:TimeIntervalStatusType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        This property holds the result of vality period computation with respect to the current
                        date and time. E.g. it specifies whether the entity is before the validity period,
                        in the validity perion or after validity period.
                        
                        This holds the result of a computation, therefore it is kind of VIRTUAL property
                        that is recomputed every time. It SHOULD NOT be set directly but it rather should be
                        computed from the values of validity timestamps and current time. Therefore it is considered
                        READ ONLY for the high-level code. It may be stored in the repository but in that
                        case it has only an informational value (the effective activation status at the time
                        the object was last updated).

                        If this property is not present then the computation haven't taken place yet.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>Validity Status</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="disableReason" type="xsd:anyURI" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			URL that identifies a reason for disable. This may be indication that that identity
            			was disabled explicitly, that the disable status was computed or other source of the
            			disabled event.
            		</xsd:documentation>
            		<xsd:appinfo>
            			<a:operational>true</a:operational>
            		</xsd:appinfo>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="disableTimestamp" type="xsd:dateTime" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Timestamp of last modification of the activation status to the disabled state.
            			Note: This timestamp is used for recording purposes. Changing it will NOT change
            			the activation state.
            		</xsd:documentation>
            		<xsd:appinfo>
            			<a:operational>true</a:operational>
            		</xsd:appinfo>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="enableTimestamp" type="xsd:dateTime" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Timestamp of last modification of the activation status to the enabled state.
            			Note: This timestamp is used for recording purposes. Changing it will NOT change
            			the activation state.
            		</xsd:documentation>
            		<xsd:appinfo>
            			<a:operational>true</a:operational>
            		</xsd:appinfo>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="archiveTimestamp" type="xsd:dateTime" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Timestamp of last modification of the activation status to the archived state.
            			Note: This timestamp is used for recording purposes. Changing it will NOT change
            			the activation state.
            		</xsd:documentation>
            		<xsd:appinfo>
            			<a:operational>true</a:operational>
            		</xsd:appinfo>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="validityChangeTimestamp" type="xsd:dateTime" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Timestamp of last modification of the effective validity state, i.e. last time the validity
            			state was recomputed with result that was different than the previous recomputation. It is
            			used to avoid repreated validity change deltas.
            			Note: This timestamp is used for recording purposes. Changing it will NOT change
            			the activation state.
            		</xsd:documentation>
            		<xsd:appinfo>
            			<a:operational>true</a:operational>
            		</xsd:appinfo>
            	</xsd:annotation>
            </xsd:element>
            
            <xsd:element name="lockoutStatus" type="tns:LockoutStatusType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        This defines the state of user or account lock-out. Lock-out means that the account
                        was temporarily disabled due to failed login attempts or a similar abuse attempt.
                        
                        This value is usualy set by the resource (or midpoint internal authentication code).
                        It is unlikely that it can be set to the "locked" value. However it usually can be used
                        to unlock the account by setting this property to "normal" value.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>Lock-out Status</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            
            <xsd:element name="lockoutExpirationTimestamp" type="xsd:dateTime" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Timestamp of a moment when account lockout expires and the account will
                        be normally usable again.
                        
                        This is only an informational value. It should be considered as read-only
                        for most cases. It only makes sense if the lockoutStatus is not in the "normal" state.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:displayName>Lock-out Expiration</a:displayName>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    
    <xsd:simpleType name="ActivationStatusType">
        <xsd:annotation>
            <xsd:documentation>
                An enumeration that indicates the activation status of a particular entity.
                The activation status detemines whether the entity is active (enabled)
                or inactive (disabled, archived, etc.). Please see documentation of individual
                enumaration values for more details.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="enabled">
                <xsd:annotation>
                	<xsd:documentation>
                		The entitity is active.
                		
                		It is enabled and fully operational.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="disabled">
                <xsd:annotation>
                	<xsd:documentation>
                		The entitity is inactive.
                		
                		It has beed disabled, haven't reaced the activation period, etc.
                		This is used to idicate that the entity is TEMPORARILY inactive
                		and there is an intent to enabled the entity later.
                		
                		usualy used for an employee on parental leave, sabatical, temporarily disabled
                		account for security reasons, etc.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DISABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="archived">
                <xsd:annotation>
                	<xsd:documentation>
                		The entitity is inactive.
                		
                		It is no longer active and there are no plans to ever re-activate it.
                		This is a PERMANENT state of deactivation.
                		
                		This state is used to keep the user record or accoutn around for archival purposes.
                		E.g. some systems require that the account exists to maintain referential consistency
                		of historical data, audit records, etc. It may also be used to "blocks" the user or account
                		identifier to avoid their reuse. 
                		
                		usualy used for retired employees and similar cases. 
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ARCHIVED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:simpleType name="TimeIntervalStatusType">
        <xsd:annotation>
            <xsd:documentation>
                Holds the result of time interval computation with respect to the current
                date and time. E.g. it specifies whether the entity is before the interval,
                in the interval or after the interval.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="before">
                <xsd:annotation>
                	<xsd:documentation>
                		Current time and date is before the interval.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BEFORE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="in">
                <xsd:annotation>
                	<xsd:documentation>
                		Current time and date is in the interval.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="after">
                <xsd:annotation>
                	<xsd:documentation>
                		Current time and date is after the interval. 
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AFTER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:simpleType name="LockoutStatusType">
        <xsd:annotation>
            <xsd:documentation>
                This defines the state of account lock-out. Lock-out means that the account
                was temporarily disabled due to failed login attempts or a similar abuse attempt.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="normal">
                <xsd:annotation>
                	<xsd:documentation>
                		Account is in normal (unlocked state). It is usable without limitations.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NORMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="locked">
                <xsd:annotation>
                	<xsd:documentation>
                		The account has been locked. Log-in to the account is temporarily disabled.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LOCKED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ResourceType">
        <xsd:annotation>
            <xsd:documentation>
                Resource represents a system or component external to the IDM
                system which we manage. It is sometimes called _IT resource_,
                _target system_, _source system_, _provisioning target_,
                etc.
                IDM system connects to it to create accounts, assign
                accounts to groups, etc. But it also may be an authoritative source of
                data, system that maintains lookup tables, database that
                contains organizational structure, etc. The {{Resource}} 
                provides a combination of several functions (e.g.
                both provisioning and authoritative data for some attributes).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
                	<xsd:element name="operationalState" type="tns:OperationalStateType" minOccurs="0"/>
                    <xsd:element name="connector" type="tns:ConnectorType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                "Composite" version of the ConnectorType reference. See below for more details.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReference>tns:connectorRef</a:objectReference>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="connectorRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the connector that implements specified resource.

                                Connector reference is MANDATORY. Although the
                                schema does not enforce it (due to various JAXB
                                reasons), exactly one of the connecotor or
                                connectorRef MUST be present in the resource object.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ConnectorType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="connectorConfiguration" type="tns:ConnectorConfigurationType"/>
                    <xsd:element name="namespace" type="xsd:anyURI" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Resource private namespace. This is the namespace            
                                that is private for a specific resource INSTANCE.
                                It may be used by the connector e.g. to generate
                                instance-specific resource schema or for other
                                purposes. If not set a default namespace is assumed.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element ref="tns:schema" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Schema for resource objects.

                                This element contains the XSD-formatted definition
                                of resource schema. It defines data types for
                                accounts, groups, roles, entitlements,
                                organizational units or any other objects
                                related to identity management that the resource
                                supports.

                                Resource schema is only available at run-time
                                and can be diffrent for every resource instance,
                                even for resource instances of the same type.
                                It is supposed to be dynamically interpreted in
                                run-time.

                                Schema defines data types (XSD types), but it
                                does NOT define how these types are handled.
                                E.g. it defines attributes and object class for
                                inetOrgPerson, that it has "cn" attribute which
                                is multi-valued string, etc.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element ref="tns:schemaHandling" minOccurs="0"/>
                    <xsd:element name="capabilities" type="tns:CapabilitiesType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                            	TODO: update
                            	
                                The capabilities supported by the resource, including both native capabilities of
                                the connector and simulated capabilities.
                                If this element is not present at all, the value of nativeCapabilities element is
                                assumed.
                                The value of this element is not generated, it should be set by the administrator.
                                The value of this element indicates administrator decisions what connector capabilities
                                to use, what capabilities to simulate and how to simulate them.
                                
                                The valus of this element indicates what the connector is allowed to do.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="scripts" type="tns:OperationProvisioningScriptsType" minOccurs="0"/>
                    <xsd:element name="projection" type="tns:ProjectionPolicyType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Resource-wide account synchronization settings.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="consistency" type="tns:ResourceConsistencyType" minOccurs="0"/>
                    <xsd:element ref="tns:synchronization" minOccurs="0"/>
                    <xsd:element name="business" type="tns:ResourceBusinessConfigurationType" minOccurs="0"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="resource" type="tns:ResourceType"/>
    
    <xsd:complexType name="OperationalStateType">
        <xsd:annotation>
            <xsd:documentation>
                Structure containing metada about operational state of the resource.
                E.g. if resource is up or down, when it was last checked, etc.
                It should not contain configuration, just the operational state.
            </xsd:documentation>
            <xsd:appinfo>
            	<a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="lastAvailabilityStatus" type="tns:AvailabilityStatusType" minOccurs="0"/>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    
    <xsd:simpleType name="AvailabilityStatusType">
        <xsd:annotation>
            <xsd:documentation>
                The enum describes the availability of the resource, if it is down, unreachable or ok. 
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="down">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DOWN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="up">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UP"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="XmlSchemaType">
        <xsd:annotation>
            <xsd:documentation>
                This element contains the XSD-formatted definition of schema.

                The schema available in this definition is expeceted to comply
                to the usual midPoint schema structure (properties, property
                containers), although it should not contain objects (persistent
                objects identified by OID).
                
                Note: This schema is considered to be available only in run-time.
                Therefore code-generation methods such as JAXB cannot be applied
                here.

                Note: xsd:any is here, but maybe a stricter type would be preferable.
                However xsd:any seems to be a common practice (e.g. SPML, WSDL).
                
                TODO: rename to CachedSchemaType
            </xsd:documentation>
            <xsd:appinfo>
            	<a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:cachingMetadata" minOccurs="0"/>
            <xsd:element name="generationConstraints" type="tns:SchemaGenerationConstraintsType" minOccurs="0"/>
            <xsd:element name="definition" type="t:SchemaDefinitionType" minOccurs="0"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="schema" type="tns:XmlSchemaType"/>
    
    <xsd:complexType name="CachingMetadataType">
        <xsd:annotation>
            <xsd:documentation>
                Metadata that record when a cache copy was retrieved, the identifiers (etags) of that
                copy and possibly also other data. It is used to guide cache coherence policies and
                cache management in general.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="retrievalTimestamp" type="xsd:dateTime" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        The timestamp of a time moment when the object was retrieved from the source.
                        Used mostly for diagnostics and general visibility. As this is relativelly rough
                        granularity and the time in distributed system is relative anyway, it is not really
                        useful for anything else.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="serialNumber" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        A string that uniquely represents the version of the data that was retrieved.
                        The objects of the same type and origin with the same serial number are assumed to
                        be the same.
                        There is no requirement for this to be identifier - the serialNumber cannot be used
                        to retrieve the object.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="cachingMetadata" type="tns:CachingMetadataType"/>
    
    <xsd:complexType name="SchemaGenerationConstraintsType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="generateObjectClass" type="xsd:QName" minOccurs="0" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			Specification of an object class that has to be automatically generated into a schema.
            			If at least one generateObjectClass specification is present then only the objectclasses
            			specified by the generateObjectClass elements will be generated an no other object class
            			will be passed into the schema.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SchemaHandlingType">
        <xsd:annotation>
            <xsd:documentation>
                Specification of handling details for resource
                schema. E.g. read-only or read-write attributes,
                account object classes, etc.

                This element belongs to ResourceType and should
                not be used elsewhere. This is a top-level
                element to make the implementation
                (JAXB marshall/unmarshall) easier.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        <xsd:element name="objectType" type="tns:ResourceObjectTypeDefinitionType" minOccurs="0"
                         maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="schemaHandling" type="tns:SchemaHandlingType"/>

    <xsd:complexType name="ResourceObjectTypeDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Defines a type from the resource schema (object class)
                that can be used for creating accounts, entitlements and possible other concepts.
                This is abstract supertype for other types. 
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="kind" type="tns:ShadowKindType" minOccurs="0"/>
        	<xsd:element name="intent" type="xsd:string" minOccurs="0"/>
            <xsd:element ref="tns:displayName" minOccurs="0" maxOccurs="1"/>
            <xsd:element ref="tns:description" minOccurs="0"/>
            <xsd:element name="default" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies whether this type is the default type for the resource.
                        Only one type for each class can be default. Setting this flag to true for more than one type is
                        an error. If the flag is not set, the value is inherited from resource schema. If the resource 
                        schema does not have this flag set, the default value is false.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="objectClass" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        XSD type from the resource schema (Object Class) that should be used for accounts
                        on this resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="attribute" minOccurs="0" maxOccurs="unbounded"
                         type="tns:ResourceAttributeDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Specification of handling of an account attribute.
                        This overrides annotations in the resource schema.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="dependency" type="tns:ResourceObjectTypeDependencyType" minOccurs="0" maxOccurs="unbounded"/>
         	<xsd:element name="association" type="tns:ResourceObjectAssociationType" minOccurs="0" maxOccurs="unbounded"/>
         	<xsd:element name="assignmentPolicyEnforcement" type="tns:AssignmentPolicyEnforcementType" minOccurs="0"/>
            <xsd:element name="iteration" type="tns:IterationSpecificationType" minOccurs="0"/>
            <xsd:element name="protected" type="tns:ResourceObjectPatternType" minOccurs="0" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			Specification of a protected account: account that cannot be affected by IDM. It will be
            			ignored by operations, will not appear in lists, etc. 
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>         	
            <xsd:element name="activation" minOccurs="0" type="tns:ResourceActivationDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of activation handling for this account type.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="credentials" minOccurs="0" type="tns:ResourceCredentialsDefinitionType">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of credentials handling for this account type.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="pagedSearches" minOccurs="0" type="xsd:anyType">
                <xsd:annotation>
                    <xsd:documentation>
                        Placeholder for old-style specification of paged searches.
                        Kept here just to avoid parsing errors when reading the configuration.
                        DEPRECATED. The value is ignored.
                        TODO remove before release
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:deprecated/>
                        <a:rawType/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="configuredCapabilities" type="c:CapabilityCollectionType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        The configured capabilities of the resource specific to this object type.

                        This part contains "tweaks" of the native capabilities.
                        Some of the native capabilities may be turned off, other capabilities may be simulated.

                        If this element is not present at all then the native+configured capabilities
                        at the resource level are applied.

                        BEWARE: Currently, only pagedSearch and addRemoveAttributeValues capability is expected here.
                        Other capabilities listed in this section are ignored.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ResourceConsistencyType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of consistency mechanisms. This may include configuration of high-level
                operation retries and similar technical configuration.
            </xsd:documentation>
            <xsd:appinfo>
            	<a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="avoidDuplicateValues" type="xsd:boolean" minOccurs="0" default="false"/>
            <xsd:element name="caseIgnoreAttributeNames" type="xsd:boolean" minOccurs="0" default="false">
                <xsd:annotation>
                    <xsd:documentation>
                        Should we ignore casing of names of attributes retrieved from the connector?
                        If yes, we normalize any attribute names with regard to the resource schema.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        	<xsd:element name="postpone" type="xsd:boolean" minOccurs="0" default="true"/>
        	<xsd:element name="discovery" type="xsd:boolean" minOccurs="0" default="true"/>
            <!-- TODO -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    
    <xsd:complexType name="ResourceBusinessConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of resource "business" aspects such as workflow parameters, notifications,
                approvers, owners, etc.
            </xsd:documentation>
            <xsd:appinfo>
            	<a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="administrativeState" type="tns:ResourceAdministrativeStateType" minOccurs="0"/>
            <xsd:element name="approverRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the resource approver(s).
                                It may point to user or organization.
                                If more than one approver is specified they are considered equivalent. Any
                                of the specified approvers may approve the request.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    
    <xsd:simpleType name="ResourceAdministrativeStateType">
        <xsd:annotation>
            <xsd:documentation>
                The state of the resource how the administrator want it to be. Overrides the real
                availability status.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="enabled">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="disabled">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DISABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="ShadowDiscriminatorType">
    	<xsd:annotation>
    		<xsd:documentation>
    			Shadow discriminator uniquely identifies a projection among other projections linked to the
    			same focus.
    		</xsd:documentation>
    	</xsd:annotation>
    	<xsd:sequence>
			<xsd:element name="resourceRef" type="c:ObjectReferenceType" minOccurs="0">
            	<xsd:annotation>
	                <xsd:documentation>
	                    Reference to a resource that is the target of reference. It may be implicit in some cases.
	                </xsd:documentation>
	                <xsd:appinfo>
	            		<a:objectReferenceTargetType>tns:ResourceType</a:objectReferenceTargetType>
	            	</xsd:appinfo>
	            </xsd:annotation>
	       	</xsd:element>
	       	<xsd:element name="kind" type="tns:ShadowKindType" minOccurs="0" default="account"/>
            <xsd:element name="intent" type="xsd:string" minOccurs="0" default="default">
                <xsd:annotation>
                    <xsd:documentation>
                        Type of projection that is the target of reference. E.g "default", "admin", "testing"
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
    	</xsd:sequence>
    </xsd:complexType>
    
   <xsd:complexType name="ResourceObjectTypeDependencyType">
   		<xsd:complexContent>
   			<xsd:extension base="tns:ShadowDiscriminatorType">
   				<xsd:sequence>
   					<xsd:element name="strictness" type="tns:ResourceObjectTypeDependencyStrictnessType" minOccurs="0"/>
   					<xsd:element name="order" type="xsd:int" minOccurs="0" default="0">
   						<xsd:annotation>
   							<xsd:documentation>
   								Specifies the order in which the dependency is applied. Lower-order dependencies
   								are applied before higher-order dependencies. Dependencies with the same order
   								are applied at the same time. There must be no circular dependency formed from
   								dependencies of the same order.
   							</xsd:documentation>
   						</xsd:annotation>
   					</xsd:element>
   					<xsd:element name="forceLoad" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false">
   						<xsd:annotation>
   							<xsd:documentation>
   								Specifies if the shadow on which we depends has to be load. By default we do
   								not force to load full dependent shadow.
   							</xsd:documentation>
   						</xsd:annotation>
   					</xsd:element>
   				</xsd:sequence>
   			</xsd:extension>
   		</xsd:complexContent>
   </xsd:complexType>
   
   <xsd:simpleType name="ResourceObjectTypeDependencyStrictnessType">
        <xsd:annotation>
            <xsd:documentation>
                TODO 
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="strict">
                <xsd:annotation>
                	<xsd:documentation>
                		If the object that we depend on is not provisioned then the dependent object will
                		not be provisioned either. Attempt to provision it will end up with an error.
                		If the object that we depend on is being provisioned in the same operation (context) as
                		the dependent object then they will be provisioned in order: independent first, dependent second.
                		Proper inbound-template-outbound sequence of mapping will be executed between the provisionings.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STRICT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="relaxed">
                <xsd:annotation>
                	<xsd:documentation>
                		If the object that we depend on is being provisioned in the same operation (context) as
                		the dependent object then they will be provisioned in order: independent first, dependent second.
                		Proper inbound-template-outbound sequence of mapping will be executed between the provisionings.
                		But no error is thrown if the dependent object is provisioned without the other object.
                		If both objects are being provisioned in the same operation (context) and provisioning of the
                		object that we depend on fails the provisioning of the dependent object will be skipped.
                		The relaxed strictness guarantees ordering in case that both objects are being provisioned 
                		in the same operation (context) and delaying of the operation on dependent resource in case
                		the operation on independent resource fails.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RELAXED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="lax">
                <xsd:annotation>
                	<xsd:documentation>
                		If the object that we depend on is being provisioned in the same operation (context) as
                		the dependent object then they will be provisioned in order: independent first, dependent second.
                		Proper inbound-template-outbound sequence of mapping will be executed between the provisionings.
                		But NO ERROR is thrown if the dependent object is provisioned without the other object. Not even if
                		they are provisioned in the same operation (context) an the independent object fails.
                		The lax strictness only guarantees ordering in case that both objects are being (successfully) provisioned.
                		It does not guarantee anything else.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LAX"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ItemRefinedDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Description of the common item handling details, such as display name,
                read/write access and value and synchronization expressions.
                These are the parts that are common to both attributes and associations.
                
                This is supposed to be used in schemaHandling part and therefore
                describe the decisions of the system administrator about the
                way how that attribute or association is used in midPoint.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="ref" type="t:ItemPathType">
                <xsd:annotation>
                    <xsd:documentation>
                        Path of the item or association that this
                        definition describes. It must point to property or the
                        attribute in the resource schema that belongs to an
                        object class that is being described here.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element ref="tns:displayName" minOccurs="0" maxOccurs="1"/>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="displayOrder" type="xsd:int" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="limitations" type="tns:PropertyLimitationsType" minOccurs="0" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			Limits the usage of the attribute, e.g. whether it may is read-only, read write or entirely ignored.
            			The limitations may apply to several system layers, therefore this element may be repeated several times.
            			But it there may be only one instance for each layer.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="matchingRule" type="xsd:QName" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Specification of a mathing rule for an attribute. Matching rule is used to compare values
            			of the attribute. The default rule is a literal comparison which is good for most attribute
            			types and for case-sensitive strings. An alternative matching rule may be specified e.g.
            			for case insensitive strings.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="valueEnumerationRef" type="c:ObjectReferenceType" minOccurs="0">
            	<xsd:annotation>
	                <xsd:documentation>
	                    Reference to an object that directly or indirectly represents possible values for
						this item. We do not define here what exactly the object has to be. It can be a lookup
						table, script that dynamically produces the values or anything similar. 
						The object must produce the values of the correct type for this item otherwise an
						error occurs.
	                </xsd:documentation>
	            </xsd:annotation>
	       	</xsd:element>
        </xsd:sequence>
    </xsd:complexType>

	<xsd:complexType name="ResourceItemDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Description of the common item handling details, such as display name,
                read/write access and value and synchronization expressions.
                These are the parts that are common to both attributes and associations.
                
                This is supposed to be used in schemaHandling part and therefore
                describe the decisions of the system administrator about the
                way how that attribute or association is used in midPoint.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:ItemRefinedDefinitionType">
        		<xsd:sequence>
		            <xsd:element name="exclusiveStrong" type="xsd:boolean" minOccurs="0" default="false">
		            	<xsd:annotation>
		            		<xsd:documentation>
		            			When set to false then both strong and normal mapping values are merged to produce
		            			the final set of values.
		            			When set to true only strong values are used if there is at least one strong mapping.
		            			Normal values are used if there is no strong mapping.
		            		</xsd:documentation>
		            	</xsd:annotation>
		            </xsd:element>
		            <xsd:element name="tolerant" type="xsd:boolean" minOccurs="0" default="true">
		            	<xsd:annotation>
		            		<xsd:documentation>
		            			When set to true, allows attribute values that are set outside midPoint.
		            			The synchronization will only remove values that are assigned by midPoint, but will
		            			tolerate extra native values.
		            			When set to false, extra attribute values are not tolerated. When midPoint detects
		            			such value (e.g. during reconciliation) it will remove it.
		            		</xsd:documentation>
		            	</xsd:annotation>
		            </xsd:element>
	            <xsd:element name="modificationPriority" type="xsd:int" minOccurs="0">
	                <xsd:annotation>
	                    <xsd:documentation>
	                        Modification priority of this item. Items with specified priorities are modified in order that
	                        follows these priorities: these with lower numbers are modified first, these with higher numbers
	                        next, and items with unspecified priorities are modified last. Each priority level gets its own
	                        modify operation (or operations, if required by ICF limitations).
	
	                        Currently this field is supported only for attributes, even it is present on associations as well.
	
	                        (It is envisioned that 'addingPriority' could be created as well in the future; it would concern
	                        creating new objects. In that case, attributes with numerically lowest adding priority would be
	                        used to create an object, and other attributes would be set via MODIFY operation, again,
	                        according to their priorities.)
	                    </xsd:documentation>
	                </xsd:annotation>
	            </xsd:element>
	            <xsd:element name="readReplaceMode" type="xsd:boolean" minOccurs="0">
	                <xsd:annotation>
	                    <xsd:documentation>
	                        Modifications to this attribute are executed in REPLACE form only. I.e. if ADD or DELETE VALUE is
	                        requested, midPoint will fetch the object state, compute the expected result and write it to the
	                        resource object via REPLACE VALUE operation. This works around some weird connector behavior.
	
	                        BEWARE: READ+REPLACE is currently supported for attributes only - not for subjectToObject associations.
	
	                        EXPERIMENTAL. May change in near future.
	                    </xsd:documentation>
	                </xsd:annotation>
	            </xsd:element>
	            <xsd:element name="secondaryIdentifier" type="xsd:boolean" minOccurs="0">
	            <xsd:annotation>
	            		<xsd:documentation>
	            			Indicated if the attribute should be considered as secondary identifier. If set to true,
	            			this attribue is stored in repository and user for example by synchronization (correlation
	            			rule), consistency mechanism, etc.
	            		</xsd:documentation>
	            	</xsd:annotation>
				</xsd:element>
	    		
	            <xsd:element name="tolerantValuePattern" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
	            	<xsd:annotation>
	            		<xsd:documentation>
	            			Pattern (regexp) for attribute value. If the value matches the pattern such value is tolerated.
	            			It is left in the attribute even if it is not derived from any mapping.
	            		</xsd:documentation>
	            	</xsd:annotation>
	            </xsd:element>
	            <xsd:element name="intolerantValuePattern" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
	            	<xsd:annotation>
	            		<xsd:documentation>
	            			Pattern (regexp) for attribute value. If the value matches the pattern such value is NOT tolerated.
	            			The value must be derived from a mapping or it will be removed.
	            		</xsd:documentation>
	            	</xsd:annotation>
	            </xsd:element>
	            <xsd:element name="fetchStrategy" type="tns:AttributeFetchStrategyType" minOccurs="0"/>
	            <xsd:element name="outbound" type="tns:MappingType" minOccurs="0" maxOccurs="1">
	                <xsd:annotation>
	                    <xsd:documentation>
	                        Defines how the attribute value is constructed in case of information flow from IDM to the
	                        resource, e.g. in case of provisioning.
	
	                        In case an expression is used, the expression variables should be as follows:
	                        $user - the user to whom the account belongs
	                        $account - the account to be changed
	
	                        Motivation: This is "value construction" type, it is
	                        using similar format that is used eleswhere in the system
	                        (e.g. in roles) and therefore a common expression processor can be
	                        used to process all of that. E.g. a single processor may take into a
	                        consideration both schema handling and dynamic attributes set by roles.
	                    </xsd:documentation>
	                </xsd:annotation>
	            </xsd:element>
	            <xsd:element name="inbound" type="tns:MappingType" minOccurs="0" maxOccurs="unbounded">
	                <xsd:annotation>
	                    <xsd:documentation>
	                        Defines how the attribute values are used (assigned) in case of information flow from resource
	                        to IDM, e.g. in case of synchronization, reconciliation or discovery.
	
	                        In case a source expression is used, the expression variables should be as follows:
	                        $user - the user to whom the account belongs
	                        $account - the account that has been changed (after the change)
	
	                        Explanation: This is not a "value construction" as it is not constructing a new
	                        attribute value. It is rather using attribute value that was set be someone else.
	                        A simpler way how to express the assignement is needed here, especially a simple way how
	                        to express assignment target. Some rules may use that information and we definitelly need that
	                        to
	                        generate correct relative change descriptions.
	                    </xsd:documentation>
	                </xsd:annotation>
	            </xsd:element>
	        </xsd:sequence>
	      </xsd:extension>
	   </xsd:complexContent>
    </xsd:complexType>
    
    <xsd:complexType name="ResourceAttributeDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Description of the attribute handling details, such as display name,
                read/write access and value and synchronization expressions.

                This is supposed to be used in schemaHandling part and therefore
                describe the decisions of the system administrator about the
                way how that attribute is used in midPoint.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:ResourceItemDefinitionType">
        		<!-- No extra elements -->
        	</xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="resourceAttributeDefinition" type="tns:ResourceAttributeDefinitionType"/>
    
    <xsd:complexType name="PropertyLimitationsType">
    	<xsd:annotation>
    		<xsd:documentation>
    			TODO
    		</xsd:documentation>
    	</xsd:annotation>
    	<xsd:sequence>
    		<xsd:element name="layer" type="tns:LayerType" minOccurs="0" maxOccurs="unbounded">
    			<xsd:annotation>
    				<xsd:documentation>
    					Specification of a layers that this limitation applies to. If not specified then it applies
    					to all layers.
    				</xsd:documentation>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="minOccurs" type="xsd:string" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Override of schema minOccurs specification.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="maxOccurs" type="xsd:string" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Override of schema maxOccurs specification.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
    		<xsd:element ref="tns:ignore" minOccurs="0"/>
    		<xsd:element name="access" type="tns:PropertyAccessType" minOccurs="0"/>
    	</xsd:sequence>
    </xsd:complexType>
    
    <xsd:simpleType name="LayerType">
        <xsd:annotation>
            <xsd:documentation>
                Defines a system layer.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="schema">
                <xsd:annotation>
                	<xsd:documentation>
                		The lowest layer. It means that the schema is taken in almost unmodified form.
                		This efficiently means "bottom of provisioning component" from the architectural perspective.
                		
                		This is the default.
                		
                		Note that this means that the schemaHandling is actually applied on the schema
                		on this layer. The LayerType does not apply to the "pure" schema, therefore this
                		is the lowest practically applicable level.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SCHEMA"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="model">
                <xsd:annotation>
                	<xsd:documentation>
                		Model layer means application of schema constraints inside the IDM model.
                		
                		This efficiently means "bottom of IDM model component" from the architectural perspective.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODEL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="presentation">
                <xsd:annotation>
                	<xsd:documentation>
                		The presentation layer that is used to display information to the user but it
                		also means presentation of the data outside midpoint. Therefore it applies both to
                		GUI and also the web service interface and also to similar interfaces.
                		
                		This efficiently means "top of IDM model component" or "Model API" from the architectural perspective. 
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PRESENTATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="PropertyAccessType">
    	<xsd:sequence>
    		<xsd:element name="read" type="xsd:boolean" minOccurs="0"/>
    		<xsd:element name="add" type="xsd:boolean" minOccurs="0"/>
    		<xsd:element name="modify" type="xsd:boolean" minOccurs="0"/>
    		<!-- delete does not make sense here -->
    	</xsd:sequence>
    </xsd:complexType>
    
    <xsd:simpleType name="AttributeFetchStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                The way how an attribute is fetched from the resource. Or more exactly a way how midPoint requests the
                attribute from the connector.
                
                This setting is used if no other (more specific) setting is specified for an attribute in the run-time.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="implicit">
                <xsd:annotation>
                	<xsd:documentation>
                		MidPoint expects that the attribute will be implicitly returned by the connector
                		in each fetch request and there is no need to explicitly request the attribute.
                		
                		This is the default. This strategy will be used if no other strategy is specified.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IMPLICIT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="explicit">
                <xsd:annotation>
                	<xsd:documentation>
                		MidPoint expects that the attribute will NOT be implicitly returned by the connector.
                		To fetch the attribute midPoint has to explicitly request it. Therefore midPoint will
                		explicitly request this attribute in each fetch request.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXPLICIT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ResourceCredentialsDefinitionType">
        <xsd:sequence>
            <xsd:element name="password" type="tns:ResourcePasswordDefinitionType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        Defines how the password synchronization is handled for the resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ResourcePasswordDefinitionType">
        <xsd:sequence>
        	<xsd:element name="fetchStrategy" type="tns:AttributeFetchStrategyType" minOccurs="0"/>
            <xsd:element name="outbound" type="tns:MappingType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        Defines how the password value is constructed in case of information flow from IDM to the
                        resource, e.g. in case of provisioning.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="inbound" type="tns:MappingType" minOccurs="0" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			Defines how user password is constructed if he user is created or updated from this account.
            			The "target" part of the assignment is implictly set to user's password, therefore it may be
            			omitted.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="passwordPolicyRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        Reference to the account type password policy settings.
                    </xsd:documentation>
                    <xsd:appinfo>
            			<a:objectReferenceTargetType>tns:PasswordPolicyType</a:objectReferenceTargetType>
            		</xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ResourceActivationDefinitionType">
    	<xsd:annotation>
            <xsd:documentation>
                Defines how the synchronization of the activation section is handled for the resource.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="existence" type="tns:ResourceBidirectionalMappingType" minOccurs="0" maxOccurs="1">
		    	<xsd:annotation>
		            <xsd:documentation>
		                TODO
		            </xsd:documentation>
		        </xsd:annotation>                
            </xsd:element>
        	<xsd:element name="administrativeStatus" type="tns:ResourceBidirectionalMappingType" minOccurs="0" maxOccurs="1">
		    	<xsd:annotation>
		            <xsd:documentation>
		                TODO
		            </xsd:documentation>
		        </xsd:annotation>                
            </xsd:element>
        	<xsd:element name="validFrom" type="tns:ResourceBidirectionalMappingType" minOccurs="0" maxOccurs="1">
		    	<xsd:annotation>
		            <xsd:documentation>
		                TODO
		            </xsd:documentation>
		        </xsd:annotation>                
            </xsd:element>
        	<xsd:element name="validTo" type="tns:ResourceBidirectionalMappingType" minOccurs="0" maxOccurs="1">
		    	<xsd:annotation>
		            <xsd:documentation>
		                TODO
		            </xsd:documentation>
		        </xsd:annotation>                
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ResourceBidirectionalMappingType">
        <xsd:sequence>
        	<xsd:element name="fetchStrategy" type="tns:AttributeFetchStrategyType" minOccurs="0"/>
            <xsd:element name="outbound" type="tns:MappingType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Maps information outbound from midpoint to the resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="inbound" type="tns:MappingType" minOccurs="0" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			Maps information inbound to midpoint from the resource.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    
    <xsd:complexType name="IterationSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of iteration properties for a resource account or other resource objects.
                Iteration is a process of choosing unique (or otherwise acceptable) values. E.g. it
                is ususally used to generate unique usernames.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="maxIterations" type="xsd:int">
        		<xsd:annotation>
        			<xsd:documentation>
        				Maximum number of itteration attempts. The number specifies attempts
        				beyound the first one, which is not considered to be an iteration.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="tokenExpression" type="tns:ExpressionType" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				An expression that will be used to format an iteration token.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="preIterationCondition" type="tns:ExpressionType" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				A condition that will be executed prior to iteration. If it returns true
        				then the iteration will continue. If it returns false then the iteration
        				will be skipped (as if there is an conflict).
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="postIterationCondition" type="tns:ExpressionType" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				A condition that will be executed after the iteration. If it returns true
        				then the iteration will be accepted as valid. If it returns false then 
        				the iteration will be skipped (as if there is an conflict).
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
     	</xsd:sequence>
     </xsd:complexType>
     
     <xsd:complexType name="ResourceObjectPatternType">
     	<xsd:annotation>
     		<xsd:documentation>
     			Resource object pattern. This data structure defines a pattern that is used to match resource
     			objects using a native identifier(s). This may be primary or secondary identifier.
     		</xsd:documentation>
     	</xsd:annotation>
     	<xsd:sequence>
     		<xsd:element name="filter" type="q:SearchFilterType" minOccurs="0" maxOccurs="1">
     			<xsd:annotation>
     				<xsd:documentation>
     					The filter used to match the object. If the object mathces then it is regarded to be
     					protected.
     					
     					Although this is minOccurs=0 it is a mandatory attribute for all current practical uses.
     					The minOccurs=0 is here only for compatibility and it will be changed to minOccurs=1
     					when the deprecated syntax is removed.
     				</xsd:documentation>
     			</xsd:annotation>
     		</xsd:element>
     		<xsd:element ref="icfs:name" minOccurs="0" maxOccurs="1">
     			<xsd:annotation>
     				<xsd:documentation>
     					ICF name of the protected object. If the object matches this value then it is considered protected.
     					DEPRECATED. Use filter instead.
     				</xsd:documentation>
     				<xsd:appinfo>
     					<a:deprecated/>
     				</xsd:appinfo>
     			</xsd:annotation>
     		</xsd:element>
     		<xsd:element ref="icfs:uid" minOccurs="0" maxOccurs="1">
     			<xsd:annotation>
     				<xsd:documentation>
     					ICF UID of the protected object. If the object matches this value then it is considered protected.
     					DEPRECATED. Use filter instead.
     				</xsd:documentation>
     				<xsd:appinfo>
     					<a:deprecated/>
     				</xsd:appinfo>
     			</xsd:annotation>
     		</xsd:element>
     	</xsd:sequence>
     </xsd:complexType>
     
     <xsd:complexType name="ResourceObjectAssociationType">
     	<xsd:annotation>
     		<xsd:documentation>
     			Describes how entitlement is associated to the subject (e.g. account or other entitlement).
     			
     			Description of the entitlement handling details, such as display name,
                read/write access and so on.

                This is supposed to be used in schemaHandling part and in assignments/inducements
                and therefore it describes the decisions of the system administrator about the
                way how entitlements are used in midPoint.
     		</xsd:documentation>
     	</xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:ResourceItemDefinitionType">
		     	<xsd:sequence>
		     		<xsd:element name="kind" type="tns:ShadowKindType" minOccurs="0"></xsd:element>
		     		<xsd:element name="intent" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                A set of intents corresponding to this association type.
                                NOTE: All of them must point to the same resource ObjectClass!
                            </xsd:documentation>
                        </xsd:annotation>
		     		</xsd:element>
		     		<xsd:element name="direction" type="tns:ResourceObjectAssociationDirectionType"  minOccurs="0"></xsd:element>
		     		<xsd:element name="associationAttribute" type="xsd:QName"  minOccurs="0"></xsd:element>
		     		<xsd:element name="valueAttribute" type="xsd:QName"  minOccurs="0"></xsd:element>
		     		<xsd:element name="explicitReferentialIntegrity" type="xsd:boolean"  minOccurs="0" default="true">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether you require midPoint to provide referential integrity for object-to-subject associations.

                                Used for resources that do not provide referential integrity by themselves, e.g. for OpenDJ with
                                default settings (i.e. with referential integrity plugin turned off).

                                For resources having referential integrity, e.g. for Active Directory, set this parameter to false.
                            </xsd:documentation>
                        </xsd:annotation>
		     		</xsd:element>
		     	</xsd:sequence>
		     </xsd:extension>
	     </xsd:complexContent>
     </xsd:complexType>

     <xsd:simpleType name="ResourceObjectAssociationDirectionType">
        <xsd:annotation>
            <xsd:documentation>
                Direction of a resource object association.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="objectToSubject">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OBJECT_TO_SUBJECT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="subjectToObject">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUBJECT_TO_OBJECT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="CapabilitiesType">
        <xsd:annotation>
            <xsd:documentation>
                Collection of resource capabilities. Each element in this collection defines a specific resource
                capability. Stardard midpoint capabilities are defined in a separate namespace. But that is not
                a closed set. Resource may also specify additional capabilities. If the code that is processing
                capabilities encounters unknown capability it must ignore it.
                
                Each capability should have boolean propery "enabled" whith true default value. This is used in
                the configured capabilities section to disable individual capabilities.
                
                This part defines native and configured capabilities. The effective capabilities of the resource
                are determined by application of configured capabilities to native capabilities.
            </xsd:documentation>
            <xsd:appinfo>
            	<a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element ref="tns:cachingMetadata" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				Metadata defining the "freshness" of the cached copy of native capabilities.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
            <xsd:element name="native" type="c:CapabilityCollectionType" minOccurs="0" maxOccurs="1">
            	<xsd:annotation>
            		<xsd:documentation>
            			The capabilities natively supported by the connector without any simulation or any
                        other workaround. It is stored in the repository as a cache of the real capabilities
                        (connector can always produce the capabilities if the resource is online).
                        If this element is not present then the data were not yet retrieved from the resource.
                        If it is present, but the inner capability list is empty then the connector provides
                        no capabilities.
                        
                        The value of this element indicates what the connector can do.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="configured" type="c:CapabilityCollectionType" minOccurs="0" maxOccurs="1">
            	<xsd:annotation>
            		<xsd:documentation>
            			The configured capabilities of the resource. This part contains "tweaks" of the native capabilities.
            			Some of the native capabilities may be turned off, other capabilities may be simulated. 
            			
                        If this element is not present at all then the native capabilities in the unchanged form are assumed.
                        
                        The value of this element is not generated, it should be set by the administrator.
                        The value of this element indicates administrator decisions what connector capabilities
                        to use, what capabilities to simulate and how to simulate them.
                        
                        The value of this element indicates what the connector is allowed to do.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="capabilities" type="tns:CapabilitiesType"/>
    
    <xsd:complexType name="CapabilityCollectionType">
        <xsd:annotation>
            <xsd:documentation>
                Collection of resource capabilities. Each element in this collection defines a specific resource
                capability. Standard midpoint capabilities are defined in a separate namespace. But that is not
                a closed set. Resource may also specify additional capabilities. If the code that is processing
                capabilities encounters unknown capability it must ignore it.
            </xsd:documentation>
            <xsd:appinfo>
            	<a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
<!--          <xsd:element name="cap" type="cap:CapabilityType" minOccurs="0" maxOccurs="unbounded"> -->
<!--                 <xsd:annotation> -->
<!--                     <xsd:documentation> -->
<!--                         Elements defining individual capabilities. -->
<!--                     </xsd:documentation> -->
<!--                 </xsd:annotation> -->
<!--             </xsd:element> -->
            <xsd:any namespace="##other" minOccurs="0" maxOccurs="unbounded" processContents="lax">
                <xsd:annotation>
                    <xsd:documentation>
                        Elements defining individual capabilities.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:any>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="OperationProvisioningScriptsType">
        <xsd:annotation>
            <xsd:documentation>
                Collection of scripts to be executed for various provisioning operations.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="script" type="tns:OperationProvisioningScriptType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Specific script definition.
                        Note: More than one script definition may apply to a specific operation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="provisioningScripts" type="tns:OperationProvisioningScriptsType"/>

    <xsd:complexType name="OperationProvisioningScriptType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies how and when a script is executed during provisioning.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:ProvisioningScriptType">
        	        <xsd:sequence>
			            <xsd:element name="operation" type="tns:ProvisioningOperationTypeType" minOccurs="0" maxOccurs="unbounded">
			                <xsd:annotation>
			                    <xsd:documentation>
			                        Defines a set of operations for which the script should be executed.
			                        If more than one operation is specified, the same
			                        script should be executed for each of them.
			                        If no operation is specified, the script will not be
			                        executed (this is meant as poor man's disable feature)
			                    </xsd:documentation>
			                </xsd:annotation>
			            </xsd:element>
			            <xsd:element name="kind" type="tns:ShadowKindType" minOccurs="0" maxOccurs="unbounded">
			                <xsd:annotation>
			                    <xsd:documentation>
			                        Constraints script execution only to resource objects of a specified kind.
			                        If not present then the scrip will be executed for objects of all kinds.
			                    </xsd:documentation>
			                </xsd:annotation>
			            </xsd:element>
			            <xsd:element name="intent" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
			                <xsd:annotation>
			                    <xsd:documentation>
			                        Constraints script execution only to resource objects with a specified intent.
			                        If not present then the scrip will be executed for objects with any intent.
			                    </xsd:documentation>
			                </xsd:annotation>
			            </xsd:element>
			            <xsd:element name="order" type="tns:BeforeAfterType">
			                <xsd:annotation>
			                    <xsd:documentation>
			                        Defines the order in which a script is executed.
			                        (before or after an operation).
			                    </xsd:documentation>
			                </xsd:annotation>
			            </xsd:element>
			        </xsd:sequence>
        	</xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ProvisioningScriptType">
        <xsd:annotation>
            <xsd:documentation>
                Specifies a script to be executed during provisioning.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="host" type="tns:ProvisioningScriptHostType" minOccurs="0" default="resource">
                <xsd:annotation>
                    <xsd:documentation>
                        Defines where the script should be executed
                        (connector or resource). If no type is specified, it
                        defaults to resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="language" type="xsd:anyURI">
                <xsd:annotation>
                    <xsd:documentation>
                        Specifies the language of the script.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="argument" type="tns:ProvisioningScriptArgumentType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Script arguments. The arguments will passed to the script
                        in any way suitable for the script. The argument name
                        is "local" to the script (script-specific). Script name
                        must be unique in the argument set.
                        The order of arguments is not significant.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="code" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Script code represented as string. The interpretation
                        depends on script language. If XML elements are used
                        inside, they should be properly escaped. (e.g. using
                        CDATA).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="ProvisioningOperationTypeType">
        <xsd:annotation>
            <xsd:documentation>
                Type of an operation (change). It defines operations to change
                object, it is not limited to object modifications.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="get">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GET"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="modify">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODIFY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="reconcile">
                <xsd:annotation>
                	<xsd:documentation>
                		Not stritcly a provisioning operation. But we understand it
                		in a broader sense of "comparing states".
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RECONCILE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="ProvisioningScriptHostType">
        <xsd:annotation>
            <xsd:documentation>
                An enumeration that defines where the script will be executed.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="connector">
                <xsd:annotation>
                    <xsd:documentation>
                        The script will be executed on "connector", it means
                        it will be executed on the same host as the connector
                        is running (which is usually IDM system).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CONNECTOR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="resource">
                <xsd:annotation>
                    <xsd:documentation>
                        The script will be executed on "resource", it means
                        it will be executed on the target sytem. Please refer
                        to the
                        connector documentation for more details, e.g.
                        in case of multi-host resources.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>


    <xsd:complexType name="ProvisioningScriptArgumentType">
        <xsd:annotation>
            <xsd:documentation>
                Script argument. It is subtype of Value Construction, therefore
                the value may be static of dynamically constructed using an
                expression. The "default" and "authoritative" flags are not
                applicable here.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ExpressionType">
                <xsd:sequence>
                    <xsd:element name="name" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Argument name. The name is "local" to the
                                script. It must comply with the limitations of
                                used script language.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="ConnectorConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Resource configuration (hostname, port, ...).
                Specific for each resource type.
                TODO

                This element belongs to ResourceType and should
                not be used elsewhere. This is a top-level
                element to make the implementation (JAXB
                marshall/unmarshall) easier.
            </xsd:documentation>
            <xsd:appinfo>
            	<a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any minOccurs="0" maxOccurs="unbounded" processContents="lax">
            </xsd:any>
        </xsd:sequence>
    </xsd:complexType>


	<xsd:complexType name="MappingType">
        <xsd:annotation>
            <xsd:documentation>
                Defines how a value of a property (or attribute) should be
                constructed. The value may be static or constructed as an
                result of evaluating an expression.

                This structure also defines a method how to merge several value
                construction definitions, how to behave if a property already
                has a value, etc.

                This is reusable data structure, used in schemaHandling, roles
                and it may also be used in may other places.

                Motivation: We need to construct attribute or property values on
                many places in midPoint. E.g. we need that in roles to generate
                dynamic account attribute values, we need that to define "templates"
                for identifiers and default values for attributes when creating a
                new account. We also need that to specify values when creating a
                new user (user templates). Having the same data structure for all of
                these cases may simplify the code, as it all can be handled by a
                generic library reused in many places through the system.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="name" type="xsd:string" minOccurs="0" maxOccurs="1">
        		<xsd:annotation>
        			<xsd:documentation>
        				Short name of the mapping. Used for debugging purposes.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
            <xsd:element ref="tns:extension" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="authoritative" minOccurs="0" type="xsd:boolean" default="true">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="exclusive" minOccurs="0" type="xsd:boolean" default="false">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="strength" minOccurs="0" type="tns:MappingStrengthType" default="strong">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="channel" type="xsd:anyURI" minOccurs="0" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			Limits application of this mapping only to specific channel. If the channel is listed then the
            			mapping will be applied. If it is not then it will not be applied.
            			If no channel is specified then no limitations apply and the mapping will be applied for all channels.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="exceptChannel" type="xsd:anyURI" minOccurs="0" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			Limits application of this mapping except for channel specified. If the channel is listed then the
            			mapping will be not applied in this channel. If it is not then it will be applied.
            			If no channel is specified then no limitations apply and the mapping will be applied for all channels.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="timeFrom" type="tns:MappingTimeDeclarationType" minOccurs="0"/>
            <xsd:element name="timeTo" type="tns:MappingTimeDeclarationType" minOccurs="0"/>
            <xsd:element name="source" type="tns:MappingSourceDeclarationType" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="expression" type="tns:ExpressionType" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="target" type="tns:MappingTargetDeclarationType" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="condition" type="tns:ExpressionType" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="inputFilter" type="tns:ValueFilterType" minOccurs="0"/>
            <xsd:element name="outputFilter" type="tns:ValueFilterType" minOccurs="0"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="mapping" type="tns:MappingType"/>
    
    <xsd:simpleType name="MappingStrengthType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="strong">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STRONG"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="normal">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NORMAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="weak">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WEAK"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="MappingTimeDeclarationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="referenceTime" type="tns:MappingSourceDeclarationType" minOccurs="0" maxOccurs="1"/>
           	<xsd:element name="offset" type="xsd:duration" minOccurs="0"/>
        </xsd:sequence>
    </xsd:complexType>
    
	<xsd:complexType name="MappingSourceDeclarationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:QName" minOccurs="0" maxOccurs="1"/>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
           	<xsd:element name="path" type="t:ItemPathType"/>
        </xsd:sequence>
    </xsd:complexType>

	<xsd:complexType name="MappingTargetDeclarationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
           	<xsd:element name="path" type="t:ItemPathType"/>
        </xsd:sequence>
    </xsd:complexType>
    
    <xsd:complexType name="ValueFilterType">
        <xsd:annotation>
            <xsd:documentation>
                Defines value filter. The value filters are supposed to take a
                single value of a specific type and return a single value of
                the same type. Filters are used to transforms values, e.g.
                to clean up illegal characters, to do charset transcoding, etc.

                Note:
                Strictly speaking, filters should be used for things like
                transliteration of national characters, case conversions, etc.
                They should not be used to "technical" transformations such as
                character set conversions. Connector should do that and connector                
                should return nice, clean unicode strings. But some connectors
                are faulty and the ability of filters to do "technical" things
                may come handy.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any minOccurs="0" maxOccurs="unbounded" processContents="lax">
                <xsd:annotation>
                    <xsd:documentation>
                        Filter parameters.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:any>
        </xsd:sequence>
        <xsd:attribute name="type" type="xsd:anyURI">
            <xsd:annotation>
                <xsd:documentation>
                    URI identifying the type of the filter. This is a identifier
                    of the filter code. Individual filters may plug-in under a
                    specific URI.
                </xsd:documentation>
            </xsd:annotation>
        </xsd:attribute>
    </xsd:complexType>

    <xsd:complexType name="ExpressionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
            <xsd:element ref="tns:extension" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="stringFilter" type="tns:StringFilterType" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="variable" type="tns:ExpressionVariableDefinitionType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Definition of additional variables that should be
                        present during evaluation of the expression.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="returnMultiplicity" type="tns:ExpressionReturnMultiplicityType" minOccurs="0"></xsd:element>
            <xsd:element ref="tns:expressionEvaluator" minOccurs="1" maxOccurs="unbounded">
            	<xsd:annotation>
            		<xsd:documentation>
            			A single expression evaluator.
            			Although this element is formally multi-value it may be used only for multiple
            			instances of the same evaluator that in fact form a single group.
            			E.g. it may be used to define several "value" elements of literal evaluator that
            			define multiple values. But it must not be used to define multiple scripts or any
            			other combination of evaluators.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="expression" type="tns:ExpressionType">
    	<xsd:annotation>
            <xsd:documentation>
                The expression that can be used to dynamically evaluate the value, e.g. in the query filter.
                
                It must be a top-level element so the processor of Query schema can find it. See prism query-2 schema.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:element>
    
    <xsd:simpleType name="ExpressionReturnMultiplicityType">
        <xsd:annotation>
            <xsd:documentation>
                Expression result multiplicity.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="single">
                <xsd:annotation>
                    <xsd:documentation>
                        Single return value
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SINGLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="multi">
                <xsd:annotation>
                    <xsd:documentation>
                        Multiple return values
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MULTI"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="StringFilterType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
    </xsd:complexType>
    
    <xsd:complexType name="ExpressionVariableDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
                Definition of a variable. This type declares a variable name
                and defines the initial content of the variable.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:QName">
                <xsd:annotation>
                    <xsd:documentation>
                        Variable name. The variable will be presented to the expression using specified name.

                        The name is a QName, which is good for XML-based expression languages such as XPath.
                        For languages with flat names the namespace is fixed (see documentation of midPoint
                        language binding) and the only relevant name is the local part.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element ref="tns:description" minOccurs="0"/>
            <!-- This needs to be a sequence of optional elements instead of choice due to a JAXB "feature" that generates XML not valid with the schema. -->
           	<xsd:element name="path" type="t:ItemPathType" minOccurs="0"/>
            <xsd:element name="objectRef" type="tns:ObjectReferenceType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element ref="tns:value" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:element name="expressionEvaluator" abstract="true"/>

    <xsd:element name="value" type="xsd:anyType" substitutionGroup="tns:expressionEvaluator" nillable="true">
        <xsd:annotation>
            <xsd:documentation>
                Static value for the attribute or property.

                Static attribute values. The values in this element should be
                assigned to the account as-is.

                List of values for the attribute provided in an appropriate XML elements
                that specify attribute name. (as is usual for properties)

                Only one attribute may be specified here, although it may have multiple
                values. Multi-valued attributes are expressed by repeating the same XML
                element multiple times.
                Hence all the XML elements that match this xsd:any must have the same
                element names (may have different values of course).


                Please note that this is nillable and therefore it may be
                explicitly set to "nil" value. Doing this means that empty
                set of values should be constructed. E.g. setting
                this to "nil" and also setting "authoritative" flag
                may enforce removal of all attribute values (if used properly).
            </xsd:documentation>
            <xsd:appinfo>
                <a:rawType/>
            </xsd:appinfo>
        </xsd:annotation>
    </xsd:element>

    <xsd:complexType name="AsIsExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Copy value as is, without any modification.
            </xsd:documentation>
        </xsd:annotation>
    </xsd:complexType>

    <xsd:element name="asIs" type="tns:AsIsExpressionEvaluatorType" substitutionGroup="tns:expressionEvaluator"/>

    <xsd:complexType name="GenerateExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Generate value according to a policy that is associated with the property/attribute.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="mode" type="tns:GenerateExpressionEvaluatorModeType" minOccurs="0" default="policy"/>
        	<xsd:element name="valuePolicyRef" type="tns:ObjectReferenceType" minOccurs="0">
        		<xsd:annotation>
	                <xsd:documentation>
	                    Reference to the value policy that should be used to generate the value.
	                </xsd:documentation>
	                <xsd:appinfo>
	        			<a:objectReferenceTargetType>tns:PasswordPolicyType</a:objectReferenceTargetType>
	        		</xsd:appinfo>
	            </xsd:annotation>
        	</xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:element name="generate" type="tns:GenerateExpressionEvaluatorType" substitutionGroup="tns:expressionEvaluator"/>
    
    <xsd:simpleType name="GenerateExpressionEvaluatorModeType">
        <xsd:annotation>
            <xsd:documentation>
                Value generator mode.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="policy">
                <xsd:annotation>
                	<xsd:documentation>
                		Generator generates the value according to the applicable value policy (e.g. a password policy).
                		The it generates a random string that satisfies the policy. If no policy can be determined then
                		a reasonable default policy is assumed.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POLICY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="uuid">
                <xsd:annotation>
                	<xsd:documentation>
                		The generator generates a random Universally Unique Identifier (UUID) string.
                		The generated UUID is currently version 4 and complies with ISO/IEC 11578:1996, but this
                		can change in the future.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UUID"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:element name="script" type="tns:ScriptExpressionEvaluatorType" substitutionGroup="tns:expressionEvaluator"/>

	<xsd:element name="path" type="t:ItemPathType" substitutionGroup="tns:expressionEvaluator"/>

    <xsd:complexType name="TransformExpressionEvaluatorType" abstract="true">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:description" minOccurs="0"/>
            <xsd:element name="relativityMode" type="tns:TransformExpressionRelativityModeType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="includeNullInputs" type="xsd:boolean" minOccurs="0" default="true">
                <xsd:annotation>
                    <xsd:documentation>
                        If set to true (which is the default) the script will be evaluated with null value
                        as argument when the input is changed from or to an empty value. This generally works
                        well for most cases. It may be set to false as an optimization.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="allowEmptyValues" type="xsd:boolean" minOccurs="0" default="false">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    
    <xsd:simpleType name="TransformExpressionRelativityModeType">
        <xsd:annotation>
            <xsd:documentation>
                Relativity mode of an expression.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="relative">
                <xsd:annotation>
                    <xsd:documentation>
                        Relative expression. Works on (partial) individual values transforming each of them one by one.
                        This is the default.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RELATIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="absolute">
                <xsd:annotation>
                    <xsd:documentation>
                        Absolute expression. Works on all the values at once. May not be entirely reliable.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ABSOLUTE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="ScriptExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Generic script expression. The purpose of the expression is to return
                a value. The expression must produce something that is a piece
                of XML, which means that it may produce either string value,
                XML node or a list of XML nodes.

                The expression may use variables or arguments. However, such
                variables or arguments passed to the expression will be different
                for each invocation. It should be documented in each case this type is used.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:TransformExpressionEvaluatorType">
		        <xsd:sequence>
		            <xsd:element name="language" type="xsd:anyURI" minOccurs="0" default="http://midpoint.evolveum.com/xml/ns/public/expression/language#Groovy">
		                <xsd:annotation>
		                    <xsd:documentation>
		                        Language of the expression. Groovy is the default language if other language is not specified.
		                    </xsd:documentation>
		                </xsd:annotation>
		            </xsd:element>
		            <xsd:element name="returnType" type="tns:ScriptExpressionReturnTypeType" minOccurs="0">
		                <xsd:annotation>
		                    <xsd:documentation>
		                        The type of the expression result, either "list" or "scalar". If not set it will be
		                        determined automatically from the target data type for the expression. This setting
		                        should be used only if the automatic mechanism does not work as expected.
		                    </xsd:documentation>
		                </xsd:annotation>
		            </xsd:element>
		            <xsd:element name="code" type="xsd:string">
		                <xsd:annotation>
		                    <xsd:documentation>
		                        Script code in the native format of the scripting language.
		                    </xsd:documentation>
		                </xsd:annotation>
		            </xsd:element>
		        </xsd:sequence>
        	</xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="ScriptExpressionReturnTypeType">
        <xsd:annotation>
            <xsd:documentation>
                The type of the expression result, either "list" or "scalar".
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="scalar">
                <xsd:annotation>
                    <xsd:documentation>
                        Single return value
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SCALAR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="list">
                <xsd:annotation>
                    <xsd:documentation>
                        Multiple return values
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LIST"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>    

	<xsd:complexType name="SearchObjectExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Create an expression based on search results.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:TransformExpressionEvaluatorType">
		        <xsd:sequence>
		        	<xsd:element name="targetType" type="xsd:QName" minOccurs="0" maxOccurs="1">
		        	</xsd:element>
		        	<xsd:element name="oid" type="xsd:string" minOccurs="0" maxOccurs="1">
		        	</xsd:element>
		        	<xsd:element name="filter" type="q:SearchFilterType" minOccurs="0" maxOccurs="1">
		        	</xsd:element>
		        	<xsd:element name="searchOnResource" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false">
		        	</xsd:element>
		        	<xsd:element name="createOnDemand" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false">
		        	</xsd:element>
		        	<xsd:element name="populateObject" type="tns:PopulateObjectType" minOccurs="0">
		            	<xsd:annotation>
		            		<xsd:documentation>
		            			TODO
		            		</xsd:documentation>
		            	</xsd:annotation>
		            </xsd:element>
		        </xsd:sequence>
	        </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
	<xsd:element name="assignmentTargetSearch" type="tns:SearchObjectExpressionEvaluatorType" substitutionGroup="tns:expressionEvaluator"/>
	<xsd:element name="associationTargetSearch" type="tns:SearchObjectExpressionEvaluatorType" substitutionGroup="tns:expressionEvaluator"/>

	<xsd:complexType name="ShadowDiscriminatorExpressionEvaluatorType">
        <xsd:annotation>
            <xsd:documentation>
                Expression based on selecting a specific projection.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element ref="tns:description" minOccurs="0" maxOccurs="1">
        	</xsd:element>
        	<xsd:element name="projectionDiscriminator" type="tns:ShadowDiscriminatorType" minOccurs="0" maxOccurs="1">
        	</xsd:element>
        </xsd:sequence>
    </xsd:complexType>
	<xsd:element name="associationFromLink" type="tns:ShadowDiscriminatorExpressionEvaluatorType" substitutionGroup="tns:expressionEvaluator"/>
	<xsd:element name="assignmentFromAssociation" type="tns:ShadowDiscriminatorExpressionEvaluatorType" substitutionGroup="tns:expressionEvaluator"/>

	<xsd:complexType name="PopulateObjectType">
		<xsd:annotation>
			<xsd:documentation>TODO</xsd:documentation>
		</xsd:annotation>
		<xsd:sequence>
			<xsd:element name="populateItem" type="tns:PopulateItemType" minOccurs="0" maxOccurs="unbounded"/>
		</xsd:sequence>
	</xsd:complexType>

	<xsd:complexType name="PopulateItemType">
		<xsd:annotation>
			<xsd:documentation>TODO</xsd:documentation>
		</xsd:annotation>
		<xsd:sequence>
			<xsd:element ref="tns:expression"/>
			<xsd:element name="target" type="tns:MappingTargetDeclarationType"/>
		</xsd:sequence>
	</xsd:complexType>

    <xsd:element name="synchronization" type="tns:SynchronizationType"/>

    <xsd:complexType name="SynchronizationType">
        <xsd:annotation>
            <xsd:documentation>
                Defines a synchronization properties (configuration) for a
                resource. This applies to all flavors of synchronization
                (live sync, reconciliation, import, ...)
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="objectSynchronization" type="tns:ObjectSynchronizationType" minOccurs="0" maxOccurs="unbounded"/>
		</xsd:sequence>
	</xsd:complexType>

    <xsd:complexType name="ObjectSynchronizationType">
        <xsd:annotation>
            <xsd:documentation>
                Defines a synchronization properties (configuration) for a
                specific type of object, e.g. User. This applies to all flavors of synchronization
                (live sync, reconciliation, import, ...)
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="name" type="xsd:string" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				Free-form name. Used for diagnostics purposes.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element ref="tns:description" minOccurs="0"/>
        	<xsd:element name="objectClass" type="xsd:QName" minOccurs="0" maxOccurs="unbounded">
        		<xsd:annotation>
        			<xsd:documentation>
        				Object classes that will be processed by this definition.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="kind" type="tns:ShadowKindType" minOccurs="0" maxOccurs="1">
        		<xsd:annotation>
        			<xsd:documentation>
        				Shadow kind assumed by this definition. If not specified then the kind
        				defined by schemaHandling part will be used. However this element can define
        				a more specific kind in case that the schemaHandling part is ambiguous
        				(e.g. the same objectclass is used for two kinds).
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="intent" type="xsd:string" minOccurs="0" maxOccurs="1">
        		<xsd:annotation>
        			<xsd:documentation>
        				Shadow intent assumed by this definition. If not specified then the intent
        				defined by schemaHandling part will be used. However this element can define
        				a more specific intent in case that the schemaHandling part is ambiguous
        				(e.g. the same objectclass is used for two intents).
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="focusType" type="xsd:QName" minOccurs="0" maxOccurs="1">
        		<xsd:annotation>
        			<xsd:documentation>
        				Type of the focus that would be applied to this type.
        				If not specified the User (c:UserType) is assumed.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
            <xsd:element name="enabled" type="xsd:boolean" minOccurs="0" default="true">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>Flag indicating if this synchronization specification is enabled. If it is not,
                        then the system will ignore this definition.
                        If enabled, the synchronization should start with most recent change
                        after enabling synchronization. It will NOT pull in even the changes that
                        were done during disabled synchronization.</p>

                        <p>If this flag is not present the synchronization is assumed to be enabled.
                        This flag is meant to act as a tool to temporarily disable synchronization without loosing the
                        configuration and and state or for forcing the synchronization engine to "skip" some changes.</p>
                        
                        <p>Note that this is different than disabling/deleting the synchronization task. If the task
                        is stopped, midPoint will not poll for changes at all. This means that the changes will
                        still be "pending" on the resource and once the task is enabled it will pull such changes.
                        On the other hand, disabling synchronization using this flag and leaving the task running will
                        "acknowledge" all changes without doing anything.</p>
                        
                        <p>Also note that disabling synchronization using this flag will disable all the flavors, e.g.
                        it will also disable import from resource.</p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="condition" type="c:ExpressionType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                    	<p>Expression that is evaluated to check whether this definition is applicable to
                        a particular shadow. It is assumed to return a boolean value. If it returns 'true'
                        then the shadow will be processed by this definition. If it returns 'false' it will
                        not be processed.</p>
                        
                        <p>If no condition is present then all applicable shadows will be processed.</p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="correlation" type="tns:ConditionalSearchFilterType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                    	<p>Correlation filter expression. Running the query should return a list of candidate focus
                    	entries that may be owners of a particular shadow.</p>

                        <p>Correlation is an rough but an efficient way how to relate the shadow (e.g. an account)
                        to a focus (e.g. an user). The correlation expression is in fact just a search filter that can
                        contain expressions inside it. If correlation search returns more that one entry,
                        confirmation expression will be executed for each of them.</p>

                        <p>The filter in this case is conditional, i.e. there can be specified an expression
                        that denotes a necessary condition for the filter to be applied.</p>
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="confirmation" type="c:ExpressionType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Confirmation expression. The arguments are an account and a candidate owner (user). The
                        confirmation expressions should return true if the user should be owner of the account. It
                        should return false if the user cannot be owner of the account.

                        The evaluation of the confirmation expression may be relativelly inefficient, as it will only
                        be run for candidate entries returned by correlation expression.

                        The expression variables should be set as follows:
                        $user - the candidate user object (one of the results of correlation expression)
                        $account - the changed account object
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="objectTemplateRef" type="tns:ObjectReferenceType" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Object template used in case the midPoint (focus) objects are created or modified.
            			This overrides the system global object templates.
            			
            			This option is usually used set per-resource user template.
            		</xsd:documentation>
            		<xsd:appinfo>
                    	<a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                    </xsd:appinfo>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="reconcile" type="xsd:boolean" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			If set to true, applicable synchronization reactions will attempt to reconcile the real attributes
            			from the resource with the state of the midPoint repository. This may require additional read and
            			recompute, therefore may be slightly less efficient.
            			
            			If set to false, attribute values will not be reconciled.
            			
            			If not present the attribute values will only be reconciled if they are available ("automatic" mode).
            			No additional read will be executed. 
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
             <xsd:element name="limitPropagation" type="xsd:boolean" minOccurs="0" default="false">
            	<xsd:annotation>
            		<xsd:documentation>
            			If set to true, applicable synchronization reactions will propagate changes only form/to source 
            			resource. In the case focus cotains links to another resource this will be not recomputed
            			and after reaction execution there may be small inconsistencies.
            			
            			It can improve performance for example for initial import.
            			
            			Default value is false. 
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="opportunistic" type="xsd:boolean" minOccurs="0" default="true">
            	<xsd:annotation>
            		<xsd:documentation>
            			If set to true midPoint will try to link and synchronize objects whenever possible.
            			E.g. it will link accounts in a case if an account with a conflicting account is found
            			and correlation expression matches. MidPoint can be quite aggressive in this mode therefore
            			this switch is used to turn it off. It is on by default.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="reaction" type="tns:SynchronizationReactionType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ConditionalSearchFilterType">
        <xsd:annotation>
            <xsd:documentation>
                A filter with an expression that denotes a necessary condition for the filter to be applied.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="q:SearchFilterType">
                <xsd:sequence>
                    <xsd:element name="condition" type="tns:ExpressionType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                A condition that must be true in order to evaluate the filter.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:simpleType name="SynchronizationSituationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="deleted">
                <xsd:annotation>
                    <xsd:documentation>
                        The account existed on the resource, but it has been deleted.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="disputed">
                <xsd:annotation>
                    <xsd:documentation>
                        New account is found and two or more owners are found for it.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DISPUTED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="linked">
                <xsd:annotation>
                    <xsd:documentation>
                        The account exists and is linked to user. (synchronization event - modify)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LINKED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unlinked">
                <xsd:annotation>
                    <xsd:documentation>
                        The account was created and is not linked to user. (synchronization event - add)
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNLINKED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unmatched">
                <xsd:annotation>
                    <xsd:documentation>
                        The new account is found on the resource (it exists) and
                        IDM cannot determine any owner for the account.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNMATCHED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="SynchronizationReactionType">
	    <xsd:annotation>
	        <xsd:documentation>
	            Reaction to a synchronization situation.
	            Situation identifier must be unique in this set (i.e. a situation definition may occur only once
	            for each situation).
	            If there is no definition for a particular situation, there will be no reaction ("do nothing").
	            The set of situation reactions is considered to be unordered.
	        </xsd:documentation>
	    </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="name" type="xsd:string" minOccurs="0" maxOccurs="1"/>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="situation" type="tns:SynchronizationSituationType">
                <xsd:annotation>
                    <xsd:documentation>
                        Defines a particular synchronization situation.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="channel" type="xsd:anyURI" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="synchronize" type="xsd:boolean" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="reconcile" type="xsd:boolean" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="limitPropagation" type="xsd:boolean" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="objectTemplateRef" type="tns:ObjectReferenceType" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Object template used in case the focus object is created or modified.
            			This overrides other template definitions (system global, resource).
            		</xsd:documentation>
            		<xsd:appinfo>
                    	<a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                    </xsd:appinfo>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="action" type="tns:SynchronizationActionType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SynchronizationActionType">
	    <xsd:annotation>
	        <xsd:documentation>
	            Defines an action to take when a synchronization situation is encountered.
	            The actions change the default midpoint behaviour.
	            If there is no action for a particular situation,there will be no special
	            reaction and the default activity takes place.
	            Several actions may be defined for a specific reaction. All of them will be
	            executed however the ordering is not guaranteed.
	        </xsd:documentation>
	    </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="name" type="xsd:string" minOccurs="0" maxOccurs="1"/>
        	<xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
        	<xsd:element name="handlerUri" type="xsd:anyURI" minOccurs="0" maxOccurs="1"/>
        	<xsd:element name="order" type="tns:BeforeAfterType" minOccurs="0" default="before"/>
        	<!-- TODO: ordering? -->
        	<xsd:element name="parameters" minOccurs="0">
        		<xsd:complexType>
        			<xsd:sequence>
			            <xsd:any minOccurs="0" maxOccurs="unbounded" processContents="lax">
			                <xsd:annotation>
			                    <xsd:documentation>
			                        Action parameters.
			                        TODO
			                    </xsd:documentation>
			                </xsd:annotation>
			            </xsd:any>
        			</xsd:sequence>
        		</xsd:complexType>
            </xsd:element>
        	<xsd:element name="userTemplateRef" type="tns:ObjectReferenceType" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				DEPRECATED. For compatibility only. Use objectTemplateRef in reaction instead.
        			</xsd:documentation>
        			<xsd:appinfo>
                    	<a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                    	<a:deprecated/>
                    </xsd:appinfo>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="objectTemplateRef" type="tns:ObjectReferenceType" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				DEPRECATED. For compatibility only. Use objectTemplateRef in reaction instead.
        			</xsd:documentation>
        			<xsd:appinfo>
                    	<a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                    	<a:deprecated/>
                    </xsd:appinfo>
        		</xsd:annotation>
        	</xsd:element>
        </xsd:sequence>
        <xsd:attribute name="ref" type="xsd:anyURI" use="optional">
            <xsd:annotation>
                <xsd:documentation>
                    Action identifier (URL)
                    DEPRECATED. Use handlerUri element instead.
                </xsd:documentation>
                <xsd:appinfo>
                	<a:deprecated/>
                </xsd:appinfo>
            </xsd:annotation>
        </xsd:attribute>
    </xsd:complexType>
   
    <xsd:complexType name="ResourceObjectShadowChangeDescriptionType">
        <xsd:annotation>
            <xsd:documentation>
            	Description of the change in the external resource. 
            </xsd:documentation>
        </xsd:annotation>
        	<xsd:sequence>
            	<xsd:element name="oldShadowOid" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Identifier of the old shadow. According to this identifier, the shadow will be
                                fetched from the repo (resource). It may be null in the case when the notification
                                describes the ADD object sitaution.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="currentShadow" type="tns:ShadowType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Current shadow. This is used in the "absolute" mode, when we do not have change description.
                                Shadow represents the current state with the modifications already applied to its. Current 
                                shadow is used to compare to the old state so the modifications may be computed and synchronized.
                                It may be null. If the current shadow is null, object delta have to be specified.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="objectDelta" type="t:ObjectDeltaType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Delta describing the changes made to the shadow. E.g. if the change in the resource was
                                to add new account, delta will contain ADD modification with the object specified.
                                It may be null. If the object delta is null, the current shadow have to be specified.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="channel" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Channel which triggers the execution of notification, e.g. synchronization, reconciliation etc.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
    </xsd:complexType>
    
<xsd:element name="resourceObjectShadowChangeDescription" type="tns:ResourceObjectShadowChangeDescriptionType"/>
    

    <xsd:complexType name="ConnectorType">
        <xsd:annotation>
            <xsd:documentation>
                Description of a generic connector. Connector in midPoint is any method of connection to the resource.
                The
                actual implementation, connector framework or protocol does not matter.

                The values of "framework", "connectorType", "connectorVersion" and "connectorHost" (if present) together form a unique
                identification of the connector. That means that two ConnectorType objects that have these values same
                represent the same connector. Only one such instance of ConnectorType should exist in the repository.

                Note: The ConnectorType does not describe
                only Identity Connector Framework (ICF) connectors, it is much more generic.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="displayName" type="t:PolyStringType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                            	Human-readable name of the connector. It may be quite long, container national characters
                            	and there is no uniqueness requirement.
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Display Name</a:displayName>
		                    	<a:displayOrder>100</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="framework" type="xsd:anyURI">
                        <xsd:annotation>
                            <xsd:documentation>
                                Identification of the framework or mechanism
                                that implements this connector.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="connectorType" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Type of the connector, as seen by the framework.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="connectorVersion" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Version of the connector. Used only for display purposes and for searching during imports. Therefore it
                                may be any (sensible) string, but it should be reasonably stable to avoid broken imports.

                                May be any string (numeric convention is recommended, but not required).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="connectorBundle" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of a package that the connector comes in. It may be a name of the JAR file, ICF
                                bundle name, URL or any other designation of the packaging.
                                This is optional, it may not be provided.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="targetSystemType" type="xsd:anyURI" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Identification of the kind of target system
                                that the connector can connect to, such as "LDAP" or "DB Table". Used only for
                                display purposes and for searching during imports. Therefore it may
                                be any (sensible) string, but it should be reasonably stable to avoid
                                broken imports.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="namespace" type="xsd:anyURI" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Connector-private namespace. This is the namespace
                                that is private for a specific connector (and
                                optionally connector version).
                                It may be used by the connector to generate
                                connector configuration schema or for other purposes.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="connectorHost" type="tns:ConnectorHostType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Connector host that hosts this connector.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReference>tns:connectorHostRef</a:objectReference>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="connectorHostRef" type="c:ObjectReferenceType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the connector host that hosts this connector.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ConnectorHostType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element ref="tns:schema" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Connector configuration schema.

                                This element contains the XSD-formatted definition of connector
                                configuration schema. It defines connector configuration variables and data types such
                                as host names, ports, administrator names and so on.

                                Connector schema is only
                                available at run-time and may be different
                                for every connector. It is supposed to be
                                dynamically interpreted in run-time.

                                Connector schema is read-only. Changing the
                                schema is not supported.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:element name="connector" type="tns:ConnectorType" substitutionGroup="c:object"/>

    <xsd:complexType name="ConnectorHostType">
        <xsd:annotation>
            <xsd:documentation>
                Host definition for remote connector, remote
                connector framework or a remote "gateway".

                Note that this is a generic concept of a connector host, not specific to
                any connector framework. It can be extended with a framework-specific
                configuration using the usual "extension" element.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="hostname" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Hostname of a remote host. May also be an IP address.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="port" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Port number of the remote service. If not present, default
                                port number is assumed by the implementation.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="sharedSecret" type="t:ProtectedStringType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Shared secret used to authenticate client to the host.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="protectConnection" type="xsd:boolean" minOccurs="0" default="false">
                        <xsd:annotation>
                            <xsd:documentation>
                            	If set to true then a protected connection will be established (usually SSL).
                                UNSTABLE. WILL CHANGE IN THE FUTURE.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="timeout" type="xsd:int" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Timeout (in milliseconds) used when initially connecting to the
                                host or during other connections when timeout is not otherwise specified.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:element name="connectorHost" type="tns:ConnectorHostType" substitutionGroup="c:object"/>


    <xsd:complexType name="ShadowType">
        <xsd:annotation>
            <xsd:documentation>
                Local copy of any object on the provisioning resource that is related to provisioning.
                It may be account, group, role (on the target system), privilege, security label,
                organizational unit or anything else that is worth managing in identity management.
                
                In the minimal form it contains only identifiers and meta-data, but it may also be used
                for locally caching the account data (in local repository).

                This XML object provides a representation of the resource object in the IDM system, in
                the LOCAL REPOSITORY. It may represents a minimal data structure in IDM repository
                that contains only identifier and nothing else. It may also represent a rich structure
                with a lot of cached or fetched data. The actual content of this object depends on usage:
                on the specific interface and operation used and even on the system state and configuration.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
                    <xsd:element name="resourceRef" type="c:ObjectReferenceType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to a resource that this resource object shadow belongs to.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ResourceType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="resource" type="tns:ResourceType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Resource that this resource object shadow belongs to.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReference>tns:resourceRef</a:objectReference>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="result" type="tns:OperationResultType"  minOccurs="0">
						<xsd:annotation>
							<xsd:documentation>
								Result describing if shadow was successfully processed, or not. If not, the errors should  be saved.
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="objectChange" type="t:ObjectDeltaType" minOccurs="0">
						<xsd:annotation>
							<xsd:documentation>
								Description of changes that happened to an resource object shadow.
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="attemptNumber" type="xsd:int" minOccurs="0">
						<xsd:annotation>
							<xsd:documentation>
								Description of number of attempts made for the resolving account consistency issues. 
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="failedOperationType" type="tns:FailedOperationTypeType" minOccurs="0">
						<xsd:annotation>
							<xsd:documentation>
								Description of operation during the processing of account failed. 
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="dead" type="xsd:boolean" minOccurs="0">
						<xsd:annotation>
							<xsd:documentation>
								Description of operation during the processing of account failed. 
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="synchronizationSituation" type="tns:SynchronizationSituationType" minOccurs="0">
	     				<xsd:annotation>
							<xsd:documentation>
								The most recent synchronization situation. Regardless of the channel.
								This simple enumeration property is used for (indexed) search of shadows in certain situation.
								It does not provide any further details. More details can be found in the "synchronizationSituationDescription"
								property.
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="synchronizationTimestamp" type="xsd:dateTime" minOccurs="0">
	     				<xsd:annotation>
							<xsd:documentation>
								The timestamp of the most recent synchronization. Regardless of the channel or result.
								It does not provide any further details. More details can be found in the "synchronizationSituationDescription"
								property.
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="fullSynchronizationTimestamp" type="xsd:dateTime" minOccurs="0">
	     				<xsd:annotation>
							<xsd:documentation>
								The timestamp of the most recent full synchronization. Regardless of the channel or result.
								It does not provide any further details. More details can be found in the "synchronizationSituationDescription"
								property.
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
     				<xsd:element name="synchronizationSituationDescription" type="tns:SynchronizationSituationDescriptionType" minOccurs="0" maxOccurs="unbounded">
     					<xsd:annotation>
							<xsd:documentation>
								Complex description of synchronization situations. This is multi-valued proprty and it should
								store only a single value for each channel (the most recent one). All the older values shoule be
								removed on each update.
							</xsd:documentation>
						</xsd:annotation>
     				</xsd:element>
                    <xsd:element name="objectClass" type="xsd:QName">
                        <xsd:annotation>
                            <xsd:documentation>
                                The reference to a type definition for this object. The reference should point
                                to the complexType definition in the resource schema or a fixed schema
                                provided during deployment.

                                The attributes contained in the following "attributes" element are expected to
                                comply with the type definition specified in this element.

                                This QName instead of URI becase it may refer to a foreign (non-midPoint)
                                schema. Such schemas may have uknown URI-QName mapping, therefore using
                                QName seems to be more reliable.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="kind" type="tns:ShadowKindType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Kind of a shadow. This means the type of shadow use. 
                                E.g. an account, entitlement, etc.
                                If not specified defaults to "generic".
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="intent" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                The intended usage type or purpose of the object. E.g. for accounts it may be
                                "user", "admin", "test".
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="protectedObject" type="xsd:boolean" minOccurs="0" default="false">
                    	<xsd:annotation>
                    		<xsd:documentation>
                    			Protected shadows cannot be changed. They are out of IDM control.
                    			This is only informational property. Changing it will have no effect on
                    			whether object is protected or not. Object protection is a strict policy that
                    			cannot be easily overriden.
                    			
                    			This is "virtual" property. It is not stored in the repository.
                    		</xsd:documentation>
                    	</xsd:annotation>
                    </xsd:element>
                    <xsd:element name="ignored" type="xsd:boolean" minOccurs="0" default="false">
                    	<xsd:annotation>
                    		<xsd:documentation>
                    			Ignored shadows will not be processed during synchronization.
                    		</xsd:documentation>
                    	</xsd:annotation>
                    </xsd:element>
                    <xsd:element name="assigned" type="xsd:boolean" minOccurs="0" default="false">
                    	<xsd:annotation>
                    		<xsd:documentation>
                    			Set to true if the object is "legally" assigned, i.e. if there is a valid
                    			assignment for this object. It shows the value from the last recompute of
                    			the object.
                    		</xsd:documentation>
                    	</xsd:annotation>
                    </xsd:element>
                    <xsd:element name="exists" type="xsd:boolean" minOccurs="0" default="false">
                    	<xsd:annotation>
                    		<xsd:documentation>
                    			Set to true if the object is known to exist on the resource.
                    			There may be shadows for objects that do not exist yet (e.g. create operations in progress)
                    			or shadows for objects that we known nothing about yet.
                    		</xsd:documentation>
                    	</xsd:annotation>
                    </xsd:element>
                    <xsd:element name="iteration" type="xsd:int" minOccurs="0">
                    </xsd:element>
                    <xsd:element name="iterationToken" type="xsd:string" minOccurs="0">
                    </xsd:element>
                    <xsd:element name="attributes" type="tns:ShadowAttributesType" minOccurs="0">
                    </xsd:element>
                    <xsd:element name="association" type="tns:ShadowAssociationType" minOccurs="0" maxOccurs="unbounded"/>
                    <xsd:element name="activation" type="tns:ActivationType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                TODO

                                For more details see the ActivationType
                                documentation.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Activation</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="credentials" type="tns:CredentialsType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                The set of account credentials (such as
                                passwords).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="account" type="tns:ShadowType" substitutionGroup="c:object">
     	<xsd:annotation>
     		<xsd:documentation>
     			DEPRECATED. Used only for compatibility back when there was an AccountShadowType.
     		</xsd:documentation>
     		<xsd:appinfo>
      			<a:deprecated>true</a:deprecated>
      		</xsd:appinfo>
     	</xsd:annotation>
     </xsd:element>
    <xsd:element name="shadow" type="tns:ShadowType" substitutionGroup="c:object"/>
    
    <xsd:simpleType name="ShadowKindType">
        <xsd:annotation>
            <xsd:documentation>
                Defines the kind of a shadow. 
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="account">
                <xsd:annotation>
                	<xsd:documentation>
                		Represents account on a target system.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ACCOUNT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="entitlement">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENTITLEMENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="generic">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GENERIC"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
             </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="ShadowAttributesType">
    	<xsd:annotation>
            <xsd:documentation>
                Attribute values from the resource. The values may be freshly fetched from
                the resource or cached. The set of attributes may be empty, may provide a
                complete copy of the resource object or anything in between. This depends on
                the implementation of the caching and fetching strategy, configuration of the
                provisioning subsystem or operation that was invoked.

                When this object is stored, attribute set will contain attribute values that
                are (persistently) cached from the resource.

                In the normal case, there should be at least attributes that identify the
                resource object on the resource (identifiers). This will be a single attribute
                in a normal case, something like uid, username, DN, etc. But if a single attribute
                is not enough to identify the account, more than one attribute may be present.

                There also may be no attributes. This can happen e.g. if IDM system knows that
                user should have account on the resource, but the account is not yet created
                and no identifier is yet assigned to it.

                This schema does not distinguish which attributes are identifiers and which are
                ordinary attributes. That can be learned from the resource schema provided by
                resource or resource connector.

                Motivation: Resource schema is dynamic, the attribute that is identifier for a
                specific object may be different for different resources, even if the resources
                are of the same type (e.g. directory servers with different LDAP schema). And we
                do not really need to know which of the attributes is identifier in the compile-time.
                Knowing that in run-time is enough.

                Please note that this may be out of sync with regard to the resource. In some
                operations (e.g. lookup) it will be only milliseconds old, but in case of stored
                cached values this may be days or even weeks old value.

                Even though there is a single extensible element "attributes", we do not want to put
                its content directly to the body of resource object. Doing so will cause problems
                with UPA rule and it will effectively prohibit the the of type replacement extensibility
                on this object.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
	    <xsd:sequence>
	        <xsd:any namespace="##other" minOccurs="0" maxOccurs="unbounded" processContents="lax">
	        </xsd:any>
	    </xsd:sequence>
	    <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    
    <xsd:complexType name="ShadowAssociationType">
    	<xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
	    <xsd:sequence>
	        <xsd:element name="name" type="xsd:QName" minOccurs="0"/>
	        <xsd:element name="shadowRef" type="tns:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:ShadowType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
	        <xsd:element name="identifiers" type="tns:ShadowIdentifiersType" minOccurs="0" maxOccurs="1"/>
	    </xsd:sequence>
	    <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    <xsd:element name="shadowAssociation" type="tns:ShadowAssociationType" />

    <xsd:complexType name="ShadowIdentifiersType">
    	<xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
	    <xsd:sequence>
	        <xsd:any namespace="##other" minOccurs="0" maxOccurs="unbounded" processContents="lax">
	        </xsd:any>
	    </xsd:sequence>
	    <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    
    <xsd:complexType name="SynchronizationSituationDescriptionType">
    	<xsd:annotation>
    		<xsd:documentation>
    			Complex description of a synchronization situation. It describes the resulting situation
    			but also when it happened (timestamp) and from where it originated (channel).
    		</xsd:documentation>
    	</xsd:annotation>
    	<xsd:sequence>
    		<xsd:element name="situation" type="tns:SynchronizationSituationType"/>
    		<xsd:element name="timestamp" type="xsd:dateTime"/>
    		<xsd:element name="channel" type="xsd:anyURI" minOccurs="0"/>
    		<xsd:element name="full" type="xsd:boolean" minOccurs="0"/>
    	</xsd:sequence>
    </xsd:complexType>

    <!-- CONVENIENCE ELEMENTS Following definitions are there to use in examples, 
		import files, etc. These should not be used in the services -->

    <xsd:element name="objects">
        <xsd:complexType>
            <xsd:annotation>
                <xsd:documentation>
                    Object list, to be used in import files and
                    examples.
                </xsd:documentation>
                <xsd:appinfo>
                    <a:container/>
                </xsd:appinfo>
            </xsd:annotation>
            <xsd:sequence>
                <xsd:element ref="c:object" minOccurs="0" maxOccurs="unbounded"/>
            </xsd:sequence>
            <xsd:attribute name="id" type="xsd:long" use="optional"/>
        </xsd:complexType>
    </xsd:element>

    <!-- MODEL SCHEMA -->

    <!-- The following clauses belong to the model schema, not here. But due 
		to a couple of OpenESB bug (see OPENIDM-124) we were forced to include the 
		whole model and identity schema in this namespace. It's bad, ugly and very 
		dangerous. But there is no other known solution. If you know one, please 
		let us know. We will really appreciate that. -->

    <xsd:annotation>
        <xsd:documentation>
            IDM Model schema defines the structure of roles, rules, access policies, 
            method of assignment of accounts and other resource objects and all 
            the properties of access control model. It is based on the identity schema, 
            using concepts of User, Account Shadow and so on. IDM Model schema is 
            static, it is available in compile-time.

            Current IDM model schema defines very minimal RBAC model.
            It is defined as temporary model to allow midPoint to be usable
            while we take the time to design a full-featured complex IDM model.

            Expect that the model will be replaced and do not depend
            on this schema in low-level components (except perhaps repository).
        </xsd:documentation>
    </xsd:annotation>

    <xsd:complexType name="AbstractRoleType" abstract="true">
        <xsd:annotation>
            <xsd:documentation>
            	Abstract class that conins the "essence" of a role.
            	This is kind of "Roleable" interface when speaking in Java terms.
            	
                A role implies assignments. The role may "grant" accounts on resources, 
                attributes and entitlements for such accounts. The role can also assign
                organizational units, other roles or various IDM objects
                that can be assigned directly to user. Role is in fact just
                a named set of assignments.

                This is the basic building block of role-based access
                control (RBAC) in the provisioning system. It defines what
                rights (e.g. accounts) should be given to user, how they
                should look like (attributes) and what groups or native
                roles to assign to them (entitlements).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:FocusType">
                <xsd:sequence>
                	<xsd:element name="displayName" type="t:PolyStringType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                            	Human-readable name of the role or org. It may be quite long, container national characters
                            	and there is no uniqueness requirement.
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Display Name</a:displayName>
		                    	<a:displayOrder>100</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="identifier" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Identifier of the role or org. It should be a structured information usually used for
                                refering to the role or org or correlating it in various systems. E.g. numeric organizational
                                unit identifier, role code, etc. It should be unique in its "own" scope. E.g. an organizational
                                unit identifier should be unique in the scope of all organizational units but it may conflict 
                                with an identifier of a project.
                            </xsd:documentation>
                            <xsd:appinfo>
		                    	<a:displayName>Identifier</a:displayName>
		                    	<a:displayOrder>110</a:displayOrder>
		                    </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                   
                   <xsd:element name="inducement" type="tns:AssignmentType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                            	TODO
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Inducement</a:displayName>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="authorization" type="tns:AuthorizationType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Set of role authorizations.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="requestable" type="xsd:boolean" minOccurs="0" default="false">
                    	<xsd:annotation>
                    		<xsd:documentation>
                    			If set to true then this role may be directly requested by the users.
                    		</xsd:documentation>
                    	</xsd:annotation>
                    </xsd:element>
					<xsd:element name="exclusion" type="tns:ExclusionType" minOccurs="0" maxOccurs="unbounded">
						<xsd:annotation>
							<xsd:documentation>
								Specification of excluded roles (part of Segregation of Duties policy).
							</xsd:documentation>
						</xsd:annotation>
					</xsd:element>
					<xsd:element name="riskLevel" type="xsd:string" minOccurs="0">
                    	<xsd:annotation>
                    		<xsd:documentation>
                    			Indication of the level of risk associated with the persissions that this role assigns.
                    			This may be a numeric value, textual label are any other suitable machine-processable indication.
                    		</xsd:documentation>
                    	</xsd:annotation>
                    </xsd:element>
					<xsd:element name="ownerRef" type="c:ObjectReferenceType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Owner of this role. The owner is a person (or group) that is responsible for maintenance of
                                role definition.
                                This reference may point to object of type UserType of OrgType.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
					<xsd:element name="approverRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Approvers for this role. The approver is a person (or group) that approves assignment
                                of this role to other users.
                                This reference may point to object of type UserType of OrgType.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="approverExpression" type="c:ExpressionType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Approvers for this role. If specified, the expression(s) are evaluated and the result
                                is used as a set of approvers (UserType, OrgType, RoleType, or any combination of them).
                                May be used with approverRef element(s).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="approvalSchema" type="c:ApprovalSchemaType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                More complex (multi-level) approval schema. If used, it overrides both
                                approverRef and approverExpression elements.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="approvalProcess" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Name of custom approval process. If used, it overrides
                                approverRef, approverExpression, and approvalSchema elements.

                                For explicitness, only one of approverRef(s)/approverExpression(s),
                                approvalSchema and approvalProcess should be specified.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="automaticallyApproved" type="c:ExpressionType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Condition specifying when the assignment is automatically approved (e.g. "user is
                                from Board of Directors"). This is an expression that should yield a boolean value.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="condition" type="tns:MappingType" minOccurs="0">
		               <xsd:annotation>
		                   <xsd:documentation>
		                       The role is applied only if the condition is evaluated to true.
		                       If condition is not present, it is assumed to be true.
		                   </xsd:documentation>
		               </xsd:annotation>
		           </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    
    <xsd:complexType name="AuthorizationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element ref="tns:description" minOccurs="0"/>
        	<xsd:element name="decision" minOccurs="0" type="tns:AuthorizationDecisionType" default="allow"/>
        	<xsd:element name="action" type="xsd:anyURI" minOccurs="1" maxOccurs="unbounded">
        		<xsd:annotation>
        			<xsd:documentation>
        				Action part from the (subject,action,object) authorization triple. It is an URL to allow extension.
        				Multiple actions may be specified. In that case the authorization applies to all of them.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="phase" type="tns:AuthorizationPhaseType" minOccurs="0" maxOccurs="1">
        		<xsd:annotation>
        			<xsd:documentation>
        				Specifies when to conduct authorizationa and what exactly to authorize.
        				If no phase is specified then the authorization applies to all phases.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="object" type="tns:OwnedObjectSpecificationType" minOccurs="0" maxOccurs="unbounded">
        		<xsd:annotation>
        			<xsd:documentation>
        				Object part from the (subject,action,object) authorization triple.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="item" type="t:ItemPathType"  minOccurs="0" maxOccurs="unbounded">
        		<xsd:annotation>
        			<xsd:documentation>
        				Specification of items that form a scope of this authorization. This autorization will
        				only affect the items specified in this element. If no items are specified then the
        				authorization applies to all items in the objects.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="target" type="tns:OwnedObjectSpecificationType" minOccurs="0" maxOccurs="unbounded">
        		<xsd:annotation>
        			<xsd:documentation>
        				Target of the operation. E.g. an role that is being assigned. It can be considered an operation
        				parameter. If no target is specified then the authorization applies to all possible targets.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<!-- TODO: more elements will be added in the future: condition, parameters -->
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
	</xsd:complexType>
		
	<xsd:simpleType name="AuthorizationDecisionType">
        <xsd:annotation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="allow">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALLOW"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="deny">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DENY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:simpleType name="AuthorizationPhaseType">
        <xsd:annotation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="request">
                <xsd:annotation>
                	<xsd:documentation>
                		Authorize the requested operations. I.e. the authorization happens
                		at the beginning of request processing. 
                		The request may be spread to many other oprations but in this case
                		only the explicitly requested set is authorized.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REQUEST"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="execution">
                <xsd:annotation>
                	<xsd:documentation>
                		Authorize the executed operations. I.e. the authorization happens
                		at the end of request processing. 
                		The request may be spread to many other oprations but in this case
                		all the requested and computed operations are authorized.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXECUTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

	<xsd:complexType name="ObjectSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Selects some objects from all the objects in midPoint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element ref="tns:description" minOccurs="0"/>
        	<xsd:element name="type" minOccurs="0" type="xsd:QName">
        		<xsd:annotation>
        			<xsd:documentation>
        				Type of the object to select.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
			<xsd:element name="orgRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        <p>
                        	Top node of an organizational hierarchy. This node and all of its subnodes
                        	(transitively, unlimited depth) are considered selected.
                        </p>
                    </xsd:documentation>
                    <xsd:appinfo>
            			<a:objectReferenceTargetType>tns:OrgType</a:objectReferenceTargetType>
            		</xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
        	<xsd:element name="filter" type="q:SearchFilterType" minOccurs="0" maxOccurs="1">
        		<xsd:annotation>
        			<xsd:documentation>
        				Filter that an object must match to be considered selected by this statement.
        				This filter MUST NOT containt organization unit clauses. It may only contain
        				property clauses, logical operations and so on.
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="special" type="tns:SpecialObjectSpecificationType" minOccurs="0" maxOccurs="unbounded">
        		<xsd:annotation>
        			<xsd:documentation>
        				Defines special object by relative description, such as "self".
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        </xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
	</xsd:complexType>
	
	<xsd:complexType name="OwnedObjectSpecificationType">
        <xsd:annotation>
            <xsd:documentation>
                Selects some objects from all the objects in midPoint.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:ObjectSpecificationType">
		        <xsd:sequence>
			        <xsd:element name="owner" type="tns:ObjectSpecificationType" minOccurs="0" maxOccurs="1">
						<xsd:annotation>
							<xsd:documentation>
								The object matches the specification if it has an owner specified by this element.
								The "owner" means a focus that has a link to the object.
							</xsd:documentation>
						</xsd:annotation>
			        </xsd:element>
		        </xsd:sequence>        	
        	</xsd:extension>
        </xsd:complexContent>
	</xsd:complexType>

	<xsd:simpleType name="SpecialObjectSpecificationType">
        <xsd:annotation>
        	<xsd:documentation>
        		Specification used to select special cases that are usually context-relative.
        	</xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="self">
                <xsd:annotation>
                    <xsd:appinfo>
                    	<xsd:documentation>
                    		Object that represents itself. This usually represents an
                    		object that corresponds to a currently logged-in user.
                    		E.g. it may be used to allow each user to change his own password.
                    	</xsd:documentation>
                        <jaxb:typesafeEnumMember name="SELF"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="RoleType">
        <xsd:annotation>
            <xsd:documentation>
                A role that implies assignments.
                The role may "grant" accounts on resources, attributes and
                entitlements for such accounts. The role can also assign
                organizational units, other roles or various IDM objects
                that can be assigned directly to user. Role is in fact just
                a named set of assignments.

                The specific roles are also called technical role or IT role,
                however this definition is an abstract definition of concept
                that can span wide area of interpretation.

                This is the basic building block of role-based access
                control (RBAC) in the provisioning system. It defines what
                rights (e.g. accounts) should be given to user, how they
                should look like (attributes) and what groups or native
                roles to assign to them (entitlements).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:AbstractRoleType">
                <xsd:sequence>
                    <xsd:element name="roleType" type="xsd:string" minOccurs="0">
                    	<xsd:annotation>
                    		<xsd:documentation>
                    			Type of a role, usually denotes a "layer" or "purpose" of the role.
                    			Such as "business", "IT", "asset", etc.
                    			This field has no special meaning in the IDM computation logic. Its purpose
                    			is to organize roles for presentation (GUI) and management. It may influence
                    			role lifecycle in later midpoint releases. 
                    		</xsd:documentation>
                    	</xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="role" type="tns:RoleType" substitutionGroup="tns:object"/>

    <xsd:element name="approverRef" type="tns:ObjectReferenceType" />

    <xsd:complexType name="ApprovalSchemaType">
        <xsd:annotation>
            <xsd:documentation>
                Rules for approving something (e.g. assignment of a role to a user).
                Specifies the structure of approvers and their relations.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string" minOccurs="0"/>
            <xsd:element name="description" type="xsd:string" minOccurs="0"/>
            <xsd:element name="level" type="c:ApprovalLevelType" minOccurs="1" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Levels, or steps, of the approval process.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ApprovalLevelType">
        <xsd:annotation>
            <xsd:documentation>
                One "level" (or step) in the approval process.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string" minOccurs="0"/>
            <xsd:element name="description" type="xsd:string" minOccurs="0"/>
            <xsd:element name="approverRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Instruction to approve something, by a user (if this points to a User object) or
                        by someone from a group of users (if this points to a Role or Org object; representing
                        all users that possess that role or belong to that OU).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="approverExpression" type="c:ExpressionType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Dynamically specifies approver(s). If specified, the expression(s) are evaluated and the result
                        is used as a set of approvers (UserType, OrgType, RoleType, or any combination of them).
                        May be used with approverRef element(s).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="evaluationStrategy" type="c:LevelEvaluationStrategyType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Must all approvers at this level approve the thing (allMustApprove),
                        or first decision is taken as authoritative (firstDecides)?
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="automaticallyApproved" type="c:ExpressionType" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        Condition specifying when this level is automatically approved (e.g. "user is
                        from Board of Directors"). This is an expression that should yield a boolean value.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="LevelEvaluationStrategyType">
        <xsd:annotation>
            <xsd:documentation>
                Enumeration of approval strategies at a particular level.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="allMustApprove">
                <xsd:annotation>
                    <xsd:documentation>
                        All approvers at a particular level must approve the operation.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL_MUST_AGREE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="firstDecides">
                <xsd:annotation>
                    <xsd:documentation>
                        First approver that votes will decide the whole level (either by approving or by rejecting).
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FIRST_DECIDES"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ExclusionType">
    	<xsd:annotation>
    		<xsd:documentation>
    			Container that defines exclusion of entities (e.g. roles).
    			It is a part of Segregation of Duties (SoD) mechanism.
    		</xsd:documentation>
    		<xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
    	</xsd:annotation>
    	<xsd:sequence>
    		<xsd:element ref="tns:description" minOccurs="0"/>
    		<xsd:element name="targetRef" type="tns:ObjectReferenceType">
    			<xsd:annotation>
    				<xsd:documentation>
    					Target of exclusion. The object defining this "exclustion" and
    					the object defined as target cannot be assigned at the same time.
    				</xsd:documentation>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="policy" type="tns:ExclusionPolicyType" minOccurs="0"/>
    	</xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
    </xsd:complexType>
    
    <xsd:simpleType name="ExclusionPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Enumeration of exclustion policy enforcement types.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="enforce">
                <xsd:annotation>
                	<xsd:documentation>
                		Enforce the policy. Excluded entities must not be assigned together.
                		Attempt to do so will result in an error.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ENFORCE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="approve">
                <xsd:annotation>
                	<xsd:documentation>
                		Exceptions to the policy are possible but are subject to an approval. 
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="APPROVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="report">
                <xsd:annotation>
                	<xsd:documentation>
                		Policy will not be enforced in any way, the violations will only
                		be reported.
                	</xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPORT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    

    <xsd:complexType name="ConstructionType">
       <xsd:annotation>
      <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
             </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:description" minOccurs="0" maxOccurs="1"/>
            <xsd:element ref="c:extension" minOccurs="0" maxOccurs="1"/>
            <xsd:choice>
                <xsd:element name="resourceRef" type="c:ObjectReferenceType" minOccurs="0">
                    <xsd:annotation>
                        <xsd:documentation>
                            Reference to a resource that should host the implied account.
                        </xsd:documentation>
                        <xsd:appinfo>
                    		<a:objectReferenceTargetType>tns:ResourceType</a:objectReferenceTargetType>
                    	</xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
                <xsd:element name="resource" type="tns:ResourceType" minOccurs="0">
                    <xsd:annotation>
                        <xsd:documentation>
                            Resource that should host the implied resource object.
                        </xsd:documentation>
                        <xsd:appinfo>
                    		<a:objectReference>tns:resourceRef</a:objectReference>
                    	</xsd:appinfo>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice>
            <xsd:choice>
                <xsd:element name="kind" type="tns:ShadowKindType" minOccurs="0" default="account">
                    <xsd:annotation>
                        <xsd:documentation>
                            Kind of resource object that should be created on the resource.

                            This element is optional. If not specified defaults to account kind.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice>
            <xsd:choice>
                <xsd:element name="intent" type="xsd:string" minOccurs="0">
                    <xsd:annotation>
                        <xsd:documentation>
                            Intent of resource object that should be created on the resource.

                            This must point to the a valid definition in
                            the resource object (in schemaHandling section).

                            This element is optional. If not specified then the definition
                            marked as default in the resource definition should be used.
                        </xsd:documentation>
                    </xsd:annotation>
                </xsd:element>
            </xsd:choice>
            <xsd:element name="attribute" type="tns:ResourceAttributeDefinitionType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Resource object attribute values implied by this role.
                        When the role is assigned the attributes specified
                        below should be assigned values specified below.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="association" type="tns:ResourceObjectAssociationType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="construction" type="tns:ConstructionType"/>


    <xsd:complexType name="ObjectTemplateType">
        <xsd:annotation>
            <xsd:documentation>
            	TODO: update
                The user template used to create new users. It
                contains fixed values or expressions that can set-up
                a new user obejct. It is used only during user creation in the
                synchronization code, but will be most likely used also
                on other places later.

                The goal is to make this a kind of "policy" how the use object
                should look like and check it on every user modification.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
                	<xsd:element name="includeRef" type="tns:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                		<xsd:annotation>
                			<xsd:documentation>
                				Included template. All the mappings of the included template are processed as if they
                				were directly placed in this template.
                			</xsd:documentation>
                			<xsd:appinfo>
                				<a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                			</xsd:appinfo>
                		</xsd:annotation>
                	</xsd:element>
                	<xsd:element name="iteration" type="tns:IterationSpecificationType" minOccurs="0"/>
                	<xsd:element name="item" type="tns:ObjectTemplateItemDefinitionType" minOccurs="0"
                                 maxOccurs="unbounded"/>
                    <xsd:element name="mapping" type="tns:ObjectTemplateMappingType" minOccurs="0"
                                 maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Defines how any of the User's properties should
                                be constructed. It can contain fixed value or
                                an expression.

                                In case an expression is used following variables should be set:
                                $user - The user object being created.
                                $account - (optional) the account from which was the user created (if present)

                                Note: the expressions will be evaluated in the order as
                                they are specified in the XML file for now, as the dependency
                                mechanism does not work yet. Later, the order should be insignificant.
                                
                                DEPRECATED. Use "item" mechanism instead.
                            </xsd:documentation>
							<xsd:appinfo>
								<a:deprecated>true</a:deprecated>
							</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="userTemplate" type="tns:ObjectTemplateType" substitutionGroup="c:object"/>
    <xsd:element name="objectTemplate" type="tns:ObjectTemplateType" substitutionGroup="c:object"/>
    
    <xsd:complexType name="ObjectTemplateItemDefinitionType">
        <xsd:annotation>
            <xsd:documentation>
            	TODO
            	
                Description of the common item handling details, such as display name,
                read/write access and value and synchronization expressions.
                These are the parts that are common to both attributes and associations.
                
                This is supposed to be used in schemaHandling part and therefore
                describe the decisions of the system administrator about the
                way how that attribute or association is used in midPoint.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
        	<xsd:extension base="tns:ItemRefinedDefinitionType">
        		<xsd:sequence>
	            <xsd:element name="mapping" type="tns:ObjectTemplateMappingType" minOccurs="0" maxOccurs="unbounded">
	                <xsd:annotation>
	                    <xsd:documentation>
	                        Defines how any of the object property value should
                            be constructed. It can contain fixed value or
                            an expression.

                            In case an expression is used following variables should be set:
                            $user - The user object being created.
                            $account - (optional) the account from which was the user created (if present)
	                    </xsd:documentation>
	                </xsd:annotation>
	            </xsd:element>
	        </xsd:sequence>
	      </xsd:extension>
	   </xsd:complexContent>
    </xsd:complexType>
    
    <xsd:complexType name="ObjectTemplateMappingType">
    	<xsd:complexContent>
    		<xsd:extension base="tns:MappingType">
    			<xsd:sequence>
    				<xsd:element name="evaluationPhase" type="tns:ObjectTemplateMappingEvaluationPhaseType" 
    								minOccurs="0" default="beforeAssignments"/>
    			</xsd:sequence>
    		</xsd:extension>
    	</xsd:complexContent>
    </xsd:complexType>
    
    <xsd:simpleType name="ObjectTemplateMappingEvaluationPhaseType">
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="beforeAssignments">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BEFORE_ASSIGNMENTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="afterAssignments">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="AFTER_ASSIGNMENTS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:complexType name="OrgType">
        <xsd:annotation>
            <xsd:documentation>
            	Organizational unit, division, section, object gropup, team or any other form of
            	organizing things and/or people.
            	
            	OrgType is also a role (RoleType). This feature may not be used for majority of
            	OrgType instances. But it is very useful if membership in an org unit automatically
            	grants some accounts or roles.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:AbstractRoleType">
                <xsd:sequence>
                    
                    <xsd:element name="orgType" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Type of the org. This may specify whether it is department, division, project, team, ...
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Type</a:displayName>
                                <a:displayOrder>120</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

					<xsd:element name="tenant" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false">
                        <xsd:annotation>
                            <xsd:documentation>
                                Flag indicating whether this object is a tenant or not. Tenants are top-level
                                organizational units of organizational structures that are designed to be independent
                                of one another. It represents a "customer" is service provider environment.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Is tenant</a:displayName>
                                <a:displayOrder>130</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="costCenter" type="xsd:string" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                The name of the cost center that applies to this org.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Cost Center</a:displayName>
                                <a:displayOrder>200</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="locality" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Primary locality of the org, the place where
                                the org is usually placed, the country, city or
                                building that it belongs to. The specific meaning
                                and form of this property is deployment-specific.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Locality</a:displayName>
                                <a:displayOrder>210</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="mailDomain" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Domain part of RFC822 e-mail address that applies to this organization.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Mail Domain</a:displayName>
                                <a:displayOrder>220</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="displayOrder" type="xsd:int" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                The content of this property specifies an order in which the organization
                                should be displayed relative to other organizations at the same level.
                                Organizations will be displayed by sorting them by the values of displayOrder
                                property (ascending). These that do not have any displayOrder annotation
                                will be displayed last. Organizations with the same displayOrder
                                are displayed in alphabetic order.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:displayName>Display Order</a:displayName>
                                <a:displayOrder>300</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="passwordPolicyRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the password policy settings which will be used for generate/validate password for this organization.

                                TODO: better documentation
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ValuePolicyType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="org" type="tns:OrgType" substitutionGroup="c:object"/>
    
    <xsd:complexType name="LookupTableType">
        <xsd:annotation>
            <xsd:documentation>
            	<p>
	                An object that represents lookup table. The lookup table can be used for two purposes:
	                value enumerations (e.g. for GUI or validation) and value mapping (translation).
	                The same lookup table can serve both purposes at the same time.
                </p>
                <p>
                	The content of the lookup table can be used as enumeration. E.g. the labels for each
                	table row can be displayed in the user interface. When a particular label is selected then
                	the associated key will be stored. Similar approach can be used for validation, e.g. when only
                	a selected set of values is legal for a certain property. In this case the "key" and "label"
                	columns are used.
                </p>
                <p>
                	The content of the lookup table can also be used for value mapping. E.g. in cases when
                	input value needs to be mapped to the output value. In this case the "key" and "value"
                	columns are used.
                </p>
                <p>
                	Even though the lookup table is represented as a prism object, it is designed to be
                	stored and queried efficiently. Therefore the contents of the lookup table will
                	be stored in a specialized table tuned for this purpose. This data type is not
                	designed to be used with the usual midPoint query mechanism (e.g. searchObjects operation).
                	Specialized operations are used to efficiently query the lookup tables. The prism 
                	representation (e.g. XML) of the lookup tables is used only for backup, restore, migrations,
                	upgrades and similar purposes.
                </p>
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
                	<xsd:element name="table" type="tns:LookupTableTableType" minOccurs="0"/>
                	<!-- TODO: Maybe more settings describing the intended use of the lookup table. -->
                	<!-- TODO: Lookup table synchronization settings? (e.g. resourceRef) -->
                </xsd:sequence>
           </xsd:extension>
       </xsd:complexContent>
   </xsd:complexType>
   <xsd:element name="lookupTable" type="tns:LookupTableType" substitutionGroup="c:object"/>
   
   <xsd:complexType name="LookupTableTableType">
       	<xsd:annotation>
    		<xsd:documentation>
    			Data structure that represents entire content of the lookup table.
    		</xsd:documentation>
    		<xsd:appinfo>
    			<a:container/>
    		</xsd:appinfo>
    	</xsd:annotation>
    	<xsd:sequence>
    		<xsd:element name="row" type="tns:LookupTableRowType" minOccurs="0" maxOccurs="unbounded"/>
   		</xsd:sequence>
        <xsd:attribute name="id" type="xsd:long" use="optional"/>
 	</xsd:complexType>

   <xsd:complexType name="LookupTableRowType">
       	<xsd:annotation>
    		<xsd:documentation>
    			Lookup table row. The table row is a (complex) property. It is intentionally not
    			a container, so we can avoid maintaining container IDs for each row. The delta semantics
    			has a slightly different meaning for the lookup tables. Each key must be unique and the key
    			functions as an implicit identifier. E.g. adding a new row with a key that does not exist yet
    			will insert a new row. Adding a new row with key that already exists will overwrite existing row.
    			Replace operation on this property will efficiently clear the entire table and replace it with a new data.
    			We do not recommend using this operation as it may be very inefficient. Add and delete operations are
    			expected during normal operation.
    		</xsd:documentation>
    	</xsd:annotation>
    	<xsd:sequence>
    		<xsd:element name="key" type="xsd:string" minOccurs="1" maxOccurs="1">
    			<xsd:annotation>
    				<xsd:documentation>
    					Lookup table key column. This is the mandatory (non-null) column that usually
    					works as a mapping key. If the lookup table is used as an emumeration (there is no value column)
    					then the value of key column will be stored in the property when selected.
    					If the lookup table is used as a map, the value of key column will be matched to the
    					input variable.
    					
    					The value of the key is limited to a usual size of a "databse string". The actual size
    					constraint depends on the type of the database used as midPoint repository. It is
    					not recommended to use long values as keys.
    				</xsd:documentation>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="value" type="xsd:string" minOccurs="0" maxOccurs="1">
    			<xsd:annotation>
    				<xsd:documentation>
    					Lookup table value column. This is optional column that represents mapping output.
    					The appropriate row will be selected by using the key. The corresponding value will be used
    					as output.
    					
    					This column has no use if the lookup table is used as an enumeration.
    					The value of the key is limited to a usual size of a "databse string". The actual size
    					constraint depends on the type of the database used as midPoint repository. We expect that
    					this column may contain quasi-structured data. But this column is not intended for a very rich
    					data structures, such as long XML snippets. If structured data must be stored in this column
    					then we recommend to use very tight "microformats" such as separating the values with collons.
    					
    					A special-purpose CLOB column for richer data formats might be added in the future.
    				</xsd:documentation>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="label" type="t:PolyStringType" minOccurs="0" maxOccurs="1">
    			<xsd:annotation>
    				<xsd:documentation>
    					Columnt that contains a user-friendly label for corresponding to the key.
    					This label will be displayed in user interface as a representation of the key.
    					The label has no meaning when the lookup table is used to map values.
    				</xsd:documentation>
    			</xsd:annotation>
    		</xsd:element>
    		<xsd:element name="lastChangeTimestamp" type="xsd:dateTime" minOccurs="0" maxOccurs="1">
    			<xsd:annotation>
    				<xsd:documentation>
    					Timestamp of the last change of the row. This is automatically manintaned by
    					the repository. It is updated every time the row is created or updated.
    					This row is intended to act as a "token" if the lookup table needs to be synchronized
    					with external resource.
    				</xsd:documentation>
    				<xsd:appinfo>
    					<a:operational>true</a:operational>
    				</xsd:appinfo>
    			</xsd:annotation>
    		</xsd:element>
   		</xsd:sequence>
 	</xsd:complexType>

    <!-- OPERATIONAL SCHEMA -->

    <!-- The following clauses belong to the operation support. -->

    <xsd:complexType name="ValuePolicyType">
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
                    <xsd:element name="lifetime" type="c:PasswordLifeTimeType" minOccurs="1" maxOccurs="1"/>
                    <xsd:element name="stringPolicy" type="c:StringPolicyType" minOccurs="1" maxOccurs="1"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    
    <xsd:element name="valuePolicy" type="tns:ValuePolicyType"/>

    <xsd:complexType name="PasswordLifeTimeType">
        <xsd:sequence>
            <xsd:element name="expiration" type="xsd:int" default="-1" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days before password expires
                        -1 : means password doesn't expire
                        0 : means password is expired
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="warnBeforeExpiration" default="0" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days before password expiration to
                        send warnings (0 means no warnings)
                    </xsd:documentation>
                </xsd:annotation>
                <xsd:simpleType>
                    <xsd:restriction base="xsd:int">
                        <xsd:minInclusive value="0"/>
                    </xsd:restriction>
                </xsd:simpleType>
            </xsd:element>
            <xsd:element name="lockAfterExpiration" default="0" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days after password after password
                        expiration the account will be locked (0 means never
                        will be locked)
                    </xsd:documentation>
                </xsd:annotation>
                <xsd:simpleType>
                    <xsd:restriction base="xsd:int">
                        <xsd:minInclusive value="0"/>
                    </xsd:restriction>
                </xsd:simpleType>
            </xsd:element>
            <xsd:element name="minPasswordAge" type="xsd:int" default="0" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of days before password may be changed (0
                        means password can be changed immediately)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="passwordHistoryLength" type="xsd:int" default="0" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Number of unique passwords in history (0 - no
                        history)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="passwordLifeTime" type="tns:PasswordLifeTimeType"/>

    <xsd:complexType name="StringPolicyType">
        <xsd:sequence>
            <xsd:element name="description" type="xsd:string" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="limitations" type="tns:LimitationsType" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="characterClass" type="tns:CharacterClassType" minOccurs="0" maxOccurs="1"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LimitationsType">
        <xsd:annotation>
            <xsd:documentation>Definition of complexity and string policy
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="minLength" type="xsd:int" default="0" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="maxLength" type="xsd:int" default="-1" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="minUniqueChars" type="xsd:int" default="0" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="checkAgainstDictionary" type="xsd:boolean" default="false" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="checkPattern" type="xsd:string" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="limit" type="tns:StringLimitType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="StringLimitType">
        <xsd:annotation>
            <xsd:documentation>Definition of valid single string limitation
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="description" type="xsd:string" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="minOccurs" type="xsd:int" default="0" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="maxOccurs" type="xsd:int" default="-1" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="mustBeFirst" type="xsd:boolean" default="false" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="characterClass" type="tns:CharacterClassType" minOccurs="0" maxOccurs="1"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="CharacterClassType">
        <xsd:annotation>
            <xsd:documentation>Definition of valid characters in class. Default
                value is ASCII printable characters (Codes 0x20
                to 0x7E)
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:choice>
                <xsd:element name="characterClass" type="tns:CharacterClassType" minOccurs="1" maxOccurs="unbounded"/>
                <xsd:element name="value" type="xsd:string" minOccurs="1"/>
            </xsd:choice>
        </xsd:sequence>
        <xsd:attribute name="ref" type="xsd:QName" use="optional"/>
        <xsd:attribute name="name" type="xsd:QName" use="optional"/>
    </xsd:complexType>

    <xsd:complexType name="OperationResultType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="operation" type="xsd:string"/>
            <xsd:element name="status" type="tns:OperationResultStatusType"/>
            <xsd:element name="params" type="tns:ParamsType" minOccurs="0"/>
            <xsd:element name="context" type="tns:ParamsType" minOccurs="0"/>
            <xsd:element name="returns" type="tns:ParamsType" minOccurs="0"/>
            <xsd:element name="token" type="xsd:long" minOccurs="0"/>
            <xsd:element name="messageCode" type="xsd:string" minOccurs="0"/>
            <xsd:element name="message" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Error or warning message.
                        This is optional, as some types does not need a message (e.g. success).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="localizedMessage" type="tns:LocalizedMessageType" minOccurs="0"/>
            <xsd:element name="details" type="xsd:string" minOccurs="0"/>
            <xsd:element name="partialResults" type="tns:OperationResultType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="operationResult" type="tns:OperationResultType"/>

    <xsd:complexType name="LocalizedMessageType">
        <xsd:sequence>
            <xsd:element name="key" type="xsd:string"/>
            <xsd:element name="argument" type="xsd:anySimpleType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ParamsType">
        <xsd:sequence>
            <xsd:element name="entry" type="tns:EntryType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="params" type="tns:ParamsType"/>

    <xsd:complexType name="EntryType">
        <xsd:sequence>
        	<xsd:element ref="tns:entryValue" minOccurs="0" />
<!--             <xsd:any processContents="lax" minOccurs="0"> -->
<!--                 <xsd:annotation> -->
<!--                     <xsd:documentation> -->
<!--                         Value of the entry. If there is a object that can native XML representation, such representation -->
<!--                         should -->
<!--                         be used. Otherwise the UnknownJavaObject can be used. -->
<!--                     </xsd:documentation> -->
<!--                 </xsd:annotation> -->
<!--             </xsd:any> -->
        </xsd:sequence>
        <xsd:attribute name="key" type="xsd:string" use="required"/>
    </xsd:complexType>
    
    <xsd:element name="entryValue" abstract="true"/>
    
    <xsd:element name="paramValue" type="xsd:anyType" substitutionGroup="tns:entryValue" nillable="true">
        <xsd:annotation>
            <xsd:documentation>
                Static value for the attribute or property.

                Static attribute values. The values in this element should be
                assigned to the account as-is.

                List of values for the attribute provided in an appropriate XML elements
                that specify attribute name. (as is usual for properties)

                Only one attribute may be specified here, although it may have multiple
                values. Multi-valued attributes are expressed by repeating the same XML
                element multiple times.
                Hence all the XML elements that match this xsd:any must have the same
                element names (may have different values of course).


                Please note that this is nillable and therefore it may be
                explicitly set to "nil" value. Doing this means that empty
                set of values should be constructed. E.g. setting
                this to "nil" and also setting "authoritative" flag
                may enforce removal of all attribute values (if used properly).
            </xsd:documentation>
            <xsd:appinfo>
                <a:rawType/>
            </xsd:appinfo>
        </xsd:annotation>
    </xsd:element>

    <xsd:simpleType name="OperationResultStatusType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="success">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUCCESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="warning">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WARNING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="partial_error">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PARTIAL_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="fatal_error">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FATAL_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="handled_error">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HANDLED_ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="not_applicable">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NOT_APPLICABLE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="in_progress">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN_PROGRESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unknown">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNKNOWN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="UnknownJavaObjectType">
        <xsd:annotation>
            <xsd:documentation>
                Type used to represent Java objects that are otherwise unknown to the system and cannot be
                represented in "canonical" XML form. This must be used only in diagnostics messages intended
                to be displayed to the human user. It must not be used in places indended for computer processing.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="class" type="xsd:string"/>
            <xsd:element name="toString" type="xsd:string"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:element name="unknownJavaObject" type="tns:UnknownJavaObjectType" substitutionGroup="tns:entryValue"/>

    <!-- Configuration types -->

    <xsd:complexType name="SystemConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                System configuration object.

                Holds global system configuration setting. There will be just one object of
                this type in the system. It will have a well-known OID.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="globalAccountSynchronizationSettings"
                                 type="tns:ProjectionPolicyType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                System-global account synchronization settings. These will be used if there is no
                                specific settings
                                (e.g. per resource or per request).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="globalPasswordPolicy" type="tns:ValuePolicyType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                System-global password policy settings. These will be used if there is no specific settings 
                                (e.g. per account)

                                TODO: better documentation
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReference>tns:globalPasswordPolicyRef</a:objectReference>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="globalPasswordPolicyRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the global password policy settings.

                                TODO: better documentation
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ValuePolicyType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="globalSecurityPolicyRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the global security policy settings.

                                TODO: better documentation
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:SecurityPolicyType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="modelHooks" type="tns:ModelHooksType" minOccurs="0"/>
                    <xsd:element name="logging" type="tns:LoggingConfigurationType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Persistent configuration of logging levels, categories, etc.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="defaultUserTemplate" type="tns:ObjectTemplateType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                            	<p>
                                User template that will be used "universally" in all situations regarding user internal
                                consistency.
                                </p>

                                <p>DEPRECATED: use objectTemplate instead.</p>
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReference>tns:defaultUserTemplateRef</a:objectReference>
                    			<a:deprecated/>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="defaultUserTemplateRef" type="tns:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                            	<p>
                                Reference to the default user template that will be used "universally" in all
                                situations regarding user internal consistency.
                                </p>

								<p>DEPRECATED: use objectTemplate instead.</p>
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
                    			<a:deprecated/>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="objectTemplate" type="tns:ObjectPolicyConfigurationType" minOccurs="0" maxOccurs="unbounded">
	                    <xsd:annotation>
							<xsd:documentation>
								Definition of default object templates for a individual object type. The templates will be used
								"universally" during all operations with specified object types - unless the templates are overriden
								in other definitions (e.g. in resource).
								
								DEPRECATED. Use defaultObjectPolicyConfiguration instead.
							</xsd:documentation>
							<xsd:appinfo>
								<a:container/>
								<a:deprecated>true</a:deprecated>
							</xsd:appinfo>
						</xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="defaultObjectPolicyConfiguration" type="tns:ObjectPolicyConfigurationType" minOccurs="0" maxOccurs="unbounded">
	                    <xsd:annotation>
							<xsd:documentation>
								Definition of default object policy for a individual object type. The definition of this policy
								contains object template and other similar settings. The policy will be used
								"universally" during all operations with specified object types - unless it is overriden
								in other definitions (e.g. in resource or org).
							</xsd:documentation>
							<xsd:appinfo>
								<a:container/>
							</xsd:appinfo>
						</xsd:annotation>
                    </xsd:element>
                    

                    <xsd:element name="connectorFramework" minOccurs="0" maxOccurs="1" type="tns:ConnectorFrameworkType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Global configuration of connectors and connector frameworks.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    
                    <xsd:element name="notificationConfiguration" type="tns:NotificationConfigurationType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for user notifications. In future, it might be overriden e.g. at a level
                                of a user.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="profilingConfiguration" type="tns:ProfilingConfigurationType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration for profiling purposes. The first iteration of profiling integration has
                                only few configuration options, but profiling feature will grow in near future.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="cleanupPolicy" type="tns:CleanupPoliciesType" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                A configuration of cleanup intervals.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="systemConfiguration" type="tns:SystemConfigurationType"/>
   

	<xsd:complexType name="ObjectPolicyConfigurationType">
		<xsd:annotation>
			<xsd:documentation>
				Definition of policy for a specific object type. It defines object template
				and similar settings that apply to the object alone. This policy settings
				apply to the object internal structure without regard to other objects.
			</xsd:documentation>
			<xsd:appinfo>
				<a:container/>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:sequence>
			<xsd:element name="type" type="xsd:QName">
				<xsd:annotation>
					<xsd:documentation>
						Specification of the type (class) of the object to apply this template to.
					</xsd:documentation>
				</xsd:annotation>
			</xsd:element>
			<xsd:element name="objectTemplateRef" type="tns:ObjectReferenceType">
                 <xsd:annotation>
                     <xsd:documentation>
                         Reference to the template.
                     </xsd:documentation>
                     <xsd:appinfo>
             			<a:objectReferenceTargetType>tns:ObjectTemplateType</a:objectReferenceTargetType>
             		</xsd:appinfo>
                 </xsd:annotation>
             </xsd:element>
             <xsd:element name="propertyConstraint" type="tns:PropertyConstraintType" minOccurs="0" maxOccurs="unbounded"/>
             <xsd:element name="oidNameBoundMode" type="xsd:boolean" minOccurs="0" default="false">
             	<xsd:annotation>
             		<xsd:documentation>
             			A mode in which OID and name of the specified object are the same.
             		</xsd:documentation>
             		<xsd:appinfo>
             			<a:deprecated>true</a:deprecated>
             		</xsd:appinfo>
             	</xsd:annotation>
             </xsd:element>
		</xsd:sequence>
	</xsd:complexType>
	
	<xsd:complexType name="PropertyConstraintType">
		<xsd:annotation>
			<xsd:documentation>
				Definition of a property constraints.
			</xsd:documentation>
			<xsd:appinfo>
				<a:container/>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:sequence>
			<xsd:element name="path" type="t:ItemPathType" minOccurs="1" maxOccurs="1">
			</xsd:element>
			<!-- TODO: uniqueness constraint -->
             <xsd:element name="oidBound" type="xsd:boolean" minOccurs="0" default="false">
             	<xsd:annotation>
             		<xsd:documentation>
             			The property value will be bound to OID. This property will be set to the value
             			of OID and it cannot be changed.
             		</xsd:documentation>
             		<xsd:appinfo>
             			<a:deprecated>true</a:deprecated>
             		</xsd:appinfo>
             	</xsd:annotation>
             </xsd:element>
		</xsd:sequence>
	</xsd:complexType>

    <xsd:complexType name="ConnectorFrameworkType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="configuration" type="tns:ConnectorFrameworkConfigurationType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Global configuration properties of a connector framework.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ConnectorFrameworkConfigurationType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element ref="tns:extension" minOccurs="0" maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        This element may contain any framework-specific global
                        configuration.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="connectorPath" type="xsd:string" minOccurs="0"
                         maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        The path to the connector artifacts such as JAR files or
                        directories containing the connector
                        code. The specific meaning may vary slightly for each connector
                        framework. The connector framework may also
                        provide a default path in case nothing is specified here (or
                        addition to what is specified here).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ProjectionPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="assignmentPolicyEnforcement" type="tns:AssignmentPolicyEnforcementType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Full enforcement is the default setting.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="legalize" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>   
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="AssignmentPolicyEnforcementType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        No enforcement. Assignments will be ignored.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="positive">
                <xsd:annotation>
                    <xsd:documentation>
                        Assignements will be enforced only in a positive manner.
                        E.i. If a non-existing account is assigned it will be created.
                        If existing account is not assigned it will NOT be removed.
                        
                        This is the default policy of no other policy is set.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POSITIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="full">
                <xsd:annotation>
                    <xsd:documentation>
                        Full enforcement
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FULL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="relative">
                <xsd:annotation>
                    <xsd:documentation>
                        Relative enforcement
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RELATIVE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ModelHooksType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="change" type="tns:HookListType" minOccurs="0"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="HookListType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="hook" type="tns:HookType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="HookType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
        	<xsd:element name="name" type="xsd:string" minOccurs="0">
        		<xsd:annotation>
        			<xsd:documentation>
        				Free-form hook name. Used for diagnostic purposed (e.g. in logfiles)
        			</xsd:documentation>
        		</xsd:annotation>
        	</xsd:element>
        	<xsd:element name="description" type="xsd:string" minOccurs="0"/>
        	<xsd:element name="enabled" type="xsd:boolean" minOccurs="0" default="true"/>
            <xsd:element name="state" type="tns:ModelStateType" minOccurs="0"/>
            <xsd:element name="focusType" type="xsd:QName" minOccurs="0"/>
            <xsd:element name="ref" type="xsd:anyURI" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			URL of hook handler.
            			Exactly one of "ref" or "script" has to be specified.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
            <xsd:element name="script" type="tns:ScriptExpressionEvaluatorType" minOccurs="0">
            	<xsd:annotation>
            		<xsd:documentation>
            			Script that will be executed instead of hook handler.
            			Exactly one of "ref" or "script" has to be specified.
            		</xsd:documentation>
            	</xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="LoggingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of logging levels, categories, log
                files, etc.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="subSystemLogger" type="tns:SubSystemLoggerConfigurationType" minOccurs="0"
                         maxOccurs="unbounded"/>
            <xsd:element name="classLogger" type="tns:ClassLoggerConfigurationType" minOccurs="0"
                         maxOccurs="unbounded"/>
            <xsd:element name="appender" type="tns:AppenderConfigurationType" minOccurs="0" maxOccurs="unbounded"/>
            <xsd:element name="rootLoggerAppender" type="xsd:string"/>
            <xsd:element name="rootLoggerLevel" type="tns:LoggingLevelType"/>
            <xsd:element name="auditing" type="tns:AuditingConfigurationType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Persistent auditing configuration. It is placed in "logging" for practical reasons as the only
                        available auditing option is to use logging.
                        THIS WILL CHANGE IN THE FUTURE.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="advanced" type="tns:AdvancedLoggingConfigurationType" minOccurs="0" maxOccurs="1"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AuditingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Auditing configuration
                UNSTABLE. THIS WILL CHANGE IN THE FUTURE.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="enabled" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="true"/>
            <xsd:element name="details" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
            <xsd:element name="appender" type="xsd:string" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="AdvancedLoggingConfigurationType" mixed="true">
        <xsd:annotation>
            <xsd:documentation>
                Contains free form loging configuration.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="ClassLoggerConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the logger: the facility that
                collects log messages from the code.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="level" type="tns:LoggingLevelType">
                <xsd:annotation>
                    <xsd:documentation>
                        Logger level
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="package" type="xsd:string" minOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO: packages are OR-ed
                        TODO: string, wildcards
                        allowed (* as in java)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="appender" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Appender name defined in appenders section in
                        logging configuration
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SubSystemLoggerConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the logger: the facility that
                collects log messages from subsystem code.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="level" type="tns:LoggingLevelType">
                <xsd:annotation>
                    <xsd:documentation>
                        Logger level
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="component" type="c:LoggingComponentType" minOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO: components are OR-ed
                        TODO: string, but there should be a way how to determine
                        list of valid categories. Maybe switch to enum later.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="appender" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Appender name defined in appenders section in
                        logging configuration
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>


    <xsd:simpleType name="LoggingLevelType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="ALL">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="OFF">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="OFF"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ERROR">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ERROR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="WARN">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WARN"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="INFO">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INFO"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="DEBUG">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DEBUG"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="TRACE">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TRACE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ALL">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="LoggingComponentType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="ALL">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="MODEL">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODEL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="PROVISIONING">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PROVISIONING"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="REPOSITORY">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="REPOSITORY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="WEB">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GUI"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="TASKMANAGER">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASKMANAGER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="RESOURCEOBJECTCHANGELISTENER">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCEOBJECTCHANGELISTENER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="WORKFLOWS">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WORKFLOWS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="NOTIFICATIONS">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NOTIFICATIONS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="AppenderConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of the logger: the facility that
                collects log messages from the code.

                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="pattern" type="xsd:string"/>
        </xsd:sequence>
        <xsd:attribute name="name" type="xsd:string"/>
    </xsd:complexType>

    <xsd:complexType name="FileAppenderConfigurationType">
        <xsd:complexContent>
            <xsd:extension base="tns:AppenderConfigurationType">
                <xsd:sequence>
                    <xsd:element name="fileName" type="xsd:string"/>
                    <xsd:element name="filePattern" type="xsd:string"/>
                    <xsd:element name="maxHistory" type="xsd:int"/>
                    <xsd:element name="maxFileSize" type="xsd:string"/>
                    <xsd:element name="append" type="xsd:boolean"/>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SecurityPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                System that contains definitions of overall security policy.
                It contains configuration of authentication mechanisms, credentials management
                (such as password resets) and so on.
                Please note that this NOT contain authorization and auditing. Authorization is
                defined in roles (see RoleType) and auditing has a separate configuration.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                	<xsd:element name="authentication" type="tns:AuthenticationPolicyType" minOccurs="0">
                	</xsd:element>
                	<xsd:element name="credentials" type="tns:CredentialsPolicyType" minOccurs="0">
                	</xsd:element>
                    <!--  TODO: radovan -->
                    
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="securityPolicy" type="tns:SecurityPolicyType"/>
    
    <xsd:complexType name="AuthenticationPolicyType">
		<xsd:annotation>
			<xsd:documentation>
				Definition of the use of authentication mechanisms. This is in fact practically
				applicable only in default security policy (the policy that is referenced from
				system configuration).
			</xsd:documentation>
			<xsd:appinfo>
				<a:container/>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:sequence>
			<!-- TODO: radovan -->
		</xsd:sequence>
	</xsd:complexType>
    
    <xsd:complexType name="CredentialsPolicyType">
		<xsd:annotation>
			<xsd:documentation>
				Credentials management policy. It specifies the management details for each supported
				credentials type. It defines parameteres such as credential lifetyme. It may define even
				a very complex schemes for some credential types. E.g. it may define a complete security
				questions.
			</xsd:documentation>
			<xsd:appinfo>
				<a:container/>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:sequence>
			<xsd:element name="password" type="tns:PasswordCredentialsPolicyType" minOccurs="0">
			</xsd:element>
			<xsd:element name="securityQuestions" type="tns:SecurityQuestionsCredentialsPolicyType" minOccurs="0">
             </xsd:element>
             <!-- More credential types may come here in the future. -->
		</xsd:sequence>
	</xsd:complexType>
	
	 <xsd:complexType name="PasswordCredentialsPolicyType">
		<xsd:annotation>
			<xsd:documentation>
				Structure that specifies policy for password management. It is in fact only a simple reference
				to a password policy.
			</xsd:documentation>
			<xsd:appinfo>
				<a:container/>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:sequence>
			<xsd:element name="passwordPolicyRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Reference to the password policy settings.
                            </xsd:documentation>
                            <xsd:appinfo>
                    			<a:objectReferenceTargetType>tns:ValuePolicyType</a:objectReferenceTargetType>
                    		</xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
		</xsd:sequence>
	</xsd:complexType>
	
	<xsd:complexType name="SecurityQuestionsCredentialsPolicyType">
		<xsd:annotation>
			<xsd:documentation>
				Structure that specifies policy for security questions. It actually contains text for the
				questions (or rather a reference to localization catalog file). But it also contains a policy
				how the questions can be used, e.g. how many questions to display to a user.
			</xsd:documentation>
			<xsd:appinfo>
				<a:container/>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:sequence>
			<!-- TODO: sabri 
				settings that apply to all questions should go here, like this:
				<xsd:element name="whatever" type="xsd:string" minOccurs="0"/>
				This is good place to specify an overall policy, e.g. "display all questions" or "randomly select 3 questions".
			 -->
			   <xsd:element name="questionNumber" type="xsd:int" minOccurs="0"  maxOccurs="1">
                <xsd:annotation>
                    <xsd:documentation>
                       Number of Questions in order to change the passwords
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
			 <xsd:element name="question" type="tns:SecurityQuestionDefinitionType" minOccurs="0" maxOccurs="unbounded">
			 	<xsd:annotation>
			 		<xsd:documentation>
			 			The set of all the security questions in this policy.
			 		</xsd:documentation>
			 	</xsd:annotation>
			 </xsd:element>
		</xsd:sequence>
	</xsd:complexType>
	
	<xsd:complexType name="SecurityQuestionDefinitionType">
		<xsd:annotation>
			<xsd:documentation>
				Definition of a single security question.
			</xsd:documentation>
			<xsd:appinfo>
				<a:container/>
			</xsd:appinfo>
		</xsd:annotation>
		<xsd:sequence>
			<xsd:element name="identifier" type="xsd:anyURI">
				<xsd:annotation>
					<xsd:documentation>
						Unique identified of a security question. This can be used in the answer to refer to this
						definition (see SecurityQuestionAnswerType).
						
						It is expected that midPoint will come with a pre-configured set of frequently used security
						questions (such as "what is your mother's maiden name?"). Therefore URI is a good mechanism for
						this identifier. URI has a natural namespacing. Which means that the identifiers of built-in
						questions will not clash with identifiers of questions configured by midPoint administrators.
					</xsd:documentation>
				</xsd:annotation>
			</xsd:element>
			<xsd:element name="enabled" type="xsd:boolean" minOccurs="0" default="true">
				<xsd:annotation>
					<xsd:documentation>
						Simple flag that could be used to disable a use of a specific question without actually
						deleting it. This may be used to select only some questions, e.g. to disable the low-security
						built-in questions such as "what is your mother's maiden name?".
						If not present at all then the question is assumed to be enabled.
					</xsd:documentation>
				</xsd:annotation>
			</xsd:element>
			<xsd:element name="questionText" type="xsd:string" maxOccurs="1">
        	    <xsd:annotation>
                    <xsd:documentation>
                        The question itself, or the localization identifier to it.
                    </xsd:documentation>
                </xsd:annotation>
        	</xsd:element>
			<!-- TODO: sabri 
				settings that apply to a specific security question should go here, like this:
				<xsd:element name="something" type="xsd:string" minOccurs="0"/>
				What comes to my mind here is a key to localization file. That definitelly should be here.
				What else?
			 -->
			 <!-- In later versions we may want to add an expression here. The expression could product an expected answer
			 to the question. This can work well for questions such as "what is your employee number?". We already store
			 employee number in each user therefore there is no need for each user to manually fill-in the expected answer.
			 We can use expression instead. Something like "$user/employeeNumber" -->
		</xsd:sequence>
	</xsd:complexType>

    <xsd:simpleType name="SystemObjectsType">
        <xsd:annotation>
            <xsd:documentation>
                OID constants for system objects
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="00000000-0000-0000-0000-000000000001">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SYSTEM_CONFIGURATION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000002">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="USER_ADMINISTRATOR"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000003">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PASSWORD_POLICY_DEFAULT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000004">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ROLE_SUPERUSER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000005">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASK_CLEANUP"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000006">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASK_VALIDITY_SCANNER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="00000000-0000-0000-0000-000000000007">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="TASK_TRIGGER_SCANNER"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:simpleType name="FailedOperationTypeType">
        <xsd:annotation>
            <xsd:documentation>
                The enum describes the operation during the account was processed.
                But the operation failed and the account was not sucessfully treated
                so the account should have the information about the type of failed operation.
                E.g. the account should be deleted, but it fails. The account needs to be
                assigned with the tombstone to be deleted later.
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="get">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="GET"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="modify">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODIFY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="MailConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Where and how to send mail notifications (or any other mail messages).
            </xsd:documentation>
            <!--<xsd:appinfo>-->
                <!--<a:container/>-->
            <!--</xsd:appinfo>-->
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="server" type="tns:MailServerConfigurationType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration of a particular mail server host. If there are more of them, they are tried
                        one after another. If there is none, mail notifications are not sent.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="defaultFrom" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        What to put into "From" field of mail messages (unless overriden by specific situation).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="debug" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Enables quite crude debugging of javamail - sending diagnostics to standard output (console).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="redirectToFile" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Instead of sending mail via SMTP, writes all messages to a file. Useful for debugging.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="MailServerConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of a particular mail server host.
            </xsd:documentation>
            <!--<xsd:appinfo>-->
                <!--<a:container/>-->
            <!--</xsd:appinfo>-->
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="host" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        Mail server host (FQDN or IP address).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="port" type="xsd:int" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Mail server port (25 by default).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="username" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        How to authenticate to the mail server.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="password" type="t:ProtectedStringType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        How to authenticate to the mail server.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="transportSecurity" type="tns:MailTransportSecurityType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        How to ensure transport-level security when sending the message.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="MailTransportSecurityType">
        <xsd:annotation>
            <xsd:documentation>
                How to ensure transport-level security when sending the message.
                SSL/STARTTLS settings are currently EXPERIMENTAL (e.g. there is no support
                for setting certificate validation-related properties; default behavior
                of javax.mail implementation is used).
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="none">
                <xsd:annotation>
                    <xsd:documentation>
                        No attempts to ensure transport security.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="NONE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="starttlsEnabled">
                <xsd:annotation>
                    <xsd:documentation>
                        Uses STARTTLS feature, if available on the server.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STARTTLS_ENABLED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="starttlsRequired">
                <xsd:annotation>
                    <xsd:documentation>
                        Uses STARTTLS feature. If it is not available on the server, the mesage sending fails.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="STARTTLS_REQUIRED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ssl">
                <xsd:annotation>
                    <xsd:documentation>
                        Employs (older) mechanism of using SSL/TLS - wraps whole SMTP connection in SSL/TLS.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SSL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="SmsConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Where and how to send SMS notifications (or any other SMS).
            </xsd:documentation>
            <!--<xsd:appinfo>-->
                <!--<a:container/>-->
            <!--</xsd:appinfo>-->
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="gateway" type="tns:SmsGatewayConfigurationType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Configuration of a particular mail server host. If there are more of them, they are tried
                        one after another. If there is none, mail notifications are not sent.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="defaultFrom" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        What to put into "From" field of SMS, if supported by the gateway.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="redirectToFile" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Instead of sending messages via SMS, writes all messages to a file. Useful for debugging.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="name" type="xsd:string" />
    </xsd:complexType>

    <xsd:complexType name="SmsGatewayConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of a particular SMS gateway.

                Currently, we only support sending via HTTP GET method.
            </xsd:documentation>
            <!--<xsd:appinfo>-->
                <!--<a:container/>-->
            <!--</xsd:appinfo>-->
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="url" type="c:ExpressionType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        How to construct URL used to send SMS.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="username" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        How to authenticate to the SMS gateway.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="password" type="t:ProtectedStringType" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        How to authenticate to the SMS gateway.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="redirectToFile" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Instead of opening HTTP connection, writes the URL to this file. Useful for debugging.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
        <xsd:attribute name="name" type="xsd:string" />
    </xsd:complexType>

    <xsd:complexType name="CleanupPoliciesType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of cleanup intervals and policies for various midPoint subsystems.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="auditRecords" type="tns:CleanupPolicyType" minOccurs="0"/>
            <xsd:element name="closedTasks" type="tns:CleanupPolicyType" minOccurs="0" />
            <xsd:element name="outputReports" type="tns:CleanupPolicyType" minOccurs="0" />
        </xsd:sequence>
    </xsd:complexType>
    
    <xsd:complexType name="CleanupPolicyType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of cleanup intervals and policies for a specific subsystem or feature.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="maxAge" type="xsd:duration" minOccurs="0"/>
        </xsd:sequence>
    </xsd:complexType>

    <!-- Things relevant to model context serialization - more precisely, those parts that are publicly visible
(i.e. their java counterparts are - or could be - contained in model-api) -->

    <xsd:simpleType name="ModelStateType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="initial">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="INITIAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="primary">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PRIMARY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="secondary">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SECONDARY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="execution">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="EXECUTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="postexecution">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="POSTEXECUTION"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="final">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FINAL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ModelExecuteOptionsType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="force" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Force the operation even if it would otherwise fail due to external failure. E.g. attempt to delete an account
                        that no longer exists on resource may fail without a FORCE option. If FORCE option is used then the operation is
                        finished even if the account does not exist (e.g. at least shadow is removed from midPoint repository).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="raw" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Avoid any smart processing of the data except for schema application. Do not synchronize the data, do not apply
                        any expressions, etc.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="noCrypt" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Avoid encryption of any cleartext data on write. Applies only to the encrypted
                        data formats (ProtectedString, ProtectedByteArray).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="reconcile" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to reconcile user while executing changes.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="executeImmediatelyAfterApproval" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to execute changes as soon as they are approved. (For the primary stage approvals, the default behavior
                        is to wait until all changes are approved/rejected and then execute the operation as a whole.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="overwrite" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to user overwrite flag. It can be used from web service, if we want to re-import some object
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="isImport" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to simulate import operation. E.g. search filters will be resolved.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="limitPropagation" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Option to limit change computation and execution only for the source resource.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="reevaluateSearchFilters" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Causes reevaluation of search filters.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="SynchronizationIntentType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        New account that should be added (and linked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that should be deleted (and unlinked)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="keep">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="KEEP"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is kept as it is (remains linked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unlink">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNLINK"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that should be unlinked (but NOT deleted).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="synchronize">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SYNCHRONIZE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that belongs to the user and needs to be synchronized.
                        This may include deleting, archiving or disabling the account.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="SynchronizationPolicyDecisionType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        New account that is going to be added (and linked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is going to be deleted (and unlinked).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="keep">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="KEEP"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is kept as it is (remains linked).
                        Note: there still may be attribute or entitlement changes.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="unlink">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="UNLINK"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        Existing account that is going to be unlinked (but NOT deleted).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="broken">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="BROKEN"/>
                    </xsd:appinfo>
                    <xsd:documentation>
                        The account is not usable. E.g. because the associated shadow does
                        not exist any more, resource does not exists any more, etc.
                        Such account link will be removed.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:complexType name="ObjectDeltaOperationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="objectDelta" type="t:ObjectDeltaType" minOccurs="0"/>
            <xsd:element name="executionResult" type="tns:OperationResultType" minOccurs="0"/>
        </xsd:sequence>
    </xsd:complexType>

    <!-- TODO profiling Configuration -->
    <xsd:complexType name="ProfilingConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                A configuration for profiling features of midPoint.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="enabled" type="xsd:boolean" minOccurs="1" maxOccurs="1"/>
            <xsd:element name="requestFilter" type="xsd:boolean" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="performanceStatistics" type="xsd:boolean" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="dumpInterval" type="xsd:int" minOccurs="0" maxOccurs="1"/>
			<!-- Subsystems start -->
			<xsd:element name="model" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
			<xsd:element name="repository" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
			<xsd:element name="provisioning" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
			<xsd:element name="ucf" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
			<xsd:element name="resourceObjectChangeListener" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
			<xsd:element name="taskManager" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
            <xsd:element name="workflow" type="xsd:boolean" minOccurs="0" maxOccurs="1" default="false"/>
			<!-- Subsystems end -->
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="profilingConfiguration" type="tns:ProfilingConfigurationType"/>
	
    <!-- notifications -->

    <xsd:complexType name="NotificationConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                A configuration for user notifications. It defines how should be notifications created in various
                situations, e.g. when an account is created or removed.
            </xsd:documentation>
            <!--<xsd:appinfo>-->
                <!--<a:container/>-->
            <!--</xsd:appinfo>-->
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="handler" type="tns:EventHandlerType" minOccurs="0" maxOccurs="unbounded"/>       <!-- implicit fork -->
            <xsd:element name="mail" type="tns:MailConfigurationType" minOccurs="0"/>
            <xsd:element name="sms" type="tns:SmsConfigurationType" minOccurs="0" maxOccurs="unbounded"/>
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="notificationConfiguration" type="tns:NotificationConfigurationType"/>

    <xsd:complexType name="EventHandlerType">
        <xsd:annotation>
            <xsd:documentation>
                An event handler. It can contain conditions (general expressions or lists of event categories, operation types,
                success/failure statuses, and so on), subhandlers (chained or forked), and various kinds of notifiers.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Symbolic name, used either as a comment or (in the future) maybe to reference the filter.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="description" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        A note about the filter, e.g. for the administrator.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="category" type="tns:EventCategoryType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Event categories supported by this handler. (Default: all)
                        Categories not listed are filtered out: not handled by this handler nor any of its successors.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="operation" type="tns:EventOperationType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Operations supported by this handler. (Default: all)
                        Operations not listed are filtered out: not handled by this handler nor any of its successors.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="status" type="tns:EventStatusType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Result statuses supported by this handler. (Default: all)
                        Statuses not listed are filtered out: not handled by this handler nor any of its successors.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="objectKind" type="tns:ShadowKindType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Resource object kinds supported by this handler. (Default: all)
                        Kinds not listed are filtered out: not handled by this handler nor any of its successors.
                        (Relevant only for account-related events.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="objectIntent" type="xsd:string" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Resource object intents supported by this handler. (Default: all)
                        Intents not listed are filtered out: not handled by this handler nor any of its successors.
                        (Relevant only for account-related events.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="focusType" type="xsd:QName" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Focus types supported by this handler. (Default: all)
                        Types not listed are filtered out: not handled by this handler nor any of its successors.
                        (Relevant only for model-generated events.)
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="expressionFilter" type="tns:ExpressionType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Expression that returns true (if the event is to be processed and passed further) or false (if it has to be thrown off).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="chained" type="tns:EventHandlerType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        A chain of handlers (usually filters and notifiers) to be evaluated, one after another.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="forked" type="tns:EventHandlerType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        A set of handlers to be evaluated without any relation among them (like a fork prongs).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="simpleUserNotifier" type="tns:SimpleUserNotifierType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="simpleFocalObjectNotifier" type="tns:SimpleFocalObjectNotifierType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="simpleResourceObjectNotifier" type="tns:SimpleResourceObjectNotifierType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="simpleWorkflowNotifier" type="tns:SimpleWorkflowNotifierType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="userPasswordNotifier" type="tns:UserPasswordNotifierType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="accountPasswordNotifier" type="tns:AccountPasswordNotifierType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        TODO
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="generalNotifier" type="tns:GeneralNotifierType" minOccurs="0" maxOccurs="unbounded">
                <xsd:annotation>
                    <xsd:documentation>
                        Here can go any notifiers (that extend GeneralNotifierType).
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:simpleType name="EventCategoryType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="resourceObjectEvent">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RESOURCE_OBJECT_EVENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="modelEvent">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODEL_EVENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="workItemEvent">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WORK_ITEM_EVENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="workflowProcessEvent">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WORKFLOW_PROCESS_EVENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="workflowEvent">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="WORKFLOW_EVENT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="EventStatusType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="success">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="SUCCESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="alsoSuccess">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ALSO_SUCCESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="failure">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="FAILURE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="onlyFailure">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ONLY_FAILURE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="inProgress">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="IN_PROGRESS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>

    <xsd:simpleType name="EventOperationType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
            <xsd:appinfo>
                <jaxb:typesafeEnumClass/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="add">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ADD"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="modify">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="MODIFY"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="delete">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DELETE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>


    <!-- notifiers -->

    <xsd:complexType name="GeneralNotifierType">
        <xsd:complexContent>
            <xsd:extension base="tns:EventHandlerType">
                <xsd:sequence>
                    <xsd:element name="recipientExpression" type="c:ExpressionType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Recipient(s) that should get the notifications. Exact form is to be determined yet,
                                but here may be mail addresses, phone numbers, etc. We need to think how to distinguish
                                these kinds of destinations.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="subjectExpression" type="c:ExpressionType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                How to construct the subject of the message that is to be sent.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="subjectPrefix" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Simpler alternative to subjectExpression: the subject itself will be constructed by the notifier,
                                but it will be prefixed by value specified here.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="bodyExpression" type="c:ExpressionType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                How to construct the body (text) of the message that is to be sent.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="watchAuxiliaryAttributes" type="xsd:boolean" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether to send a notification when only auxiliary attributes (namely: validityStatus,
                                validityChangeTimestamp, effectiveStatus, disableTimestamp, modifyChannel, modifyTimestamp,
                                modifierRef and maybe others) are modified. If set to false (default), these attributes
                                are hidden from list of modified attributes as well.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="showModifiedValues" type="xsd:boolean" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether to show modified values (or only names of changed attributes). Default: true. (NOT IMPLEMENTED YET. THE NAME MIGHT CHANGE.)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="showTechnicalInformation" type="xsd:boolean" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether to show technical information (e.g. model context or account operation details).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="transport" type="xsd:string" minOccurs="0" maxOccurs="unbounded" />
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SimpleResourceObjectNotifierType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:GeneralNotifierType">
                <xsd:sequence>
                    <xsd:element name="watchSynchronizationAttributes" type="xsd:boolean" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Whether to send a notification when only auxiliary attributes related to synchronization situation
                                (synchronizationSituationDescription, synchronizationSituation) are modified.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SimpleUserNotifierType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:SimpleFocalObjectNotifierType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SimpleFocalObjectNotifierType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:GeneralNotifierType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="SimpleWorkflowNotifierType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:GeneralNotifierType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="UserPasswordNotifierType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:GeneralNotifierType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="AccountPasswordNotifierType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:GeneralNotifierType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="DummyNotifierType">
        <xsd:annotation>
            <xsd:documentation>
                TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:GeneralNotifierType">
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:complexType name="GeneralChangeProcessorConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration for GeneralChangeProcessor (workflows).
                We use JAXB because the structure is quite complex.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="scenario" minOccurs="0" maxOccurs="unbounded" type="tns:GeneralChangeProcessorScenarioType" />
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="generalChangeProcessorConfiguration" type="tns:GeneralChangeProcessorConfigurationType" />
    <xsd:complexType name="GeneralChangeProcessorScenarioType">
        <xsd:annotation>
            <xsd:documentation>
                A scenario for GeneralChangeProcessor.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="enabled" minOccurs="0" type="xsd:boolean" default="true">
                <xsd:annotation>
                    <xsd:documentation>
                        Is this scenario enabled?
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="name" minOccurs="0" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        A human-readable name of the scenario (e.g. "Approving assignments of roles R1001-R1999 to users in XYZ organization").
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="activationCondition" minOccurs="0" type="tns:ExpressionType">
                <xsd:annotation>
                    <xsd:documentation>
                        A condition controlling whether this scenario applies, i.e. whether a defined approval process should be started.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="processName" minOccurs="1" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        A name of the approval process. When the above condition is met, this process is started. It has to evaluate the situation,
                        seek user's (or users') approval(s), modifying the situation if necessary.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="beanName" minOccurs="0" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        The name of the Spring bean used for customizations. It provides e.g. a method for externalizing process state,
                        a method for providing work item contents, and so on.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

        </xsd:sequence>
    </xsd:complexType>
    
    
    <!-- Report Types -->
    
    <xsd:simpleType name="ExportType">
        <xsd:annotation>
            <xsd:documentation>
                Report export type.
                pdf, csv, xml, xmlEmbed, html, rtf, xls, odt, ods, docx, xlsx, pptx, xhtml, jxl.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="pdf">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PDF"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="csv">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="CSV"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="xml">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="XML"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="xmlEmbed">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="XML_EMBED"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="html">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="HTML"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="rtf">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="RTF"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="xls">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="XLS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="odt">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ODT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="ods">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="ODS"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="docx">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="DOCX"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="xlsx">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="XLSX"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="pptx">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PPTX"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="xhtml">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="XHTML"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="jxl">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="JXL"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    <xsd:simpleType name="OrientationType">
        <xsd:annotation>
            <xsd:documentation>
                Report orientation.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:restriction base="xsd:string">
            <xsd:enumeration value="landscape">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="LANDSCAPE"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
            <xsd:enumeration value="portrait">
                <xsd:annotation>
                    <xsd:appinfo>
                        <jaxb:typesafeEnumMember name="PORTRAIT"/>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:enumeration>
        </xsd:restriction>
    </xsd:simpleType>
    
    
    <xsd:complexType name="ReportFieldConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Configuration of report fields.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="nameReport" type="xsd:string" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="nameHeader" type="xsd:string" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="itemPath" type="t:ItemPathType" minOccurs="0"/>
            <xsd:element name="sortOrderNumber" type="xsd:int" minOccurs="0" maxOccurs="1"/>
            <xsd:element name="sortOrder" type="q:OrderDirectionType" minOccurs="0" maxOccurs="1"/>  
            <xsd:element name="width" type="xsd:int" minOccurs="0" maxOccurs="1" />
            <xsd:element name="classType" type="xsd:QName" minOccurs="0" maxOccurs="1"/>   
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="reportFieldConfiguration" type="tns:ReportFieldConfigurationType"/>
    
    <!--<xsd:complexType name="ReportTemplateType">-->
        <!--<xsd:sequence>-->
            <!--<xsd:any namespace="##other" processContents="lax">-->
                <!--<xsd:annotation>-->
                    <!--<xsd:documentation>-->
                        <!--&lt;!&ndash; TODO description &ndash;&gt;-->
                    <!--</xsd:documentation>-->
                <!--</xsd:annotation>-->
            <!--</xsd:any>-->
        <!--</xsd:sequence>-->
    <!--</xsd:complexType>-->

    <!--<xsd:complexType name="ReportTemplateStyleType">-->
        <!--<xsd:sequence>-->
            <!--<xsd:any namespace="##other" processContents="lax">-->
                <!--<xsd:annotation>-->
                    <!--<xsd:documentation>-->
                        <!--&lt;!&ndash; TODO description &ndash;&gt;-->
                    <!--</xsd:documentation>-->
                <!--</xsd:annotation>-->
            <!--</xsd:any>-->
        <!--</xsd:sequence>-->
    <!--</xsd:complexType>-->
    
    <xsd:complexType name="DataSourceType">
        <xsd:sequence>
            <xsd:element name="providerClass" type="xsd:string"/>
            <xsd:element name="springBean" type="xsd:boolean" default="false" minOccurs="0"/>
        </xsd:sequence>
    </xsd:complexType>

    <xsd:complexType name="SubreportType">
        <xsd:sequence>
            <xsd:element name="name" type="xsd:string"/>
            <xsd:element name="reportRef" type="tns:ObjectReferenceType"/>
        </xsd:sequence>
    </xsd:complexType>
    
	<xsd:complexType name="ReportType">
	    <xsd:annotation>
            <xsd:documentation>
            	TODO
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
                    <xsd:element name="parent" type="xsd:boolean" default="true" minOccurs="0"/>
                    <xsd:element name="subreport" type="tns:SubreportType" minOccurs="0" maxOccurs="unbounded"/>
                    

                    <xsd:element name="template" type="xsd:base64Binary" minOccurs="0" maxOccurs="1" />
                    <xsd:element name="templateStyle" type="xsd:base64Binary" minOccurs="0" maxOccurs="1" />
                       
<!--                    	<xsd:element name="template" type="t:XmlAsStringType" minOccurs="0"/> -->
<!--                 	<xsd:element name="templateStyle" type="t:XmlAsStringType" minOccurs="0"/> -->
                    <xsd:element name="orientation" type="tns:OrientationType" minOccurs="0">
    				    <xsd:annotation>
                            <xsd:documentation>
                                Report page orientation.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="export" type="tns:ExportType" minOccurs="0">
    				<xsd:annotation>
                            <xsd:documentation>
                                File type which will be used during report export.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="useHibernateSession" type="xsd:boolean" default="false" minOccurs="0"/>
                    <xsd:element name="dataSource" type="tns:DataSourceType" minOccurs="0"/>
            		<xsd:element name="field" type="tns:ReportFieldConfigurationType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Columns user definition. Name, type, report field, column name.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="configuration" type="tns:ReportConfigurationType" minOccurs="0"/>
                    <xsd:element name="configurationSchema" type="tns:XmlSchemaType" minOccurs="0"/>
            	</xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="report" type="tns:ReportType"/>

    <xsd:complexType name="ReportConfigurationType">
        <xsd:annotation>
            <xsd:documentation>
                Report configuration based on report configuration schema.
                TODO

                This element belongs to ReportType and should
                not be used elsewhere. This is a top-level
                element to make the implementation (JAXB
                marshall/unmarshall) easier.
            </xsd:documentation>
            <xsd:appinfo>
                <a:container/>
            </xsd:appinfo>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:any minOccurs="0" maxOccurs="unbounded" processContents="lax">
            </xsd:any>
        </xsd:sequence>
    </xsd:complexType>

	<xsd:complexType name="ReportOutputType">
    	<xsd:annotation>
            <xsd:documentation>
            	Reports outputs.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
            		<xsd:element name="filePath" type="xsd:string"/>
            		<xsd:element name="report" type="tns:ReportType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Report which is assigned. 
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:reportRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>   
                    <xsd:element name="reportRef" type="c:ObjectReferenceType">
                        <xsd:annotation>
                            <xsd:documentation>
                                Report which is assigned.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ReportType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
        		</xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="reportOutput" type="tns:ReportOutputType"/>
	
    <xsd:complexType name="WorkItemType">
        <xsd:annotation>
            <xsd:documentation>
                WorkItemType contains information about a human task (or a notification).
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="workItemId" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Internal identifier of a work item, assigned by the underlying workflow engine
                                (currently Activiti). MidPoint WorkItem is Activiti Task. So workItemId is
                                taskId.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="processInstanceId" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Identifier of a process instance, to which this work item (activiti task) belongs.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="changeProcessor" type="xsd:string" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Class name of change processor that manages workflow process instance that contains this work item.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="assignee" type="tns:UserType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                User to which the work item is assigned. Other users do not see such a work item in their work lists.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:assigneeRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="assigneeRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                User to which the work item is assigned. Other users do not see such a work item in their work lists.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="candidateUsers" type="tns:UserType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Users to which the work item MAY BE assigned.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:candidateUsersRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="candidateUsersRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Users to which the work item MAY BE assigned.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="candidateRoles" type="tns:AbstractRoleType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Organizations/roles to users of which the work item MAY BE assigned.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:candidateRolesRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="candidateRolesRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:AbstractRoleType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="requester" type="tns:UserType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                User who requested the respective operation was carried out.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:requesterRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="requesterRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                User who requested the respective operation was carried out.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>


                    <xsd:element name="contents" type="tns:ObjectType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Work item contents - i.e. the actual work that the user has
                                to do, along with all the necessary information.
                                It is stored as PrismObject, although, actually, it is always a
                                subtype of WorkItemContents, but this structure is defined in separate XSD file.
                                TODO consider moving all wf-related structures to that file
                                in order to allow correct references among them.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:contentsRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="contentsRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ObjectType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                    <xsd:element name="trackingData" type="tns:TrackingDataType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                Various implementation-level (activiti) data useful for diagnostics.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:trackingDataRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="trackingDataRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:TrackingDataType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>

                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>

    <xsd:element name="workItem" type="tns:WorkItemType" substitutionGroup="c:object"/>

    <xsd:complexType name="TrackingDataType">
        <xsd:annotation>
            <xsd:appinfo>
                <a:object/>
            </xsd:appinfo>
            <xsd:documentation>
                Various implementation-level (activiti) data about a work item, useful for diagnostics.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="c:ObjectType">
                <xsd:sequence>
                    <xsd:element name="taskId" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Activiti task identifier</a:displayName>
                                <a:displayOrder>100</a:displayOrder>
                                <a:access>read</a:access>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="processInstanceId" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Process instance ID</a:displayName>
                                <a:displayOrder>110</a:displayOrder>
                                <a:access>read</a:access>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="executionId" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Process execution ID</a:displayName>
                                <a:displayOrder>120</a:displayOrder>
                                <a:access>read</a:access>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="taskOwner" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Task owner</a:displayName>
                                <a:displayOrder>130</a:displayOrder>
                                <a:access>read</a:access>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="taskAssignee" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Task assignee</a:displayName>
                                <a:displayOrder>140</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="taskCandidates" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Task candidates</a:displayName>
                                <a:displayOrder>150</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="processDefinitionKey" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Process definition key</a:displayName>
                                <a:displayOrder>160</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="processDefinitionId" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Process definition ID</a:displayName>
                                <a:displayOrder>170</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="shadowTaskOid" type="xsd:string">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:displayName>Related midPoint task</a:displayName>
                                <a:displayOrder>200</a:displayOrder>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="trackingData" type="tns:TrackingDataType" substitutionGroup="c:object"/>

    <xsd:complexType name="WfProcessInstanceType">
        <xsd:annotation>
            <xsd:documentation>
                Information about workflow process instance.

                Beware, the list of work items (workItems) may not be always present.
                It depends on situation, e.g. when retrieving list of process instances, we do not populate this attribute.
                When retrieving specific instance, we usually do.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:complexContent>
            <xsd:extension base="tns:ObjectType">
                <xsd:sequence>
                    <xsd:element name="processInstanceId" type="xsd:string">
                        <xsd:annotation>
                            <xsd:documentation>
                                Internal identifier of a process instance, assigned by the underlying workflow engine
                                (currently Activiti).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="startTimestamp" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Time when this process instance started.
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="endTimestamp" type="xsd:dateTime" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Time when this process instance finished (if it did).
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="finished" type="xsd:boolean" minOccurs="0">
                        <xsd:annotation>
                            <xsd:documentation>
                                Is the instance finished? (TODO consider removing this and deriving from endTimestamp...)
                            </xsd:documentation>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="state" type="tns:ObjectType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:documentation>
                                (Externalized) process instance state stored as PrismObject.
                                Actually, it is always a subtype of ProcessInstanceState,
                                but this structure is defined in separate XSD file.
                                TODO consider moving all wf-related structures to that file
                                in order to allow correct references among them.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:stateRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="stateRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="1">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:ObjectType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="workItems" type="tns:WorkItemType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:documentation>
                                Work items that are part of this process instance. This attribute may or may not be filled-in.
                            </xsd:documentation>
                            <xsd:appinfo>
                                <a:objectReference>tns:workItemsRef</a:objectReference>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                    <xsd:element name="workItemsRef" type="c:ObjectReferenceType" minOccurs="0" maxOccurs="unbounded">
                        <xsd:annotation>
                            <xsd:appinfo>
                                <a:objectReferenceTargetType>tns:WorkItemType</a:objectReferenceTargetType>
                            </xsd:appinfo>
                        </xsd:annotation>
                    </xsd:element>
                </xsd:sequence>
            </xsd:extension>
        </xsd:complexContent>
    </xsd:complexType>
    <xsd:element name="wfProcessInstance" type="tns:WfProcessInstanceType" />

    <xsd:complexType name="DecisionType">
        <xsd:annotation>
            <xsd:documentation>
                Basic information on a user decision in context of a work item.

                This structure is meant to describe the outcome of a work items in various contexts,
                although currently it is used only within the generalized item approval process.
            </xsd:documentation>
        </xsd:annotation>
        <xsd:sequence>
            <xsd:element name="approver" type="c:UserType">
                <xsd:annotation>
                    <xsd:documentation>
                        Information on a user who has made this decision.
                    </xsd:documentation>
                    <xsd:appinfo>
                        <a:objectReference>tns:approverRef</a:objectReference>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="approverRef" type="c:ObjectReferenceType">
                <xsd:annotation>
                    <xsd:appinfo>
                        <a:objectReferenceTargetType>tns:UserType</a:objectReferenceTargetType>
                    </xsd:appinfo>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="approverName" type="xsd:string">
                <xsd:annotation>
                    <xsd:documentation>
                        The name of a user who has made this decision. Used as an optimization to avoid retrieving and storing whole UserType.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>

            <xsd:element name="approved" type="xsd:boolean" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        Boolean representation of the decision, if applicable.
                        True = approved, false = rejected, null = either unknown or not applicable.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="resultAsString" type="xsd:string" minOccurs="0">
                <xsd:annotation>
                    <xsd:documentation>
                        String representation of the result. Used in cases where the result is not simple 'approved' or 'rejected'.
                    </xsd:documentation>
                </xsd:annotation>
            </xsd:element>
            <xsd:element name="comment" type="xsd:string" minOccurs="0"/>
            <xsd:element name="dateTime" type="xsd:dateTime" />
        </xsd:sequence>
    </xsd:complexType>
    <xsd:element name="decisionType" type="tns:DecisionType" />

</xsd:schema>