<?xml version="1.0" encoding="utf-8"?>
<xsl:stylesheet xmlns:xsl="http://www.w3.org/1999/XSL/Transform"
 xmlns:xalan="http://xml.apache.org/xalan"
 xmlns:stsuuser="urn:ibm:names:ITFIM:1.0:stsuuser"
 xmlns:mapping-ext="com.tivoli.am.fim.trustserver.sts.utilities.IDMappingExtUtils"
 extension-element-prefixes="mapping-ext"
 version="1.0">

  <xsl:strip-space elements="*" />
  <xsl:output method="xml" version="1.0" encoding="utf-8" indent="yes" />

  <!--
  Initially we start with a copy of the document.
 -->
  <xsl:template match="@* | node()">
    <xsl:copy>
      <xsl:apply-templates select="@* | node()" />
    </xsl:copy>
  </xsl:template>

  <!-- This template replaces the entire Principal element with one that contains just the iv user name. -->
  <xsl:template match="//stsuuser:Principal">
    <stsuuser:Principal>
      <stsuuser:Attribute name="name" type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier">
        <stsuuser:Value>
          <xsl:value-of select="stsuuser:Attribute[@name='name']"/>
        </stsuuser:Value>
      </stsuuser:Attribute>
    </stsuuser:Principal>
  </xsl:template>

  <xsl:template match="//stsuuser:AttributeList">
    <stsuuser:AttributeList>
      <!-- First the authentcation method attribute -->
      <stsuuser:Attribute name="AuthenticationMethod" type="urn:oasis:names:tc:SAML:1.0:assertion">
        <stsuuser:Value>urn:oasis:names:tc:SAML:1.0:am:password</stsuuser:Value>
      </stsuuser:Attribute>

      <!-- Generate the user roles -->
      <stsuuser:Attribute name="role" type="http://schemas.microsoft.com/ws/2008/06/identity/claims">
        <xsl:for-each select="//stsuuser:Group">
          <stsuuser:Value>
            <xsl:value-of select="@name"/>
          </stsuuser:Value>
        </xsl:for-each>
      </stsuuser:Attribute>

      <!-- Generate the email. NOTE: the @name value must match the stanza configuration in WebSEAL for aznapi-entitlement-services -->
      <stsuuser:Attribute name="email" type="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress">
        <stsuuser:Value>
          <xsl:value-of select="stsuuser:Attribute[@name='tagvalue_email']"/>
        </stsuuser:Value>
      </stsuuser:Attribute>
    </stsuuser:AttributeList>
  </xsl:template>
</xsl:stylesheet>