%% -*- erlang -*-
[{rabbit, [{auth_backends, [rabbit_auth_backend_ldap]},
           {default_vhost, <<"test">>}]},
 {rabbitmq_auth_backend_ldap,
  [ {servers,            ["localhost"]},
    {user_dn_pattern,    "cn=${username},ou=People,dc=example,dc=com"},
    {other_bind,         anon},
    {use_ssl,            false},
    {port,               389},
    {log,                true},
    {tag_queries,        [{administrator, {constant, false}}]},
    {vhost_access_query, {exists, "ou=${vhost},ou=vhosts,dc=example,dc=com"}},
    {resource_access_query,
     {for, [{resource, exchange,
             {for, [{permission, configure,
                     {in_group, "cn=wheel,ou=groups,dc=example,dc=com"}
                    },
                    {permission, write, {constant, true}},
                    {permission, read,
                     {match, {string, "${name}"},
                             {string, "^xch-${username}-.*"}}
                    }
                   ]}},
            {resource, queue,
             {for, [{permission, configure,
                     {match, {attribute, "${user_dn}", "description"},
                             {string, "can-declare-queues"}}
                    },
                    {permission, write, {constant, true}},
                    {permission, read,
                     {'or',
                      [{'and',
                        [{equals, "${name}", "test1"},
                         {equals, "${username}", "Simon MacMullen"}]},
                       {'and',
                        [{equals, "${name}", "test2"},
                         {'not', {equals, "${username}", "Mike Bridgen"}}]}
                      ]}}
                   ]}}
            ]}}
  ]}
].
