#
# Create an OU to store all the clients. This is an optional OU to keep all OAuth 2.0 clients in
# the same location. If a different location is needed to store the clients, alter the LDIF.
# SearchBase in the "pingfederate/server/default/data/config-store/org.sourceid.oauth20.domain.ClientManagerLdapImpl.xml"
# file should point to this OU. eg. <c:item name="SearchBase">OU=Clients,DC=example,DC=global</c:item>
#
# <Your DC Here> should be changed to the location of your full DC. eg. DC=example,DC=global

dn: ou=Clients,<Your DC Here>
changetype: add
objectclass: top
objectclass: organizationalUnit
ou: Clients

#
# Defines the actual "pf-oauth-client" objectClass and its attribute types in which the OAuth 2.0 Client will be stored.
#
# If any changes are made to the attribute names, the corresponding "pingfederate/server/default/data/config-store/org.sourceid.oauth20.domain.ClientManagerLdapImpl.xml"
# must also be altered to reflect these changes.
#

dn: cn=schema
changetype: modify
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.12
  NAME 'pf-oauth-client-id'
  DESC 'PingFederate OAuth 2.0 Client ID'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '256' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.13
  NAME 'pf-oauth-client-name'
  DESC 'PingFederate OAuth 2.0 Client Name'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '128' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.14
  NAME 'pf-oauth-client-refresh-rolling'
  DESC 'PingFederate OAuth 2.0 Client Refresh Rolling'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.15
  NAME 'pf-oauth-client-logo-url'
  DESC 'PingFederate OAuth 2.0 Client Logo URL'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '1024' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.16
  NAME 'pf-oauth-client-hashed-secret'
  DESC 'PingFederate OAuth 2.0 Client Hash Secret'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.17
  NAME 'pf-oauth-client-description'
  DESC 'PingFederate OAuth 2.0 Client Description'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '2048' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.18
  NAME 'pf-oauth-client-persistent-grant-exp-type'
  DESC 'PingFederate OAuth 2.0 Client Persistent Grant Expiration Type'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.19
  NAME 'pf-oauth-client-persistent-grant-exp-time'
  DESC 'PingFederate OAuth 2.0 Client Persistent Grant Expiration Time'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.20
  NAME 'pf-oauth-client-persistent-grant-exp-time-unit'
  DESC 'PingFederate OAuth 2.0 Client Persistent Grant Expiration Time Unit'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '1' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.21
  NAME 'pf-oauth-client-bypass-approval-page'
  DESC 'PingFederate OAuth 2.0 Client Bypass Approval Page'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  SINGLE-VALUE
  USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.22
  NAME 'pf-oauth-client-grant-type'
  DESC 'PingFederate OAuth 2.0 Client Grant Type'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '128' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.23
  NAME 'pf-oauth-client-redirect-uri'
  DESC 'PingFederate OAuth 2.0 Client Redirect URI'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '512' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.24
  NAME 'pf-oauth-client-restrict-scopes'
  DESC 'PingFederate OAuth 2.0 Client Restrict Scopes'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  SINGLE-VALUE
  USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.25
  NAME 'pf-oauth-client-restricted-scopes'
  DESC 'PingFederate OAuth 2.0 Client Restricted Scopes'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '256' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.26
  NAME 'pf-oauth-client-logout-uri'
  DESC 'PingFederate OAuth 2.0 Client Logout URI'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '512' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.27
  NAME 'pf-oauth-client-authn-type'
  DESC 'PingFederate OAuth 2.0 Client Authentication Type'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '32' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.28
  NAME 'pf-oauth-client-client-cert-issuer-dn'
  DESC 'PingFederate OAuth 2.0 Client Certificate Issuer DN'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '1024' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.29
  NAME 'pf-oauth-client-client-cert-subject-dn'
  DESC 'PingFederate OAuth 2.0 Client Certificate Subject DN'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '1024' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.30
  NAME 'pf-oauth-client-jwks-url'
  DESC 'PingFederate OAuth 2.0 Client JWKS URL'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  SINGLE-VALUE
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '512' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.31
  NAME 'pf-oauth-client-jwks'
  DESC 'PingFederate OAuth 2.0 Client JWKS'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '8192' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.32
  NAME 'pf-oauth-client-enforce-replay-prevention'
  DESC 'PingFederate OAuth 2.0 Client Enforce Replay Prevention'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  SINGLE-VALUE
  USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.33
  NAME 'pf-oauth-client-require-signed-requests'
  DESC 'PingFederate OAuth 2.0 Client Require Signed Requests'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
  SINGLE-VALUE
  USAGE userApplications )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.34
  NAME 'pf-oauth-client-supplemental-info'
  DESC 'PingFederate OAuth 2.0 Client Supplemental Information'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
  USAGE userApplications
  X-MIN-VALUE-LENGTH '0'
  X-MAX-VALUE-LENGTH '2048' )
-
add: attributeTypes
attributeTypes: ( 1.3.6.1.4.1.28867.9.2.35
  NAME 'pf-oauth-client-last-modified'
  DESC 'PingFederate OAuth 2.0 Client Last Modified Time'
  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
  SINGLE-VALUE )
-
add: objectClasses
objectClasses: ( 1.3.6.1.4.1.28867.9.1.2
  NAME 'pf-oauth-client'
  DESC 'PingFederate OAuth 2.0 Client Information'
  SUP top
  STRUCTURAL
  MUST pf-oauth-client-id
  MAY ( pf-oauth-client-name
    $ pf-oauth-client-refresh-rolling
    $ pf-oauth-client-logo-url
    $ pf-oauth-client-hashed-secret
    $ pf-oauth-client-description
    $ pf-oauth-client-persistent-grant-exp-type
    $ pf-oauth-client-persistent-grant-exp-time
    $ pf-oauth-client-persistent-grant-exp-time-unit
    $ pf-oauth-client-bypass-approval-page
    $ pf-oauth-client-grant-type
    $ pf-oauth-client-redirect-uri
    $ pf-oauth-client-restrict-scopes
    $ pf-oauth-client-restricted-scopes
    $ pf-oauth-client-logout-uri
    $ pf-oauth-client-authn-type
    $ pf-oauth-client-client-cert-issuer-dn
    $ pf-oauth-client-client-cert-subject-dn
    $ pf-oauth-client-jwks-url
    $ pf-oauth-client-jwks
    $ pf-oauth-client-enforce-replay-prevention
    $ pf-oauth-client-require-signed-requests
    $ pf-oauth-client-supplemental-info
    $ pf-oauth-client-last-modified ) )
