/*
 *  Copyright 2016 Anyware Services
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */
package org.ametys.core.user.population;

import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.lang.reflect.Array;
import java.nio.file.Files;
import java.nio.file.StandardCopyOption;
import java.sql.Connection;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.Properties;
import java.util.Set;
import java.util.regex.Pattern;
import java.util.stream.Collectors;

import javax.xml.transform.OutputKeys;
import javax.xml.transform.TransformerConfigurationException;
import javax.xml.transform.TransformerFactory;
import javax.xml.transform.TransformerFactoryConfigurationError;
import javax.xml.transform.sax.SAXTransformerFactory;
import javax.xml.transform.sax.TransformerHandler;
import javax.xml.transform.stream.StreamResult;

import org.apache.avalon.framework.activity.Disposable;
import org.apache.avalon.framework.activity.Initializable;
import org.apache.avalon.framework.component.Component;
import org.apache.avalon.framework.configuration.Configuration;
import org.apache.avalon.framework.configuration.ConfigurationException;
import org.apache.avalon.framework.configuration.DefaultConfigurationBuilder;
import org.apache.avalon.framework.service.ServiceException;
import org.apache.avalon.framework.service.ServiceManager;
import org.apache.avalon.framework.service.Serviceable;
import org.apache.cocoon.xml.AttributesImpl;
import org.apache.cocoon.xml.XMLUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.xml.serializer.OutputPropertiesFactory;
import org.xml.sax.SAXException;

import org.ametys.core.ObservationConstants;
import org.ametys.core.authentication.CredentialProvider;
import org.ametys.core.authentication.CredentialProviderFactory;
import org.ametys.core.authentication.CredentialProviderModel;
import org.ametys.core.datasource.ConnectionHelper;
import org.ametys.core.datasource.SQLDataSourceManager;
import org.ametys.core.observation.Event;
import org.ametys.core.observation.ObservationManager;
import org.ametys.core.script.SQLScriptHelper;
import org.ametys.core.ui.Callable;
import org.ametys.core.user.CurrentUserProvider;
import org.ametys.core.user.InvalidModificationException;
import org.ametys.core.user.User.UserCreationOrigin;
import org.ametys.core.user.UserIdentity;
import org.ametys.core.user.directory.ModifiableUserDirectory;
import org.ametys.core.user.directory.UserDirectory;
import org.ametys.core.user.directory.UserDirectoryFactory;
import org.ametys.core.user.directory.UserDirectoryModel;
import org.ametys.core.util.I18nUtils;
import org.ametys.core.util.ReadXMLDataHelper;
import org.ametys.plugins.core.authentication.MultifactorAuthenticationManager;
import org.ametys.plugins.core.impl.user.directory.JdbcUserDirectory;
import org.ametys.plugins.core.impl.user.directory.JdbcUserDirectory.StrongPasswordRequirements;
import org.ametys.plugins.core.impl.user.directory.StaticUserDirectory;
import org.ametys.runtime.i18n.I18nizableText;
import org.ametys.runtime.model.DefinitionContext;
import org.ametys.runtime.model.ElementDefinition;
import org.ametys.runtime.model.checker.ItemCheckerDescriptor;
import org.ametys.runtime.model.type.ElementType;
import org.ametys.runtime.model.type.ModelItemTypeConstants;
import org.ametys.runtime.model.type.xml.XMLElementType;
import org.ametys.runtime.plugin.PluginsManager;
import org.ametys.runtime.plugin.PluginsManager.Status;
import org.ametys.runtime.plugin.component.AbstractLogEnabled;
import org.ametys.runtime.util.AmetysHomeHelper;

/**
 * DAO for accessing {@link UserPopulation}
 */
public class UserPopulationDAO extends AbstractLogEnabled implements Component, Serviceable, Initializable, Disposable
{
    /** Avalon Role */
    public static final String ROLE = UserPopulationDAO.class.getName();
    
    /** The id of the "admin" population */
    public static final String ADMIN_POPULATION_ID = "admin_population";
    
    /** The id of the "user system" login */
    public static final String SYSTEM_USER_LOGIN = "system-user";
    /** The id of the "user system" population */
    public static final UserIdentity SYSTEM_USER_IDENTITY = new UserIdentity(SYSTEM_USER_LOGIN, ADMIN_POPULATION_ID);
    
    /** The sql table for admin users */
    private static final String __ADMIN_TABLENAME = "AdminUsers";

    /** The path of the XML file containing the user populations */
    private static File __USER_POPULATIONS_FILE;
    
    /** The regular expression for an id of a user population */
    private static final String __ID_REGEX = "^[a-z][a-z0-9_-]*";
    
    /** The date (as a long) of the last time the {@link #__USER_POPULATIONS_FILE Populations file} was read (last update) */
    private long _lastFileReading;
    
    /** The whole user populations of the application */
    private Map<String, UserPopulation> _userPopulations;
    /** The misconfigured user populations */
    private Set<String> _misconfiguredUserPopulations;
    
    /** The list of population ids which are declared in the user population file but were not instanciated since their configuration led to an error */
    private Set<String> _ignoredPopulations;
    
    /** The population admin */
    private UserPopulation _adminUserPopulation;
    
    /** The user directories factory  */
    private UserDirectoryFactory _userDirectoryFactory;

    /** The credential providers factory  */
    private CredentialProviderFactory _credentialProviderFactory;
    
    /** The extension point for population consumers */
    private PopulationConsumerExtensionPoint _populationConsumerEP;

    private ObservationManager _observationManager;

    private CurrentUserProvider _currentUserProvider;

    private I18nUtils _i18nutils;
    
    private MultifactorAuthenticationManager _multifactorAuthenticationManager;

    private ReadXMLDataHelper _readXMLDataHelper;
    
    private ServiceManager _manager;

    @Override
    public void initialize()
    {
        __USER_POPULATIONS_FILE = new File(AmetysHomeHelper.getAmetysHome(), "config" + File.separator + "user-populations.xml");
        _userPopulations = new LinkedHashMap<>();
        _misconfiguredUserPopulations = new HashSet<>();
        _ignoredPopulations = new HashSet<>();
        _lastFileReading = 0;
    }
    
    private PopulationConsumerExtensionPoint _getPopulationConsumerExtensionPoint()
    {
        if (_populationConsumerEP == null)
        {
            try
            {
                _populationConsumerEP = (PopulationConsumerExtensionPoint) _manager.lookup(PopulationConsumerExtensionPoint.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException("Failed to retrieve PopulationConsumerExtensionPoint", e);
            }
        }
        return _populationConsumerEP;
    }
    
    private ObservationManager _getObservationManager()
    {
        if (_observationManager == null)
        {
            try
            {
                _observationManager = (ObservationManager) _manager.lookup(ObservationManager.ROLE);
            }
            catch (ServiceException e)
            {
                // Not a safe component... ignore it
                return null;
            }
        }
        return _observationManager;
    }
    
    private UserDirectoryFactory _getUserDirectoryFactory()
    {
        if (_userDirectoryFactory == null)
        {
            try
            {
                _userDirectoryFactory = (UserDirectoryFactory) _manager.lookup(UserDirectoryFactory.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException("Failed to retrieve UserDirectoryFactory", e);
            }
        }
        return _userDirectoryFactory;
    }
    
    private CredentialProviderFactory _getCredentialProviderFactory()
    {
        if (_credentialProviderFactory == null)
        {
            try
            {
                _credentialProviderFactory = (CredentialProviderFactory) _manager.lookup(CredentialProviderFactory.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException("Failed to retrieve CredentialProviderFactory", e);
            }
        }
        return _credentialProviderFactory;
    }
    
    private CurrentUserProvider _getCurrentUserProvider()
    {
        if (_currentUserProvider == null)
        {
            try
            {
                _currentUserProvider = (CurrentUserProvider) _manager.lookup(CurrentUserProvider.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException("Failed to retrieve CurrentUserProvider", e);
            }
        }
        return _currentUserProvider;
    }
    
    private I18nUtils _getI18nUtils()
    {
        if (_i18nutils == null)
        {
            try
            {
                _i18nutils = (I18nUtils) _manager.lookup(I18nUtils.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException("Failed to retrieve I18nUtils", e);
            }
        }
        return _i18nutils;
    }
    
    private MultifactorAuthenticationManager _getMultifactorAuthenticationManager()
    {
        if (_multifactorAuthenticationManager == null)
        {
            try
            {
                _multifactorAuthenticationManager = (MultifactorAuthenticationManager) _manager.lookup(MultifactorAuthenticationManager.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException("Failed to retrieve multifactor authentication manager", e);
            }
        }
        return _multifactorAuthenticationManager;
    }
    
    private ReadXMLDataHelper _getReadXMLDataHelper()
    {
        if (_readXMLDataHelper == null)
        {
            try
            {
                _readXMLDataHelper = (ReadXMLDataHelper) _manager.lookup(ReadXMLDataHelper.ROLE);
            }
            catch (ServiceException e)
            {
                throw new RuntimeException("Failed to retrieve read XML data helper", e);
            }
        }
        return _readXMLDataHelper;
    }
    
    @Override
    public void service(ServiceManager manager) throws ServiceException
    {
        _manager =  manager;
    }
    
    /**
     * Gets all the populations to JSON format
     * @param withAdmin True to include the "admin" population
     * @return A list of object representing the {@link UserPopulation}s
     */
    public List<Object> getUserPopulationsAsJson(boolean withAdmin)
    {
        return getUserPopulations(withAdmin).stream().map(this::getUserPopulationAsJson).collect(Collectors.toList());
    }
    
    /**
     * Gets a population to JSON format
     * @param userPopulation The user population to get
     * @return An object representing a {@link UserPopulation}
     */
    public Map<String, Object> getUserPopulationAsJson(UserPopulation userPopulation)
    {
        Map<String, Object> result = new LinkedHashMap<>();
        result.put("id", userPopulation.getId());
        result.put("label", userPopulation.getLabel());
        result.put("enabled", userPopulation.isEnabled());
        result.put("valid", isValid(userPopulation.getId()));
        result.put("isInUse", _getPopulationConsumerExtensionPoint().isInUse(userPopulation.getId()));
        
        List<Object> userDirectories = new ArrayList<>();
        for (UserDirectory ud : userPopulation.getUserDirectories())
        {
            String udModelId = ud.getUserDirectoryModelId();
            UserDirectoryModel udModel = _getUserDirectoryFactory().getExtension(udModelId);
            
            Map<String, Object> directory = new HashMap<>();
            directory.put("id", ud.getId());
            
            if (StringUtils.isNotBlank(ud.getLabel()))
            {
                directory.put("label", _getI18nUtils().translate(udModel.getLabel()) + " (" + ud.getLabel() + ")");
            }
            else
            {
                directory.put("label", udModel.getLabel());
            }
            directory.put("modifiable", ud instanceof ModifiableUserDirectory);
            userDirectories.add(directory);
        }
        result.put("userDirectories", userDirectories);
        
        List<Object> credentialProviders = new ArrayList<>();
        for (CredentialProvider cp : userPopulation.getCredentialProviders())
        {
            String cpModelId = cp.getCredentialProviderModelId();
            CredentialProviderModel cpModel = _getCredentialProviderFactory().getExtension(cpModelId);
            
            Map<String, Object> credentialProvider = new HashMap<>();
            credentialProvider.put("id", cp.getId());
            
            if (StringUtils.isNotBlank(cp.getLabel()))
            {
                credentialProvider.put("label", _getI18nUtils().translate(cpModel.getLabel()) + " (" + cp.getLabel() + ")");
            }
            else
            {
                credentialProvider.put("label", cpModel.getLabel());
            }
            credentialProviders.add(credentialProvider);
        }
        result.put("credentialProviders", credentialProviders);
        
        return result;
    }
    
    /**
     * Gets all the populations of this application
     * @param includeAdminPopulation True to include the "admin" population
     * @return A list of {@link UserPopulation}
     */
    public List<UserPopulation> getUserPopulations(boolean includeAdminPopulation)
    {
        List<UserPopulation> result = new ArrayList<>();
        if (includeAdminPopulation)
        {
            result.add(getAdminPopulation());
        }
        
        // Don't read in safe mode, we know that only the admin population is needed in this case and we want to prevent some warnings in the logs for non-safe features not found
        if (Status.OK.equals(PluginsManager.getInstance().getStatus()))
        {
            _readPopulations(false);
            result.addAll(_userPopulations.values());
        }
        
        return result;
    }
    
    /**
     * Gets all the enabled populations of this application
     * @param withAdmin True to include the "admin" population
     * @return A list of enabled {@link UserPopulation}
     */
    public List<UserPopulation> getEnabledUserPopulations(boolean withAdmin)
    {
        return getUserPopulations(withAdmin).stream().filter(UserPopulation::isEnabled).collect(Collectors.toList());
    }
    
    /**
     * Gets a population with its id.
     * @param id The id of the population
     * @return The {@link UserPopulation}, or null if not found
     */
    public UserPopulation getUserPopulation(String id)
    {
        if (ADMIN_POPULATION_ID.equals(id))
        {
            return getAdminPopulation();
        }
        
        _readPopulations(false);
        return _userPopulations.get(id);
    }
    
    /**
     * Gets the list of the ids of all the population of the application
     * @return The list of the ids of all the populations
     */
    @Callable
    public List<String> getUserPopulationsIds()
    {
        _readPopulations(false);
        return new ArrayList<>(_userPopulations.keySet());
    }
    
    /**
     * Returns the id of population which have a fatal invalid configuration.
     * These populations can NOT be used by application.
     * @return The ignored populations
     */
    public Set<String> getIgnoredPopulations()
    {
        _readPopulations(false);
        return _ignoredPopulations;
    }
    
    /**
     * Returns the id of population which have at least one user directory or one credential provider misconfigured
     * These populations can be used by application.
     * @return The misconfigured populations.
     */
    public Set<String> getMisconfiguredPopulations()
    {
        _readPopulations(false);
        return _misconfiguredUserPopulations;
    }
    
    /**
     * Return the configuration file.
     * @return the configuration file.
     */
    public File getConfigurationFile()
    {
        return __USER_POPULATIONS_FILE;
    }
    
    /**
     * Gets the configuration for creating/editing a user population.
     * @return A map containing information about what is needed to create/edit a user population
     * @throws Exception If an error occurs.
     */
    @Callable
    public Map<String, Object> getEditionConfiguration() throws Exception
    {
        Map<String, Object> result = new LinkedHashMap<>();
        DefinitionContext context = DefinitionContext.newInstance().withEdition(true);
        
        List<Object> userDirectoryModels = new ArrayList<>();
        for (String extensionId : _getUserDirectoryFactory().getExtensionsIds())
        {
            UserDirectoryModel udModel = _getUserDirectoryFactory().getExtension(extensionId);
            if (udModel == null)
            {
                throw new IllegalStateException("The user population configuration refers to an unexisting extension for the user directory '" + extensionId + "'");
            }
            
            Map<String, Object> udMap = new LinkedHashMap<>();
            udMap.put("id", extensionId);
            udMap.put("label", udModel.getLabel());
            udMap.put("description", udModel.getDescription());
            
            Map<String, Object> params = new LinkedHashMap<>();
            for (String paramId : udModel.getParameters().keySet())
            {
                // prefix in case of two parameters from two different models have the same id which can lead to some errorsin client-side
                params.put(extensionId + "$" + paramId, udModel.getParameters().get(paramId).toJSON(context));
            }
            udMap.put("parameters", params);
            
            Map<String, Object> paramCheckers = new LinkedHashMap<>();
            for (String paramCheckerId : udModel.getParameterCheckers().keySet())
            {
                ItemCheckerDescriptor paramChecker = udModel.getParameterCheckers().get(paramCheckerId);
                paramCheckers.put(extensionId + "$" + paramCheckerId, paramChecker.toJSON());
            }
            udMap.put("parameterCheckers", paramCheckers);
            
            userDirectoryModels.add(udMap);
        }
        result.put("userDirectoryModels", userDirectoryModels);
        
        List<Object> credentialProviderModels = new ArrayList<>();
        for (String extensionId : _getCredentialProviderFactory().getExtensionsIds())
        {
            CredentialProviderModel cpModel = _getCredentialProviderFactory().getExtension(extensionId);
            if (cpModel == null)
            {
                throw new IllegalStateException("The user population configuration refers to an unexisting extension for the credential provider '" + extensionId + "'");
            }

            Map<String, Object> cpMap = new LinkedHashMap<>();
            cpMap.put("id", extensionId);
            cpMap.put("label", cpModel.getLabel());
            cpMap.put("description", cpModel.getDescription());
            
            Map<String, Object> params = new LinkedHashMap<>();
            for (String paramId : cpModel.getParameters().keySet())
            {
                // prefix in case of two parameters from two different models have the same id which can lead to some errors in client-side
                params.put(extensionId + "$" + paramId, cpModel.getParameters().get(paramId).toJSON(context));
            }
            cpMap.put("parameters", params);
            
            Map<String, Object> paramCheckers = new LinkedHashMap<>();
            for (String paramCheckerId : cpModel.getParameterCheckers().keySet())
            {
                ItemCheckerDescriptor paramChecker = cpModel.getParameterCheckers().get(paramCheckerId);
                paramCheckers.put(extensionId + "$" + paramCheckerId, paramChecker.toJSON());
            }
            cpMap.put("parameterCheckers", paramCheckers);
            
            credentialProviderModels.add(cpMap);
        }
        result.put("credentialProviderModels", credentialProviderModels);
        
        return result;
    }
    
    /**
     * Gets the values of the parameters of the given population
     * @param id The id of the population
     * @return The values of the parameters
     */
    @Callable
    public Map<String, Object> getPopulationParameterValues(String id)
    {
        Map<String, Object> result = new LinkedHashMap<>();
        
        _readPopulations(false);
        UserPopulation up = _userPopulations.get(id);
        
        if (up == null)
        {
            getLogger().error("The UserPopulation of id '{}' does not exists.", id);
            result.put("error", "unknown");
            return result;
        }
        
        // Population Label
        result.put("label", up.getLabel());
        result.put("id", up.getId());
        
        // User Directories
        List<Map<String, Object>> userDirectories = new ArrayList<>();
        
        for (UserDirectory ud : up.getUserDirectories())
        {
            Map<String, Object> ud2json = new HashMap<>();
            String udModelId = ud.getUserDirectoryModelId();
            UserDirectoryModel model = _getUserDirectoryFactory().getExtension(udModelId);
            if (model == null)
            {
                throw new IllegalStateException("The user population configuration refers to an unexisting extension for the user directory '" + udModelId + "'");
            }

            ud2json.put("id", ud.getId());
            ud2json.put("udModelId", udModelId);
            ud2json.put("label", ud.getLabel());
            Map<String, Object> params = new HashMap<>();
            for (String key : ud.getParameterValues().keySet())
            {
                ElementDefinition parameter = model.getParameters().get(key);
                params.put(udModelId + "$" + key, ModelItemTypeConstants.PASSWORD_ELEMENT_TYPE_ID.equals(parameter.getType().getId()) ? "PASSWORD" : ud.getParameterValues().get(key));
            }
            ud2json.put("params", params);
            userDirectories.add(ud2json);
        }
        result.put("userDirectories", userDirectories);
        
        // Credential Providers
        List<Map<String, Object>> credentialProviders = new ArrayList<>();
        
        for (CredentialProvider cp : up.getCredentialProviders())
        {
            Map<String, Object> cp2json = new HashMap<>();
            String cpModelId = cp.getCredentialProviderModelId();
            CredentialProviderModel model = _getCredentialProviderFactory().getExtension(cpModelId);
            if (model == null)
            {
                throw new IllegalStateException("The user population configuration refers to an unexisting extension for the credential provider '" + cpModelId + "'");
            }

            cp2json.put("id", cp.getId());
            cp2json.put("cpModelId", cpModelId);
            cp2json.put("label", cp.getLabel());
            Map<String, Object> params = new HashMap<>();
            for (String key : cp.getParameterValues().keySet())
            {
                ElementDefinition parameter = model.getParameters().get(key);
                params.put(cpModelId + "$" + key, ModelItemTypeConstants.PASSWORD_ELEMENT_TYPE_ID.equals(parameter.getType().getId()) ? "PASSWORD" : cp.getParameterValues().get(key));
            }
            cp2json.put("params", params);
            credentialProviders.add(cp2json);
        }
        result.put("credentialProviders", credentialProviders);
        
        return result;
    }
    
    /**
     * Gets the "admin" population
     * @return The "admin" population
     */
    public synchronized UserPopulation getAdminPopulation()
    {
        if (_adminUserPopulation != null)
        {
            return _adminUserPopulation;
        }
        
        _adminUserPopulation = new UserPopulation();
        _adminUserPopulation.setId(ADMIN_POPULATION_ID);
        
        Map<String, Object> userDirectory1 = new HashMap<>();
        userDirectory1.put("udModelId", "org.ametys.plugins.core.user.directory.Static");
        userDirectory1.put("id", "static");
        userDirectory1.put("org.ametys.plugins.core.user.directory.Static$runtime.users.static.users", SYSTEM_USER_LOGIN + ":System:User:");
        
        Map<String, Object> userDirectory2 = new HashMap<>();
        String udModelId = "org.ametys.plugins.core.user.directory.Jdbc";
        userDirectory2.put("udModelId", udModelId);
        userDirectory2.put("id", "admin-jdbc");
        
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.DATASOURCE_PARAM_NAME, SQLDataSourceManager.AMETYS_INTERNAL_DATASOURCE_ID);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USERS_TABLE_PARAM_NAME, __ADMIN_TABLENAME);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USE_STRONG_PASSWORD_PARAM_NAME, true);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USE_STRONG_PASSWORD_MIN_LENGTH_PARAM_NAME, 8);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USE_STRONG_PASSWORD_MIN_LOWERCASE_PARAM_NAME, 1);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USE_STRONG_PASSWORD_MIN_UPPERCASE_PARAM_NAME, 1);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USE_STRONG_PASSWORD_MIN_NUMBERS_PARAM_NAME, 1);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USE_STRONG_PASSWORD_MIN_SPECIALS_PARAM_NAME, 1);
        userDirectory2.put(udModelId + "$" + JdbcUserDirectory.USE_STRONG_PASSWORD_SPECIAL_CHARACTERS_PARAM_NAME, StrongPasswordRequirements.DEFAULT_SPECIAL_CHARACTERS);
        
        Map<String, Object> credentialProvider = new HashMap<>();
        String cpModelId = "org.ametys.core.authentication.FormBased";
        credentialProvider.put("cpModelId", cpModelId);
        credentialProvider.put(cpModelId + "$" + "runtime.authentication.form.cookies", "false");
        credentialProvider.put(cpModelId + "$" + "runtime.authentication.form.store-password-in-session", "false");
        credentialProvider.put(cpModelId + "$" + "runtime.authentication.form.captcha", "true");
        credentialProvider.put(cpModelId + "$" + "runtime.authentication.form.login-by-email", "false");
        credentialProvider.put(cpModelId + "$" + "runtime.authentication.form.security.storage", SQLDataSourceManager.AMETYS_INTERNAL_DATASOURCE_ID);
        credentialProvider.put(cpModelId + "$" + "runtime.authentication.form.multifactor", "true");

        // We may need to create the admin user
        boolean wasExisting = false;
        try (Connection connection = ConnectionHelper.getInternalSQLDataSourceConnection())
        {
            wasExisting = SQLScriptHelper.tableExists(connection, __ADMIN_TABLENAME);
        }
        catch (Exception e)
        {
            throw new RuntimeException("Cannot test if " + __ADMIN_TABLENAME + " table exists in internal database", e);
        }
        
        List<UserDirectory> userDirectories = _getUserDirectories(ADMIN_POPULATION_ID, List.of(userDirectory1, userDirectory2));
        List<CredentialProvider> credentialProviders = _getCredentialProviders(List.of(credentialProvider));
        
        _updateUserPopulation(_adminUserPopulation, new I18nizableText("plugin.core", "PLUGINS_CORE_USER_POPULATION_ADMIN_LABEL"), userDirectories, credentialProviders);
        
        ((StaticUserDirectory) _adminUserPopulation.getUserDirectory("static")).setGrantAllCredentials(false);
        
        if (!wasExisting)
        {
            Map<String, String> adminUserInformations = new HashMap<>();
            adminUserInformations.put("login", "admin");
            adminUserInformations.put("password", "admin");
            adminUserInformations.put("firstname", "User");
            adminUserInformations.put("lastname", "Administrator");
            adminUserInformations.put("email", "");
            
            JdbcUserDirectory adminUserDirectory = (JdbcUserDirectory) _adminUserPopulation.getUserDirectories().get(1);
            try
            {
                adminUserDirectory.forceStrongPassword(false);
                adminUserDirectory.add(adminUserInformations, UserCreationOrigin.ADMIN);
                adminUserDirectory.forceStrongPassword(true);
            }
            catch (InvalidModificationException e)
            {
                throw new RuntimeException("Cannot create the 'admin' user", e);
            }
        }
        
        return _adminUserPopulation;
    }
    
    /**
     * Adds a new population
     * @param id The unique id of the population
     * @param label The label of the population
     * @param userDirectoriesParameters A list of user directory parameters
     * @param credentialProvidersParameters A list of credential provider parameters
     * @return A map containing the id of the created population, or the kind of error that occured
     */
    @Callable
    public Map<String, Object> add(String id, String label, List<Map<String, Object>> userDirectoriesParameters, List<Map<String, Object>> credentialProvidersParameters)
    {
        _readPopulations(false);
        
        Map<String, Object> result = new LinkedHashMap<>();
        
        if (!_isCorrectId(id))
        {
            return null;
        }
        
        UserPopulation userPopulation = new UserPopulation();
        userPopulation.setId(id);
        
        List<UserDirectory> userDirectories = _getUserDirectories(id, userDirectoriesParameters);
        List<CredentialProvider> credentialProviders = _getCredentialProviders(credentialProvidersParameters);
        
        _updateUserPopulation(userPopulation, new I18nizableText(label), userDirectories, credentialProviders);
        
        _userPopulations.put(id, userPopulation);
        if (_writePopulations())
        {
            getLogger().error("An error occured when writing the configuration file which contains the user populations.", id);
            result.put("error", "server");
            return result;
        }
        
        if (_getObservationManager() != null)
        {
            Map<String, Object> eventParams = new HashMap<>();
            eventParams.put(ObservationConstants.ARGS_USERPOPULATION_ID, id);
            _getObservationManager().notify(new Event(ObservationConstants.EVENT_USERPOPULATION_ADDED, _getCurrentUserProvider().getUser(), eventParams));
        }
        
        result.put("id", id);
        return result;
    }
    
    private boolean _isCorrectId(String id)
    {
        if (_userPopulations.get(id) != null || ADMIN_POPULATION_ID.equals(id))
        {
            getLogger().error("The id '{}' is already used for a population.", id);
            return false;
        }
        
        if (!Pattern.matches(__ID_REGEX, id))
        {
            getLogger().error("The id '{}' is not a correct id for a user population.", id);
            return false;
        }
        
        return true;
    }
    
    /**
     * Edits the given population.
     * @param id The id of the population to edit
     * @param label The label of the population
     * @param userDirectoriesParameters A list of user directory parameters
     * @param credentialProvidersParameters A list of credential provider parameters
     * @return A map containing the id of the edited population, or the kind of error that occured
     */
    @Callable
    public Map<String, Object> edit(String id, String label, List<Map<String, Object>> userDirectoriesParameters, List<Map<String, Object>> credentialProvidersParameters)
    {
        _readPopulations(false);
        
        Map<String, Object> result = new LinkedHashMap<>();
        
        UserPopulation userPopulation = _userPopulations.get(id);
        if (userPopulation == null)
        {
            getLogger().error("The UserPopulation with id '{}' does not exist, it cannot be edited.", id);
            result.put("error", "unknown");
            return result;
        }
        
        // User directories
        Map<String, Map<String, Object>> existingUserDirectoriesParameters = userPopulation.getUserDirectories().stream()
                                                                               .collect(Collectors.toMap(UserDirectory::getId, UserDirectory::getParameterValues));
        Map<String, String> userDirectoriesModels = userPopulation.getUserDirectories().stream().collect(Collectors.toMap(UserDirectory::getId, UserDirectory::getUserDirectoryModelId));
        List<UserDirectory> userDirectories = _getUserDirectories(id, userDirectoriesParameters, existingUserDirectoriesParameters, userDirectoriesModels);

        // Credential providers
        Map<String, Map<String, Object>> existingCredentialProvidersParameters = userPopulation.getCredentialProviders().stream()
                                                                                   .collect(Collectors.toMap(CredentialProvider::getId, CredentialProvider::getParameterValues));
        Map<String, String> credentialProvidersModels = userPopulation.getCredentialProviders().stream().collect(Collectors.toMap(CredentialProvider::getId, CredentialProvider::getCredentialProviderModelId));
        List<CredentialProvider> credentialProviders = _getCredentialProviders(credentialProvidersParameters, existingCredentialProvidersParameters, credentialProvidersModels);
        
        userPopulation.dispose();
        _updateUserPopulation(userPopulation, new I18nizableText(label), userDirectories, credentialProviders);
        
        if (_writePopulations())
        {
            getLogger().error("An error occured when writing the configuration file which contains the user populations.", id);
            result.put("error", "server");
            return result;
        }
        
        if (_getObservationManager() != null)
        {
            Map<String, Object> eventParams = new HashMap<>();
            eventParams.put(ObservationConstants.ARGS_USERPOPULATION_ID, id);
            _getObservationManager().notify(new Event(ObservationConstants.EVENT_USERPOPULATION_UPDATED, _getCurrentUserProvider().getUser(), eventParams));
        }
        
        result.put("id", id);
        return result;
    }
    
    private List<UserDirectory> _getUserDirectories(String userPopulationId, List<Map<String, Object>> userDirectories)
    {
        return _getUserDirectories(userPopulationId, userDirectories, Collections.emptyMap(), Collections.emptyMap());
    }
    
    private List<UserDirectory> _getUserDirectories(String userPopulationId, List<Map<String, Object>> userDirectories, Map<String, Map<String, Object>> existingUdParameters, Map<String, String> udModels)
    {
        // Create the user directories
        List<UserDirectory> uds = new ArrayList<>();
        for (Map<String, Object> userDirectoryParameters : userDirectories)
        {
            String id = (String) userDirectoryParameters.remove("id");
            String modelId = (String) userDirectoryParameters.remove("udModelId");
            String additionnalLabel = (String) userDirectoryParameters.remove("label");
            Map<String, Object> typedParamValues = _getTypedUDParameters(userDirectoryParameters, modelId);
            
            if (StringUtils.isBlank(id))
            {
                id = org.ametys.core.util.StringUtils.generateKey();
            }
            else
            {
                _keepExistingUserDirectoryPassword(modelId, typedParamValues, existingUdParameters.getOrDefault(id, Collections.emptyMap()), udModels.get(id));
            }
            
            uds.add(_getUserDirectoryFactory().createUserDirectory(id, modelId, typedParamValues, userPopulationId, additionnalLabel));
        }
        
        return uds;
    }
    
    private List<CredentialProvider> _getCredentialProviders(List<Map<String, Object>> credentialProviders)
    {
        return _getCredentialProviders(credentialProviders, Collections.emptyMap(), Collections.emptyMap());
    }
    
    private List<CredentialProvider> _getCredentialProviders(List<Map<String, Object>> credentialProviders, Map<String, Map<String, Object>> existingCpParameters, Map<String, String> cpModels)
    {
        // Create the credential providers
        List<CredentialProvider> cps = new ArrayList<>();
        for (Map<String, Object> credentialProviderParameters : credentialProviders)
        {
            String id = (String) credentialProviderParameters.remove("id");
            String modelId = (String) credentialProviderParameters.remove("cpModelId");
            String additionnalLabel = (String) credentialProviderParameters.remove("label");
            Map<String, Object> typedParamValues = _getTypedCPParameters(credentialProviderParameters, modelId);
            
            if (StringUtils.isBlank(id))
            {
                id = org.ametys.core.util.StringUtils.generateKey();
            }
            else
            {
                _keepExistingCredentialProviderPassword(modelId, typedParamValues, existingCpParameters.getOrDefault(id, Collections.emptyMap()), cpModels.get(id));
            }
            
            CredentialProvider credentialProvider = _getCredentialProviderFactory().createCredentialProvider(id, modelId, typedParamValues, additionnalLabel);
            if (credentialProvider != null)
            {
                cps.add(credentialProvider);
            }
        }
        
        return cps;
    }
    
    private void _updateUserPopulation(UserPopulation userPopulation, I18nizableText label, List<UserDirectory> userDirectories, List<CredentialProvider> credentialProviders)
    {
        userPopulation.setLabel(label);
        userPopulation.setUserDirectories(userDirectories);
        userPopulation.setCredentialProviders(credentialProviders);
        
        _getMultifactorAuthenticationManager().initializeMFACryptoComponent(userPopulation);
    }
    
    private void _keepExistingUserDirectoryPassword(String modelId, Map<String, Object> typedParamValues, Map<String, Object> existingUdParameters, String existingModelId)
    {
        // An existing id means an existing user directory
        if (StringUtils.equals(modelId, existingModelId))
        {
            // The model did not changed, we want to keep the unmodified passwords
            UserDirectoryModel userDirectoryModel = _getUserDirectoryFactory().getExtension(modelId);
            for (Map.Entry<String, ? extends ElementDefinition> parameterEntry : userDirectoryModel.getParameters().entrySet())
            {
                ElementDefinition parameter = parameterEntry.getValue();
                // If the parameter is a password AND has no value
                if (ModelItemTypeConstants.PASSWORD_ELEMENT_TYPE_ID.equals(parameter.getType().getId()) && typedParamValues.get(parameterEntry.getKey()) == null)
                {
                    // Update the submitted data with the existing password
                    typedParamValues.put(parameterEntry.getKey(), existingUdParameters.get(parameterEntry.getKey()));
                }
            }
        }
    }

    private void _keepExistingCredentialProviderPassword(String modelId, Map<String, Object> typedParamValues, Map<String, Object> existingCpParameters, String existingModelId)
    {
        // An existing id means an existing credential provider
        if (StringUtils.equals(modelId, existingModelId))
        {
            // The model did not changed, we want to keep the unmodified passwords
            CredentialProviderModel credentialProviderModel = _getCredentialProviderFactory().getExtension(modelId);
            for (Map.Entry<String, ? extends ElementDefinition> parameterEntry : credentialProviderModel.getParameters().entrySet())
            {
                ElementDefinition parameter = parameterEntry.getValue();
                // If the parameter is a password AND has no value
                if (ModelItemTypeConstants.PASSWORD_ELEMENT_TYPE_ID.equals(parameter.getType().getId()) && typedParamValues.get(parameterEntry.getKey()) == null)
                {
                    // Update the submitted data with the existing password
                    typedParamValues.put(parameterEntry.getKey(), existingCpParameters.get(parameterEntry.getKey()));
                }
            }
        }
    }
    
    private Map<String, Object> _getTypedUDParameters(Map<String, Object> parameters, String modelId)
    {
        Map<String, Object> resultParameters = new LinkedHashMap<>();
        
        UserDirectoryModel model = _getUserDirectoryFactory().getExtension(modelId);
        if (model == null)
        {
            throw new IllegalStateException("The user population configuration refers to an unexisting extension for the user directory '" + modelId + "'");
        }

        Map<String, ? extends ElementDefinition> declaredParameters = model.getParameters();
        for (String paramNameWithPrefix : parameters.keySet())
        {
            String[] splitStr = paramNameWithPrefix.split("\\$", 2);
            String prefix = splitStr[0];
            String paramName = splitStr[1];
            if (prefix.equals(modelId) && declaredParameters.containsKey(paramName))
            {
                Object originalValue = parameters.get(paramNameWithPrefix);
                
                ElementDefinition parameter = declaredParameters.get(paramName);
                ElementType type = parameter.getType();
                
                if (parameter.isMultiple())
                {
                    @SuppressWarnings("unchecked")
                    List<Object> multipleValue = originalValue instanceof List
                            ? (List<Object>) originalValue
                            : List.of(originalValue);
                    
                    Object[] typedValues = multipleValue.stream()
                            .map(val -> type.castValue(val))
                            .toArray(s -> (Object[]) Array.newInstance(type.getManagedClass(), s));
                    
                    resultParameters.put(paramName, typedValues);
                }
                else
                {
                    Object typedValue = type.castValue(originalValue);
                    resultParameters.put(paramName, typedValue);
                }
            }
            else if (prefix.equals(modelId))
            {
                getLogger().warn("The parameter {} is not declared in extension {}. It will be ignored", paramName, modelId);
            }
        }
        
        return resultParameters;
    }
    
    private Map<String, Object> _getTypedCPParameters(Map<String, Object> parameters, String modelId)
    {
        Map<String, Object> resultParameters = new LinkedHashMap<>();
        
        CredentialProviderModel model = _getCredentialProviderFactory().getExtension(modelId);
        if (model == null)
        {
            throw new IllegalStateException("The user population configuration refers to an unexisting extension for the credential provider '" + modelId + "'");
        }
        
        Map<String, ? extends ElementDefinition> declaredParameters = model.getParameters();
        for (String paramNameWithPrefix : parameters.keySet())
        {
            String[] splitStr = paramNameWithPrefix.split("\\$", 2);
            String prefix = splitStr[0];
            String paramName = splitStr[1];
            if (prefix.equals(modelId) && declaredParameters.containsKey(paramName))
            {
                Object originalValue = parameters.get(paramNameWithPrefix);
                
                ElementDefinition parameter = declaredParameters.get(paramName);
                ElementType type = parameter.getType();
                
                if (parameter.isMultiple())
                {
                    @SuppressWarnings("unchecked")
                    List<Object> multipleValue = originalValue instanceof List
                            ? (List<Object>) originalValue
                            : List.of(originalValue);
                    
                    Object[] typedValues = multipleValue.stream()
                            .map(val -> type.castValue(val))
                            .toArray(s -> (Object[]) Array.newInstance(type.getManagedClass(), s));
                    
                    resultParameters.put(paramName, typedValues);
                }
                else
                {
                    Object typedValue = type.castValue(originalValue);
                    resultParameters.put(paramName, typedValue);
                }
            }
            else if (prefix.equals(modelId))
            {
                getLogger().warn("The parameter {} is not declared in extension {}. It will be ignored", paramName, modelId);
            }
        }
        
        return resultParameters;
    }

    /**
     * Removes the given population.
     * @param id The id of the population to remove
     * @return A map containing the id of the removed population
     */
    @Callable
    public Map<String, Object> remove(String id)
    {
        return remove(id, false);
    }
    
    /**
     * Removes the given population.
     * @param id The id of the population to remove
     * @param forceDeletion Delete the population even if it is still in use
     * @return A map containing the id of the removed population
     */
    public Map<String, Object> remove(String id, boolean forceDeletion)
    {
        Map<String, Object> result = new LinkedHashMap<>();
        
        // Check if the population is not the admin population
        if (ADMIN_POPULATION_ID.equals("id"))
        {
            return null;
        }
        
        // Check if the population is used
        if (!forceDeletion && _getPopulationConsumerExtensionPoint().isInUse(id))
        {
            getLogger().error("The UserPopulation with id '{}' is used, it cannot be removed.", id);
            result.put("error", "used");
            return result;
        }
        
        _readPopulations(false);
        
        UserPopulation up = _userPopulations.remove(id);
        
        if (up == null)
        {
            getLogger().error("The UserPopulation with id '{}' does not exist, it cannot be removed.", id);
            result.put("error", "unknown");
            return result;
        }
        
        up.dispose();
        
        if (_writePopulations())
        {
            result.put("error", "server");
            return result;
        }
        
        if (_getObservationManager() != null)
        {
            Map<String, Object> eventParams = new HashMap<>();
            eventParams.put(ObservationConstants.ARGS_USERPOPULATION_ID, id);
            _getObservationManager().notify(new Event(ObservationConstants.EVENT_USERPOPULATION_DELETED, _getCurrentUserProvider().getUser(), eventParams));
        }
        
        result.put("id", id);
        return result;
    }
    
    /**
     * Enables/Disables the given population
     * @param populationId The id of the population to enable/disable
     * @param enabled True to enable the population, false to disable it.
     * @return A map containing the id of the enabled/disabled population, or with an error.
     */
    @Callable
    public Map<String, Object> enable(String populationId, boolean enabled)
    {
        Map<String, Object> result = new LinkedHashMap<>();
        
        UserPopulation population = getUserPopulation(populationId);
        if (population != null)
        {
            population.enable(enabled);
            result.put("id", populationId);
        }
        else
        {
            getLogger().error("The UserPopulation with id '{}' does not exist, it cannot be enabled/disabled.", populationId);
            result.put("error", "unknown");
        }
        
        if (_writePopulations())
        {
            result.put("error", "server");
            return result;
        }
        
        return result;
    }
    
    /**
     * Determines if a population has a valid configuration
     * @param populationId The id of the population to retrieve state
     * @return A map, with the response as a boolean, or an error.
     */
    @Callable
    public boolean isValid(String populationId)
    {
        return !_misconfiguredUserPopulations.contains(populationId);
    }
    
    /**
     * Returns the enabled state of the given population
     * @param populationId The id of the population to retrieve state
     * @return A map, with the response as a booolean, or an error.
     */
    @Callable
    public Map<String, Object> isEnabled(String populationId)
    {
        Map<String, Object> result = new LinkedHashMap<>();
        
        UserPopulation population = getUserPopulation(populationId);
        if (population != null)
        {
            result.put("enabled", population.isEnabled());
        }
        else
        {
            result.put("error", "unknown");
        }
        
        return result;
    }
    
    /**
     * Determines if a population can be removed
     * @param populationId The id of the population
     * @return A map, with the response as a boolean, or an error.
     */
    @Callable
    public Map<String, Object> canRemove(String populationId)
    {
        Map<String, Object> result = new HashMap<>();
        
        //Can remove only if not used, event if the population is disabled
        result.put("canRemove", !_getPopulationConsumerExtensionPoint().isInUse(populationId));
        
        return result;
    }
    
    /**
     * If needed, reads the config file representing the populations and then
     * reinitializes and updates the internal representation of the populations.
     * @param forceRead True to avoid the use of the cache and force the reading of the file
     */
    private synchronized void _readPopulations(boolean forceRead)
    {
        try
        {
            if (!__USER_POPULATIONS_FILE.exists())
            {
                if (getLogger().isDebugEnabled())
                {
                    getLogger().debug("No user population file found at {}. Creating a new one.", __USER_POPULATIONS_FILE.getAbsolutePath());
                }
                _createPopulationsFile(__USER_POPULATIONS_FILE);
            }
            
            // In Linux file systems, the precision of java.io.File.lastModified() is the second, so we need here to always have
            // this (bad!) precision by doing the truncation to second precision (/1000 * 1000) on the millis time value.
            // Therefore, the boolean outdated is computed with '>=' operator, and not '>', which will lead to sometimes (but rarely) unnecessarily re-read the file.
            long fileLastModified = (__USER_POPULATIONS_FILE.lastModified() / 1000) * 1000;
            if (forceRead || fileLastModified >= _lastFileReading)
            {
                getLogger().debug("Reading user population file at {}", __USER_POPULATIONS_FILE.getAbsolutePath());
                
                long lastFileReading = Instant.now().truncatedTo(ChronoUnit.SECONDS).toEpochMilli();
                Map<String, UserPopulation> userPopulations = new LinkedHashMap<>();
                Set<String> ignoredPopulations = new HashSet<>();
                Set<String> misconfiguredUserPopulations = new HashSet<>();

                Configuration cfg = new DefaultConfigurationBuilder().buildFromFile(__USER_POPULATIONS_FILE);
                for (Configuration childCfg : cfg.getChildren("userPopulation"))
                {
                    try
                    {
                        UserPopulation up = _configurePopulation(childCfg, misconfiguredUserPopulations);
                        userPopulations.put(up.getId(), up);
                    }
                    catch (ConfigurationException e)
                    {
                        getLogger().error("Fatal configuration error for population of id '{}'. The population will be ignored.", childCfg.getAttribute("id", ""), e);
                        ignoredPopulations.add(childCfg.getAttribute("id", ""));
                    }
                }
                
                getLogger().debug("User population file read. Found {} valid population(s), {} invalid population(s) and {} misconfigured population(s)", userPopulations.size(), ignoredPopulations.size(), misconfiguredUserPopulations.size());
                
                // Release previous components
                this.dispose();
                
                _lastFileReading = lastFileReading;
                _userPopulations = userPopulations;
                _ignoredPopulations = ignoredPopulations;
                _misconfiguredUserPopulations = misconfiguredUserPopulations;
            }
            else if (getLogger().isDebugEnabled())
            {
                getLogger().debug("No need to reload the user population file. The file modified at {} was not modified since {}", fileLastModified, _lastFileReading);
            }
        }
        catch (Exception e)
        {
            getLogger().error("Failed to retrieve user populations from the configuration file " + __USER_POPULATIONS_FILE, e);
        }
    }
    
    private void _createPopulationsFile(File file) throws IOException, TransformerConfigurationException, SAXException
    {
        file.createNewFile();
        try (OutputStream os = new FileOutputStream(file))
        {
            // create a transformer for saving sax into a file
            TransformerHandler th = ((SAXTransformerFactory) TransformerFactory.newInstance()).newTransformerHandler();
            
            StreamResult result = new StreamResult(os);
            th.setResult(result);

            // create the format of result
            Properties format = new Properties();
            format.put(OutputKeys.METHOD, "xml");
            format.put(OutputKeys.INDENT, "yes");
            format.put(OutputKeys.ENCODING, "UTF-8");
            format.put(OutputPropertiesFactory.S_KEY_INDENT_AMOUNT, "4");
            th.getTransformer().setOutputProperties(format);
            th.startDocument();
            XMLUtils.createElement(th, "userPopulations");
            th.endDocument();
        }
        
        if (getLogger().isDebugEnabled())
        {
            getLogger().debug("Empty file for user populations created");
        }
    }
    
    private UserPopulation _configurePopulation(Configuration configuration, Set<String> misconfiguredUserPopulations) throws ConfigurationException
    {
        UserPopulation up = new UserPopulation();
        
        String upId = configuration.getAttribute("id");
        up.setId(upId);
        
        List<UserDirectory> userDirectories = _configureUserDirectories(configuration, upId, misconfiguredUserPopulations);
        List<CredentialProvider> credentialProviders = _configureCredentialProviders(configuration, upId);

        _updateUserPopulation(up, new I18nizableText(configuration.getChild("label").getValue()), userDirectories, credentialProviders);
        
        boolean enabled = configuration.getAttributeAsBoolean("enabled", true) && userDirectories.size() > 0 && credentialProviders.size() > 0;
        up.enable(enabled);
        
        return up;
    }
    
    private List<UserDirectory> _configureUserDirectories(Configuration configuration, String upId, Set<String> misconfiguredUserPopulations) throws ConfigurationException
    {
        List<UserDirectory> userDirectories = new ArrayList<>();
        
        Configuration[] userDirectoriesConf = configuration.getChild("userDirectories").getChildren("userDirectory");
        for (Configuration userDirectoryConf : userDirectoriesConf)
        {
            String id = userDirectoryConf.getAttribute("id");
            String modelId = userDirectoryConf.getAttribute("modelId");
            String label = userDirectoryConf.getAttribute("label", null);
            
            try
            {
                Map<String, Object> paramValues = _getUDParametersFromConfiguration(userDirectoryConf, modelId, upId);
                UserDirectory ud = _getUserDirectoryFactory().createUserDirectory(id, modelId, paramValues, upId, label);
                if (ud != null)
                {
                    userDirectories.add(ud);
                }
            }
            catch (Exception e)
            {
                getLogger().warn("The population of id '" + upId + "' declares a user directory with an invalid configuration", e);
                misconfiguredUserPopulations.add(upId);
            }
        }

        if (userDirectories.isEmpty())
        {
            misconfiguredUserPopulations.add(upId);
            getLogger().warn("The population of id '" + upId + "' does not have user directory with a valid configuration. It will be disabled until it will be fixed.");
        }
        
        return userDirectories;
    }
    
    private List<CredentialProvider> _configureCredentialProviders(Configuration configuration, String upId) throws ConfigurationException
    {
        List<CredentialProvider> credentialProviders = new ArrayList<>();
        
        Configuration[] credentialProvidersConf = configuration.getChild("credentialProviders").getChildren("credentialProvider");
        for (Configuration credentialProviderConf : credentialProvidersConf)
        {
            String id = credentialProviderConf.getAttribute("id");
            String modelId = credentialProviderConf.getAttribute("modelId");
            String additionnalLabel = credentialProviderConf.getAttribute("label", null);
            
            try
            {
                Map<String, Object> paramValues = _getCPParametersFromConfiguration(credentialProviderConf, modelId, upId);
                CredentialProvider cp = _getCredentialProviderFactory().createCredentialProvider(id, modelId, paramValues, additionnalLabel);
                if (cp != null)
                {
                    credentialProviders.add(cp);
                }
            }
            catch (Exception e)
            {
                getLogger().warn("The population of id '" + upId + "' declares a credential provider with an invalid configuration", e);
                _misconfiguredUserPopulations.add(upId);
            }
        }
        
        if (credentialProviders.isEmpty())
        {
            _misconfiguredUserPopulations.add(upId);
            getLogger().warn("The population of id '" + upId + "' does not have credential provider with a valid configuration. It will be disabled until it will be fixed.");
        }
        
        return credentialProviders;
    }
    
    /**
     * Get the typed parameters of a user directory used by a population
     * @param conf The user directory's configuration.
     * @param modelId The id of user directory model
     * @param populationId The id of population
     * @return The typed parameters
     * @throws IllegalArgumentException if the configured user directory references a non-existing user directory model
     * @throws ConfigurationException if a parameter is missing
     */
    private Map<String, Object> _getUDParametersFromConfiguration(Configuration conf, String modelId, String populationId) throws ConfigurationException, IllegalArgumentException
    {
        if (!_getUserDirectoryFactory().hasExtension(modelId))
        {
            throw new IllegalArgumentException(String.format("The population of id '%s' declares a non-existing user directory model with id '%s'. It will be ignored.", populationId, modelId));
        }
        
        Map<String, ? extends ElementDefinition> declaredParameters = _getUserDirectoryFactory().getExtension(modelId).getParameters();
        
        Map<String, List<I18nizableText>> errors = new HashMap<>();
        Map<String, Object> parameters = _getReadXMLDataHelper().readAndValidateXMLData(conf, modelId + "$", declaredParameters, errors);
        if (errors.isEmpty())
        {
            return parameters;
        }
        else
        {
            StringBuilder sb = new StringBuilder(String.format("The population of id '%s' declares a user directory model with id '%s' but some parameters are not valid:", populationId, modelId));
            for (String dataName : errors.keySet())
            {
                for (I18nizableText error : errors.get(dataName))
                {
                    sb.append("\n* '").append(dataName).append("': ").append(_getI18nUtils().translate(error));
                }
            }
            sb.append("\nThis user directory will be ignored.");
            
            throw new ConfigurationException(sb.toString(), conf);
        }
    }
    
    /**
     * Get the typed parameters of a credential provider used by a population
     * @param conf The credential provider's configuration.
     * @param modelId The id of credential provider model
     * @param populationId The id of population
     * @return The typed parameters
     * @throws IllegalArgumentException if the configured credential provider references a non-existing credential provider model
     * @throws ConfigurationException if a parameter is missing
     */
    private Map<String, Object> _getCPParametersFromConfiguration(Configuration conf, String modelId, String populationId) throws ConfigurationException, IllegalArgumentException
    {
        if (!_getCredentialProviderFactory().hasExtension(modelId))
        {
            throw new IllegalArgumentException(String.format("The population of id '%s' declares a non-existing credential provider model with id '%s'. It will be ignored.", populationId, modelId));
        }
        
        Map<String, ? extends ElementDefinition> declaredParameters = _getCredentialProviderFactory().getExtension(modelId).getParameters();
        
        Map<String, List<I18nizableText>> errors = new HashMap<>();
        Map<String, Object> parameters = _getReadXMLDataHelper().readAndValidateXMLData(conf, modelId + "$", declaredParameters, errors);
        if (errors.isEmpty())
        {
            return parameters;
        }
        else
        {
            StringBuilder sb = new StringBuilder(String.format("The population of id '%s' declares a credential provider model with id '%s' but some parameters are not valid:", populationId, modelId));
            for (String dataName : errors.keySet())
            {
                for (I18nizableText error : errors.get(dataName))
                {
                    sb.append("\n* '").append(dataName).append("': ").append(_getI18nUtils().translate(error));
                }
            }
            sb.append("\nThis credential provider will be ignored.");
            
            throw new ConfigurationException(sb.toString(), conf);
        }
    }
    
    /**
     * Erases the config file representing the populations and rebuild it 
     * from the internal representation of the populations.
     * @return True if an error occured
     */
    private boolean _writePopulations()
    {
        File backup = new File(__USER_POPULATIONS_FILE.getPath() + ".tmp");
        boolean errorOccured = false;
        
        // Create a backup file
        try
        {
            Files.copy(__USER_POPULATIONS_FILE.toPath(), backup.toPath());
        }
        catch (IOException e)
        {
            getLogger().error("Error when creating backup '" + __USER_POPULATIONS_FILE + "' file", e);
        }
        
        // Do writing
        try (OutputStream os = new FileOutputStream(__USER_POPULATIONS_FILE))
        {
            // create a transformer for saving sax into a file
            TransformerHandler th = ((SAXTransformerFactory) TransformerFactory.newInstance()).newTransformerHandler();
            
            StreamResult result = new StreamResult(os);
            th.setResult(result);

            // create the format of result
            Properties format = new Properties();
            format.put(OutputKeys.METHOD, "xml");
            format.put(OutputKeys.INDENT, "yes");
            format.put(OutputKeys.ENCODING, "UTF-8");
            format.put(OutputPropertiesFactory.S_KEY_INDENT_AMOUNT, "4");
            th.getTransformer().setOutputProperties(format);

            // sax the config
            try
            {
                _toSAX(th);
            }
            catch (Exception e)
            {
                getLogger().error("Error when saxing the userPopulations", e);
                errorOccured = true;
            }
        }
        catch (IOException | TransformerConfigurationException | TransformerFactoryConfigurationError e)
        {
            getLogger().error("Error when trying to modify the user populations with the configuration file " + __USER_POPULATIONS_FILE, e);
        }
        
        // Restore the file if an error previously occured
        try
        {
            if (errorOccured)
            {
                // An error occured, restore the original
                Files.copy(backup.toPath(), __USER_POPULATIONS_FILE.toPath(), StandardCopyOption.REPLACE_EXISTING);
                // Force to reread the file
                _readPopulations(true);
            }
            Files.deleteIfExists(backup.toPath());
        }
        catch (IOException e)
        {
            getLogger().error("Error when restoring backup '" + __USER_POPULATIONS_FILE + "' file", e);
        }
        
        return errorOccured;
    }
    
    private void _toSAX(TransformerHandler handler)
    {
        try
        {
            handler.startDocument();
            XMLUtils.startElement(handler, "userPopulations");
            for (UserPopulation up : _userPopulations.values())
            {
                _saxUserPopulation(up, handler);
            }
            
            XMLUtils.endElement(handler, "userPopulations");
            handler.endDocument();
        }
        catch (SAXException e)
        {
            getLogger().error("Error when saxing the userPopulations", e);
        }
    }
    
    private void _saxUserPopulation(UserPopulation userPopulation, TransformerHandler handler)
    {
        try
        {
            AttributesImpl atts = new AttributesImpl();
            atts.addCDATAAttribute("id", userPopulation.getId());
            atts.addCDATAAttribute("enabled", Boolean.toString(userPopulation.isEnabled()));
            XMLUtils.startElement(handler, "userPopulation", atts);
            
            userPopulation.getLabel().toSAX(handler, "label");
            
            // SAX user directories
            XMLUtils.startElement(handler, "userDirectories");
            for (UserDirectory ud : userPopulation.getUserDirectories())
            {
                AttributesImpl attr = new AttributesImpl();
                attr.addCDATAAttribute("id", ud.getId());
                attr.addCDATAAttribute("modelId", ud.getUserDirectoryModelId());
                attr.addCDATAAttribute("label", ud.getLabel() != null ? ud.getLabel() : "");
                XMLUtils.startElement(handler, "userDirectory", attr);
                
                UserDirectoryModel udModel = _getUserDirectoryFactory().getExtension(ud.getUserDirectoryModelId());
                _writeParameterValues(udModel.getParameters(), ud.getParameterValues(), handler);

                XMLUtils.endElement(handler, "userDirectory");
            }
            XMLUtils.endElement(handler, "userDirectories");
            
            // SAX credential providers
            XMLUtils.startElement(handler, "credentialProviders");
            for (CredentialProvider cp : userPopulation.getCredentialProviders())
            {
                AttributesImpl attr = new AttributesImpl();
                attr.addCDATAAttribute("id", cp.getId());
                attr.addCDATAAttribute("modelId", cp.getCredentialProviderModelId());
                attr.addCDATAAttribute("label", cp.getLabel() != null ? cp.getLabel() : "");
                XMLUtils.startElement(handler, "credentialProvider", attr);

                CredentialProviderModel cpModel = _getCredentialProviderFactory().getExtension(cp.getCredentialProviderModelId());
                _writeParameterValues(cpModel.getParameters(), cp.getParameterValues(), handler);

                XMLUtils.endElement(handler, "credentialProvider");
            }
            XMLUtils.endElement(handler, "credentialProviders");
            
            XMLUtils.endElement(handler, "userPopulation");
        }
        catch (SAXException e)
        {
            getLogger().error("Error when saxing the userPopulation " + userPopulation, e);
        }
    }
    
    private void _writeParameterValues(Map<String, ? extends ElementDefinition> definitions, Map<String, Object> paramValues, TransformerHandler handler) throws SAXException
    {
        for (String paramName : paramValues.keySet())
        {
            Object value = paramValues.get(paramName);
            ElementDefinition definition = definitions.get(paramName);
            
            Optional<XMLElementType> type = Optional.ofNullable(definition)
                    .map(ElementDefinition::getType)
                    .filter(XMLElementType.class::isInstance)
                    .map(XMLElementType.class::cast);
            
            if (type.isPresent())
            {
                type.get().write(handler, paramName, value);
            }
        }
    }
    
    @Override
    public void dispose()
    {
        for (UserPopulation up : _userPopulations.values())
        {
            up.dispose();
        }
        
        _userPopulations.clear();
        _lastFileReading = 0;
    }
}