<def-group>
    <definition class="compliance" id="{{{ rule_id }}}" version="1">
           {{{ oval_metadata("SSSD should be configured with trust path to an accepted trust anchor.", rule_title=rule_title) }}}
        <criteria>
            <criterion comment="check value of certificate_verification in sssd configuration"
                       test_ref="test_{{{rule_id}}}" />
        </criteria>
    </definition>

    <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="test the value of
        certificate_verification in sssd configuration" id="test_{{{rule_id}}}" version="1">
        <ind:object object_ref="obj_{{{rule_id}}}" />
        <ind:state state_ref="state_{{{rule_id}}}" />
    </ind:textfilecontent54_test>

    <ind:textfilecontent54_object id="obj_{{{rule_id}}}" version="1">
        <ind:filepath operation="pattern match">^/etc/sssd/sssd.conf$</ind:filepath>
        <ind:pattern operation="pattern match">^[\s]*\[domain\/.*](?:[^\n\[]*\n+)+?[\s]*certificate_verification\s*=\s*([\w,]+)$</ind:pattern>
        <ind:instance operation="greater than or equal" datatype="int">1</ind:instance>
    </ind:textfilecontent54_object>

    <ind:textfilecontent54_state comment="value of certificate_verification" id="state_{{{rule_id}}}" version="1">
        <ind:subexpression operation="equals">ca_cert,ocsp</ind:subexpression>
    </ind:textfilecontent54_state>
</def-group>
