Ajcody-System-Documentation-For-Rights-Included-In-ZCS-Install

Ajcody System Documentation for rights included in ZCS Install

   KB 20680        Last updated on 2016-06-21  




0.00
(0 votes)
24px ‎  - This is Zeta Alliance Certified Documentation. The content has been tested by the Community.


The following system documentation was from a ZCS 8.0.4 system.

System Documentation For Rights Included in ZCS Install

Actual System Documentation For Rights Included in ZCS Install Home Page

Please see: Ajcody-System-Documentation-For-Rights-Included-In-ZCS-Install


zmprov help right


$ zmprov help right

  checkRight(ckr) {target-type} [{target-id|target-name}] {grantee-id|grantee-name (note:can only check internal user)} {right}

  getAllEffectiveRights(gaer) {grantee-type} {grantee-id|grantee-name} [expandSetAttrs] [expandGetAttrs]

  getAllRights(gar) [-v] [-t {target-type}] [-c ALL|ADMIN|USER]

  getEffectiveRights(ger) {target-type} [{target-id|target-name}] {grantee-id|grantee-name} [expandSetAttrs] [expandGetAttrs]

  getCreateObjectAttrs(gcoa) {target-type} {domain-id|domain-name} {cos-id|cos-name} {grantee-id|grantee-name}

  getGrants(gg) [-t {target-type} [{target-id|target-name}]] [-g {grantee-type} {grantee-id|grantee-name} 
       [{0|1 (whether to include grants granted to groups the grantee belongs)}]]

  getRight(gr) {right} [-e] (whether to expand combo rights recursively)

  getRightsDoc(grd) [java packages]

  grantRight(grr) {target-type} [{target-id|target-name}] {grantee-type} [{grantee-id|grantee-name} [secret]] {[-]right}

  revokeRight(rvr) {target-type} [{target-id|target-name}] {grantee-type} [{grantee-id|grantee-name}] {[-]right}


    {target-type} = account, calresource, cos, dl, group, domain, server, ucservice, xmppcomponent, zimlet, config, global

    {target-id|target-name} is required if target-type is: account calresource cos dl group domain server ucservice xmppcomponent zimlet ,
        otherwise {target-id|target-name} should not be specified

    {grantee-type} = usr, grp, egp, all, dom, gst, key, pub, email

    {grantee-id|grantee-name} is required if grantee-type is: usr grp egp dom gst key email ,
        otherwise {target-id|target-name} should not be specified

    {right}: if right is prefixed with a '-', it means negative right, i.e., specifically deny
             for complete list of rights, do "zmprov [-l] gar"

Additional Commentary On grantee-type Types

For grantee-type, the options are available [Details found within /opt/zimbra/docs/soap.txt] :

  • usr - A Zimbra internal user
  • grp - A Zimbra internal group(distribution list)
  • egp - An external AD group
  • all - All Zimbra authenticated users - (by and {name-or-id} are ignored)
  • dom - (domain)
  • gst - (non-Zimbra email address and password)
    • Might not yet supported.
  • key - (non-Zimbra email address/external user and access key)
  • pub - Public authenticated and unauthenticated access - (by and {name-or-id} are ignored)
  • email - An email address. Server will lookup in directory and determine the actual grantee

zmmailbox help right

$ zmmailbox help right 

  checkRight(ckr)  [opts] {name} {right}
    -v/--verbose                 verbose output

  getRights(gr)  [opts] [right1 [right2...]]
    -v/--verbose                 verbose output

  grantRight(grr)  {account {name}|group {name}|domain {name}||all|public|guest {email} [{password}]|key {email} [{accesskey}] {[-]right}}

  listRights(lr)  [opts] 
    -v/--verbose                 verbose output

  revokeRight(rvr)  {account {name}|group {name}|domain {name}||all|public|guest {email} [{password}]|key {email} [{accesskey}] {[-]right}}

To grant/revoke rights on entries an account can inherit grants from(group, domain, global), use "zmprov grr/rvr" commands.

Developer text files on ZCS installs

In /opt/zimbra/conf/rights/ you'll find the following text files:

  • zimbra-rights.xml
  • zimbra-user-rights.xml
  • adminconsole-ui.xml
  • zimbra-rights-adminconsole-domainadmin.xml
  • zimbra-rights-adminconsole.xml
  • zimbra-rights-domainadmin.xml
  • zimbra-rights-roles.xml


zimbra-user-rights.xml



<?xml version="1.0" encoding="UTF-8"?>

<rights>

<!--
*******************
    user rights
    
    For user rights, default targetType is "account"
*******************
-->

<right name="invite" userRight="1" fallback="InviteFallback" cache="1" targetType="account">
  <desc>automatically add meeting invites from grantee to the target's calendar</desc>
  <default>allow</default>
</right>

<right name="viewFreeBusy" userRight="1" cache="1" targetType="account">
  <desc>view free/busy</desc>
  <default>allow</default>
</right>

<right name="loginAs" userRight="1" cache="1" targetType="account">
  <desc>login as another user.  Currently this is only honored for imap/pop3 login.</desc>
</right>

<right name="sendAs" userRight="1" cache="1" targetType="account" grantTargetType="account">
  <desc>reply to messages in a shared folder as the owner of the folder</desc>
</right>

<right name="sendOnBehalfOf" userRight="1" cache="1" targetType="account" grantTargetType="account">
  <desc>send messages on behalf of the grantor</desc>
</right>

<right name="sendAsDistList" userRight="1" cache="1" targetType="dl" grantTargetType="dl">
  <desc>reply to messages in a shared folder as the owner of the folder</desc>
</right>

<right name="sendOnBehalfOfDistList" userRight="1" cache="1" targetType="dl" grantTargetType="dl">
  <desc>send messages on behalf of the grantor</desc>
</right>

<right name="sendToDistList" userRight="1" targetType="dl" cache="1">
  <desc>send mails to distribution list</desc>
  <default>allow</default>
</right>

<right name="viewDistList" userRight="1" targetType="dl" cache="1">
  <desc>view distribution list members</desc>
  <default>allow</default>
</right>

<right name="createDistList" userRight="1" targetType="domain" cache="1">
  <desc>create distribution lists in a domain</desc>
</right>

<right name="ownDistList" userRight="1" targetType="dl" cache="1" grantTargetType="dl">
  <desc>own distribution list</desc>
</right>

</rights>


zimbra-rights.xml



<?xml version="1.0" encoding="UTF-8"?>

<rights>

<!-- 
********************
    admin rights
********************
-->

<!-- 
========================================================
                      account rights
========================================================
-->

<right name="getAccount" type="getAttrs" targetType="account">
  <desc>get all account attributes</desc>
</right>

<right name="modifyAccount" type="setAttrs" targetType="account">
  <desc>modify all account attributes</desc>
</right>

<right name="listAccount" type="preset" targetType="account">
  <desc>see account in GetAllAccounts/SearchDirectoryResponse</desc>
</right>

<right name="renameAccount" type="preset" targetType="account">
  <desc>rename account</desc>
</right>

<right name="deleteAccount" type="preset" targetType="account">
  <desc>delete account</desc>
</right>

<right name="addAccountAlias" type="preset" targetType="account">
  <desc>add account alias</desc>
</right>

<right name="removeAccountAlias" type="preset" targetType="account">
  <desc>remove account alias</desc>
</right>

<right name="getAccountInfo" type="preset" targetType="account">
  <desc>get basic account info: account id, home server, and access URLs</desc>
</right>

<right name="getAccountMembership" type="preset" targetType="account">
  <desc>get all groups the account is a member of</desc>
</right>

<right name="adminLoginAs" type="preset" targetType="account" cache="1">
  <desc>
    login to the user's account as an administrator
  </desc>
</right>

<right name="checkRightUsr" type="preset" targetType="account">
  <desc>check if the account has any effective rights</desc>
</right> 

<right name="getMailboxInfo" type="preset" targetType="account">
  <desc>get mailbox id and size(quota) of an account</desc>
</right>

<right name="purgeMessages" type="preset" targetType="account">
  <desc>purge messages of an account</desc>
</right>

<right name="reindexMailbox" type="preset" targetType="account">
  <desc>reindex mailbox</desc>
</right> 

<right name="moveAccountMailbox" type="preset" targetType="account">
  <desc>move account mailbox</desc>
</right>        
 
<right name="setAccountPassword" type="preset" targetType="account">
  <desc>set account password, not restricted by password strength policies</desc>
</right>

<right name="changeAccountPassword" type="preset" targetType="account">
  <desc>change account password, restricted by password strength policies</desc>
</right>

<right name="checkPasswordStrength" type="preset" targetType="account">
  <desc>check password strength</desc>
</right>

<right name="configurePasswordStrength" type="setAttrs" targetType="account,calresource,cos">
  <desc>configure password strength</desc>
  <attrs>
      <a n="zimbraPasswordMinLength"/>
      <a n="zimbraPasswordMaxLength"/>
      <a n="zimbraPasswordMinUpperCaseChars"/>
      <a n="zimbraPasswordMinLowerCaseChars"/>
      <a n="zimbraPasswordMinNumericChars"/>
      <a n="zimbraPasswordMinPunctuationChars"/>
  </attrs>
</right>

<right name="viewAdminSavedSearch" type="getAttrs" targetType="account,calresource">
  <desc>view admin saved searches</desc>
  <attrs>
      <a n="zimbraAdminSavedSearches"/>
  </attrs>
</right>

<right name="setAdminSavedSearch" type="setAttrs" targetType="account,calresource">
  <desc>save admin saved searches</desc>
  <attrs>
      <a n="zimbraAdminSavedSearches"/>
  </attrs>
</right>  

<right name="configureQuota" type="setAttrs" targetType="account,cos">
  <desc>configure quota</desc>
  <attrs>
      <a n="zimbraMailQuota"/>
      <a n="zimbraQuotaWarnPercent"/>
      <a n="zimbraQuotaWarnInterval"/>
      <a n="zimbraQuotaWarnMessage"/>
  </attrs>
</right> 

<right name="viewAccountAdminUI" type="preset" targetType="account">
  <desc>
    execute the GetAdminConsoleUIComp SOAP when an account 
    other than the authenticated account is specified in the request.  
  </desc>
</right>

<right name="viewDistributionListAdminUI" type="preset" targetType="dl">
  <desc>
    execute the GetAdminConsoleUIComp SOAP when a distribution list 
    is specified in the request.  
  </desc>
</right>

<right name="configureAdminUI" type="setAttrs" targetType="account,dl">
  <desc>configure admin UI components</desc>
  <attrs>
    <a n="zimbraAdminConsoleUIComponents"/>
  </attrs>
</right>

<!-- 
========================================================
                 calendar resource rights
========================================================
-->

<right name="getCalendarResource" type="getAttrs" targetType="calresource">
  <desc>get all calendar resource attributes</desc>
</right>

<right name="modifyCalendarResource" type="setAttrs" targetType="calresource">
  <desc>modify all calendar resource attributes</desc>
</right>

<right name="listCalendarResource" type="preset" targetType="calresource">
  <desc>see calendar resource in GetAllCalendarResources/SearchDirectoryResponse</desc>
</right>

<right name="renameCalendarResource" type="preset" targetType="calresource">
  <desc>rename calendar resource</desc>
</right>

<right name="deleteCalendarResource" type="preset" targetType="calresource">
  <desc>delete calendar resource</desc>
</right>

<right name="addCalendarResourceAlias" type="preset" targetType="calresource">
  <desc>add calendar resource alias</desc>
</right>

<right name="removeCalendarResourceAlias" type="preset" targetType="calresource">
  <desc>remove calendar resource alias</desc>
</right>

<right name="adminLoginCalendarResourceAs" type="preset" targetType="calresource">
  <desc>login to the calendar resource as an admin.</desc>
</right>
       
<right name="getCalendarResourceInfo" type="preset" targetType="calresource">
  <desc>get account id, home server, cos id and name, and access URL</desc>
</right>
       
<right name="setCalendarResourcePassword" type="preset" targetType="calresource">
  <desc>set calendar resource password, not restricted by password strength policies</desc>
</right>

<right name="changeCalendarResourcePassword" type="preset" targetType="calresource">
  <desc>set calendar resource password, restricted by password strength policies</desc>
</right> 

<right name="checkCalendarResourcePasswordStrength" type="preset" targetType="calresource">
  <desc>check password strength</desc>
</right>    

<right name="reindexCalendarResourceMailbox" type="preset" targetType="calresource">
  <desc>reindex mailbox</desc>
</right> 

<right name="moveCalendarResourceMailbox" type="preset" targetType="calresource">
  <desc>move calendar resource mailbox</desc>
</right>   

<!-- 
========================================================
                      COS rights
========================================================
-->

<right name="getCos" type="getAttrs" targetType="cos">
  <desc>get all cos attributes</desc>
</right>

<right name="modifyCos" type="setAttrs" targetType="cos">
  <desc>set all cos attributes</desc>
</right>

<right name="listCos" type="preset" targetType="cos">
  <desc>see cos in GetAllCos/SearchDirectoryResponse</desc>
</right>

<right name="renameCos" type="preset" targetType="cos">
  <desc>rename cos</desc>
</right>

<right name="deleteCos" type="preset" targetType="cos">
  <desc>delete cos</desc>
</right>

<right name="assignCos" type="preset" targetType="cos">
  <desc>assign the cos (to domains or accounts)</desc>
</right>

<right name="manageZimlet" type="preset" targetType="cos">
  <desc>activate/deactivate zimlets on a cos</desc>
</right>

<right name="configureCosConstraint" type="setAttrs" targetType="cos">
  <desc>configure cos constraint</desc>
  <attrs>
    <a n="zimbraConstraint"/>
  </attrs>
</right>

<!-- 
========================================================
                      config rights
========================================================
-->

<right name="getGlobalConfig" type="getAttrs" targetType="config">
  <desc>get all global config attributes</desc>
</right>

<right name="modifyGlobalConfig" type="setAttrs" targetType="config">
  <desc>modify all global config attributes</desc>
</right>

<right name="configureGlobalConfigConstraint" type="setAttrs" targetType="config">
  <desc>configure global config constraint</desc>
  <attrs>
    <a n="zimbraConstraint"/>
  </attrs>
</right>

<!-- 
========================================================
                 distribution list rights
========================================================
-->

<right name="checkRightGrp" type="preset" targetType="dl">
  <desc>check if the group has any effective rights</desc>
</right> 

<right name="getDistributionList" type="getAttrs" targetType="dl">
  <desc>get all distribution list attributes</desc>
</right>

<right name="modifyDistributionList" type="setAttrs" targetType="dl">
  <desc>set all distribution list attributes</desc>
</right>

<right name="listDistributionList" type="preset" targetType="dl">
  <desc>see distribution list in GetAllCos/SearchDirectoryResponse</desc>
</right>

<right name="renameDistributionList" type="preset" targetType="dl">
  <desc>rename distribution list</desc>
</right>

<right name="deleteDistributionList" type="preset" targetType="dl">
  <desc>delete distribution list</desc>
</right>

<right name="addDistributionListAlias" type="preset" targetType="dl">
  <desc>add distribution list alias</desc>
</right>

<right name="removeDistributionListAlias" type="preset" targetType="dl">
  <desc>remove distribution list alias</desc>
</right>

<right name="getDistributionListMembership" type="preset" targetType="dl">
  <desc>get all groups the distribution list is a member of</desc>
</right>

<right name="addDistributionListMember" type="preset" targetType="dl">
  <desc>add member to distribution list</desc>
</right>

<right name="removeDistributionListMember" type="preset" targetType="dl">
  <desc>remove member from distribution list</desc>
</right>


<!-- 
========================================================
                 dynamic group
========================================================
-->

<right name="getGroup" type="getAttrs" targetType="group">
  <desc>get all group attributes</desc>
</right>

<right name="modifyGroup" type="setAttrs" targetType="group">
  <desc>set all group attributes</desc>
</right>

<right name="listGroup" type="preset" targetType="group">
  <desc>see group in GetAllCos/SearchDirectoryResponse</desc>
</right>

<right name="renameGroup" type="preset" targetType="group">
  <desc>rename group</desc>
</right>

<right name="deleteGroup" type="preset" targetType="group">
  <desc>delete group</desc>
</right>

<right name="addGroupAlias" type="preset" targetType="group">
  <desc>add group alias</desc>
</right>

<right name="removeGroupAlias" type="preset" targetType="group">
  <desc>remove group alias</desc>
</right>

<right name="addGroupMember" type="preset" targetType="group">
  <desc>add member to group</desc>
</right>

<right name="removeGroupMember" type="preset" targetType="group">
  <desc>remove member from group</desc>
</right>



<!-- 
========================================================
                      domain rights
========================================================
-->

<right name="getDomain" type="getAttrs" targetType="domain">
  <desc>get all domain attributes</desc>
</right>

<right name="modifyDomain" type="setAttrs" targetType="domain">
  <desc>set all domain attributes</desc>
</right>

<right name="listDomain" type="preset" targetType="domain">
  <desc>see domain in GetAllCos/SearchDirectoryResponse</desc>
</right>

<right name="deleteDomain" type="preset" targetType="domain">
  <desc>delete domain</desc>
</right>

<right name="createSubDomain" type="preset" targetType="domain">
  <desc>create sub domain</desc>
</right>

<right name="checkDomainMXRecord" type="preset" targetType="domain">
  <desc>check domain MX record</desc>
</right>

<right name="countAccount" type="preset" targetType="domain">
  <desc>count accounts in a domain</desc>
</right>

<right name="getDomainQuotaUsage" type="preset" targetType="domain">
  <desc>get domain quota usage</desc>
</right>

<right name="createAccount" type="preset" targetType="domain">
  <desc>create account in the domain</desc>
</right>

<right name="autoProvisionAccount" type="preset" targetType="domain">
  <desc>auto provision account in the domain in MANUAL mode</desc>
</right>

<right name="createCalendarResource" type="preset" targetType="domain">
  <desc>create calendar resource in the domain</desc>
</right>

<right name="createDistributionList" type="preset" targetType="domain">
  <desc>create distribution list in the domain</desc>
</right>

<right name="createGroup" type="preset" targetType="domain">
  <desc>create group in the domain</desc>
</right>

<right name="createAlias" type="preset" targetType="domain">
  <desc>create alias in this domain</desc>
</right>

<right name="deleteAlias" type="preset" targetType="domain">
  <desc>delete alias in this domain</desc>
</right>

<right name="listAlias" type="preset" targetType="domain">
  <desc>list alias in this domain</desc>
</right>

<right name="accessGAL" type="preset" targetType="domain">
  <desc>access GAL(global address list)</desc>
</right>
         
<right name="checkExchangeAuthConfig" type="preset" targetType="domain">
  <desc>check exchange auth config</desc>
</right>

<right name="configureWikiAccount" type="setAttrs" targetType="domain,config">
  <desc>configure attributes for wiki account</desc>
   <attrs>
    <a n="zimbraNotebookAccount"/>                                
  </attrs> 
</right>


<right name="configureExternalGAL" type="setAttrs" targetType="domain">
  <desc>configure attributes for external GAL</desc>
   <attrs>
    <a n="zimbraGalMode"/>
    <a n="zimbraGalLdapURL"/>
    <a n="zimbraGalLdapSearchBase"/>
    <a n="zimbraGalLdapBindDn"/>
    <a n="zimbraGalLdapBindPassword"/>
    <a n="zimbraGalLdapFilter"/>
    <a n="zimbraGalAutoCompleteLdapFilter"/>
    <a n="zimbraGalSyncLdapURL"/>
    <a n="zimbraGalSyncLdapSearchBase"/>
    <a n="zimbraGalSyncLdapFilter"/>
    <a n="zimbraGalSyncLdapAuthMech"/>
    <a n="zimbraGalSyncLdapBindDn"/>
    <a n="zimbraGalSyncLdapBindPassword"/>                                   
  </attrs> 
</right>

<right name="configureExternalAuth" type="setAttrs" targetType="domain">
  <desc>configure attributes for external auth</desc>
   <attrs>
    <a n="zimbraAuthMech"/>
    <a n="zimbraAuthLdapURL"/>
    <a n="zimbraAuthLdapBindDn"/>
    <a n="zimbraAuthLdapSearchBase"/>
    <a n="zimbraAuthLdapSearchFilter"/>
    <a n="zimbraAuthLdapSearchBindDn"/>
    <a n="zimbraAuthLdapSearchBindPassword"/>      
    <a n="zimbraAuthFallbackToLocal"/>
    <a n="zimbraAuthKerberos5Realm"/>
    <a n="zimbraAuthLdapStartTlsEnabled"/>
  </attrs> 
</right>         


   
<!-- 
========================================================
                    server rights
========================================================
-->   

<right name="getServer" type="getAttrs" targetType="server">
  <desc>get all server attributes</desc>
</right>

<right name="modifyServer" type="setAttrs" targetType="server">
  <desc>set all server attributes</desc>
</right>

<right name="listServer" type="preset" targetType="server">
  <desc>see server in GetAllServers/SearchDirectoryResponse</desc>
</right>

<right name="deleteServer" type="preset" targetType="server">
  <desc>delete server</desc>
</right>

<right name="flushCache" type="preset" targetType="server">
  <desc>flush LDAP, skin, local caches on server</desc>
</right>

<right name="checkDirectoryOnFileSystem" type="preset" targetType="server">
  <desc>check and create directory on file system</desc>
</right>

<right name="checkHealth" type="preset" targetType="server">
  <desc>check server health</desc>
</right>
       
<right name="getSessions" type="preset" targetType="server">
  <desc>dump/get sessions</desc>
</right>

<right name="getMailboxStats" type="preset" targetType="server">
  <desc>get mailbox stats homed on the server</desc>
</right>

<right name="manageMailQueue" type="preset" targetType="server">
  <desc>view and take actions on mail queues</desc>
</right>   

<right name="manageAccountLogger" type="preset" targetType="server">
  <desc>add/remove account loggers</desc>
</right>

<right name="manageVolume" type="preset" targetType="server">
  <desc>create, volumes</desc>
</right>  

<right name="applianceAll" type="preset" targetType="server">
  <desc>catchall, appliance</desc>
</right>

<right name="deployZimlet" type="preset" targetType="server">
  <desc>deploy and undeploy zimlets on a server</desc>
</right>

<right name="backupAccount" type="preset" targetType="server">
  <desc>backup accounts on a server</desc>
</right> 

<right name="restoreAccount" type="preset" targetType="server">
  <desc>restore accounts on a server</desc>
</right> 

<right name="rolloverRedoLog" type="preset" targetType="server">
  <desc>rollover redo log on a server</desc>
</right> 

<right name="moveMailboxToServer" type="preset" targetType="server">
  <desc>move mailboxes to a server</desc>
</right> 

<right name="moveMailboxFromServer" type="preset" targetType="server">
  <desc>move mailboxes from a server and purge moved mailboxes</desc>
</right> 

<right name="getServiceStatus" type="preset" targetType="server">
  <desc>get service status of server</desc>
</right>

<right name="manageCrossMailboxSearchTask" type="preset" targetType="server">
  <desc>create/abort/delete/purge/get status of a cross mailbox search task</desc>
</right>

<right name="getServerStats" type="preset" targetType="server">
  <desc>get stats of server</desc>
</right>

<right name="getHSMStatus" type="preset" targetType="server">
  <desc>get HSM process status for a server</desc>
</right>

<right name="moveBlobs" type="preset" targetType="server">
  <desc>move blobs, start and abort HSM thread on a server</desc>
</right>

<right name="createMigrationTask" type="preset" targetType="server">
    <desc>create bulk migration task on a server</desc>
</right>

<right name="getCertificateInfo" type="preset" targetType="server">
    <desc>view SSL certificates installed on the target server</desc>
</right>

<right name="installCertificate" type="preset" targetType="server">
    <desc>install SSL certificates on the target server</desc>
</right>

<right name="getCSR" type="preset" targetType="server">
    <desc>get CSR from the target server</desc>
</right>  
   
<right name="generateCSR" type="preset" targetType="server">
    <desc>generate CSR on the target server</desc>
</right>


    
<!-- 
========================================================
                    UC service rights
========================================================
-->   

<right name="getUCService" type="getAttrs" targetType="ucservice">
  <desc>get all UC service attributes</desc>
</right>

<right name="modifyUCService" type="setAttrs" targetType="ucservice">
  <desc>set all UC service attributes</desc>
</right>

<right name="listUCService" type="preset" targetType="ucservice">
  <desc>see UC service in GetAllUCServices/SearchDirectoryResponse</desc>
</right>

<right name="deleteUCService" type="preset" targetType="ucservice">
  <desc>delete UC service</desc>
</right>

<right name="renameUCService" type="preset" targetType="ucservice">
  <desc>rename UC service</desc>
</right>

<!-- 
========================================================
                    XMPP component rights
========================================================
--> 

<right name="getXMPPComponent" type="getAttrs" targetType="xmppcomponent">
  <desc>get all XMPP component attributes</desc>
</right>

<right name="modifyXMPPComponent" type="setAttrs" targetType="xmppcomponent">
  <desc>set all XMPP component attributes</desc>
</right>

<right name="listXMPPComponent" type="preset" targetType="xmppcomponent">
  <desc>see XMPP component in GetAllXMPPComponents</desc>
</right>

<right name="deleteXMPPComponent" type="preset" targetType="xmppcomponent">
  <desc>delete XMPP component</desc>
</right>



<!-- 
========================================================
                    zimlet rights
========================================================
--> 

<right name="getZimlet" type="getAttrs" targetType="zimlet">
  <desc>get all zimlet attributes</desc>
</right>

<right name="modifyZimlet" type="setAttrs" targetType="zimlet">
  <desc>set all zimlet attributes</desc>
</right>

<right name="listZimlet" type="preset" targetType="zimlet">
  <desc>see zimlet in GetAllZimlets</desc>
</right>

<right name="deleteZimlet" type="preset" targetType="zimlet">
  <desc>delete zimlet</desc>
</right>


<!-- 
========================================================
                    global grant rights
========================================================
-->

<right name="createCos" type="preset" targetType="global">
  <desc>create cos</desc>
</right>

<right name="createServer" type="preset" targetType="global">
  <desc>create server</desc>
</right>

<right name="createUCService" type="preset" targetType="global">
  <desc>create UC service</desc>
</right>

<right name="createTopDomain" type="preset" targetType="global">
  <desc>create a top-level domain</desc>
</right>

<right name="createXMPPComponent" type="preset" targetType="global">
  <desc>create XMPP component</desc>
</right>

<right name="createZimlet" type="preset" targetType="global">
  <desc>create zimlet</desc>
</right>

<right name="installZCSLicense" type="preset" targetType="global">
    <desc>install Zimbra License file on the target server</desc>
</right>
   
<right name="getAllFreeBusyProviders" type="preset" targetType="global">
    <desc>Retrieve a list of Free/Busy providers via GetAllFreeBusyProvidersRequest SOAP request</desc>
</right>

<right name="checkSoftwareUpdates" type="preset" targetType="global">
    <desc>check for Zimbra software updates</desc>
</right>

<right name="uploadClientSoftware" type="preset" targetType="global">
    <desc>upload client software via Admin Console</desc>
</right>

<!-- 
========================================================
                    misc rights
========================================================
-->

<right name="crossDomainAdmin" type="preset" targetType="domain">
  <desc>cross domain admin right</desc>
</right>


<right name="viewGrants" type="getAttrs" targetType="account,calresource,cos,dl,domain,server,xmppcomponent,zimlet,config,global">
  <desc>view grants on all target types</desc>
  <!-- 
      Use just the one same right on all target types for now.
         
      e.g. If this right is granted on a domain, the grantee 
            can see zimbraACE on the domain, all DLs, and all 
            accounts in the domain.
            
            To do things like:
            "can see grants granted on all accounts in the domain
             but cannot see any grants on the domain entry itself"
            
            grant an inline right on the domain entry, like:
                get:account:zimbraACE
            and do not grant this right.
            
            This right the equivalent of the sum of the following inline
            rights:
                get.account.zimbraACE
                get.calresource.zimbraACE
                get.cos.zimbraACE
                get.dl.zimbraACE
                get.domain.zimbraACE
                get.server.zimbraACE
                get.xmppcomponent.zimbraACE
                get.zimlet.zimbraACE
                get.config.zimbraACE
                get.global.zimbraACE
  -->
  <attrs>
      <a n="zimbraACE"/>
  </attrs>
</right>



</rights>

adminconsole-ui.xml


<?xml version="1.0" encoding="UTF-8"?>

<rights>

<ui name="Manage-Accounts-Account-GeneralInfo">Home -> Manage -> Accounts -> [pick an account] -> General Information </ui>>
<ui name="Manage-Accounts-Account-GeneralInfo(modify)">Home -> Manage -> Accounts -> [pick an account] -> General Information (modify)</ui>>
<ui name="Manage-Accounts-Account-GeneralInfo(view)">Home -> Manage -> Accounts -> [pick an account] -> General Information (view)</ui>>

<ui name="Manage-Accounts-Account-ContactInfo">Home -> Manage -> Accounts -> [pick an account] -> Contact Information</ui>>
<ui name="Manage-Accounts-Account-ContactInfo(modify)">Home -> Manage -> Accounts -> [pick an account] -> Contact Information (modify)</ui>>
<ui name="Manage-Accounts-Account-ContactInfo(view)">Home -> Manage -> Accounts -> [pick an account] -> Contact Information (view)</ui>>

<ui name="Manage-Accounts-Account-MemberOf">Home -> Manage -> Accounts -> [pick an account] -> Member Of</ui>

<ui name="Manage-Accounts-Account-Aliases">Home -> Manage -> Accounts -> [pick an account] -> Aliases</ui>
<ui name="Manage-Accounts-Account-Aliases(modify)">Home -> Manage -> Accounts -> [pick an account] -> Aliases (modify)</ui>
<ui name="Manage-Accounts-Account-Aliases(view)">Home -> Manage -> Accounts -> [pick an account] -> Aliases (view)</ui>
  
<ui name="Manage-Accounts-Account-Features">Home -> Manage -> Accounts -> [pick an account] -> Features</ui>
<ui name="Manage-Accounts-Account-Features(modify)">Home -> Manage -> Accounts -> [pick an account] -> Features (modify)</ui>
<ui name="Manage-Accounts-Account-Features(view)">Home -> Manage -> Accounts -> [pick an account] -> Features (view)</ui>

<ui name="Manage-Accounts-Account-Forwarding">Home -> Manage -> Accounts -> [pick an account] -> Forwarding</ui>
<ui name="Manage-Accounts-Account-Forwarding(modify)">Home -> Manage -> Accounts -> [pick an account] -> Forwarding (modify)</ui>
<ui name="Manage-Accounts-Account-Forwarding(view)">Home -> Manage -> Accounts -> [pick an account] -> Forwarding (view)</ui>

<ui name="Manage-Accounts-Account-Preferences">Home -> Manage -> Accounts -> [pick an account] -> Preferences</ui>
<ui name="Manage-Accounts-Account-Preferences(modify)">Home -> Manage -> Accounts -> [pick an account] -> Preferences (modify)</ui>
<ui name="Manage-Accounts-Account-Preferences(view)">Home -> Manage -> Accounts -> [pick an account] -> Preferences (view)</ui>  

<ui name="Manage-Accounts-Account-FreeBusyInterop">Home -> Manage -> Accounts -> [pick an account] -> Free/Busy Interop</ui>
<ui name="Manage-Accounts-Account-FreeBusyInterop(modify)">Home -> Manage -> Accounts -> [pick an account] -> Free/Busy Interop (modify)</ui>
<ui name="Manage-Accounts-Account-FreeBusyInterop(view)">Home -> Manage -> Accounts -> [pick an account] -> Free/Busy Interop (view)</ui>
  
<ui name="Manage-Accounts-Account-Themes">Home -> Manage -> Accounts -> [pick an account] -> Themes</ui>
<ui name="Manage-Accounts-Account-Themes(modify)">Home -> Manage -> Accounts -> [pick an account] -> Themes (modify)</ui>
<ui name="Manage-Accounts-Account-Themes(view)">Home -> Manage -> Accounts -> [pick an account] -> Themes (view)</ui>

<ui name="Manage-Accounts-Account-Zimlets">Home -> Manage -> Accounts -> [pick an account] -> Zimlets</ui>
<ui name="Manage-Accounts-Account-Zimlets(modify)">Home -> Manage -> Accounts -> [pick an account] -> Zimlets (modify)</ui>
<ui name="Manage-Accounts-Account-Zimlets(view)">Home -> Manage -> Accounts -> [pick an account] -> Zimlets (view)</ui>

<ui name="Manage-Accounts-Account-ACL">Home -> Manage -> Accounts -> [pick an account] -> ACL</ui>
<ui name="Manage-Accounts-Account-ACL(modify)">Home -> Manage -> Accounts -> [pick an account] -> ACL (modify)</ui>
<ui name="Manage-Accounts-Account-ACL(view)">Home -> Manage -> Accounts -> [pick an account] -> ACL (view)</ui>

<ui name="Manage-DistributionLists-DistributionList-Members">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Members</ui>
<ui name="Manage-DistributionLists-DistributionList-Members(modify)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Members (modify)</ui>
<ui name="Manage-DistributionLists-DistributionList-Members(view)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Members (view)</ui>

<ui name="Manage-DistributionLists-DistributionList-Notes">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Notes</ui>
<ui name="Manage-DistributionLists-DistributionList-Notes(modify)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Notes (modify)</ui>
<ui name="Manage-DistributionLists-DistributionList-Notes(view)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Notes (view)</ui>

<ui name="Manage-DistributionLists-DistributionList-Aliases">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Aliases</ui>
<ui name="Manage-DistributionLists-DistributionList-Aliases(modify)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Aliases (modify) </ui>
<ui name="Manage-DistributionLists-DistributionList-Aliases(view)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> Aliases (view) </ui>

<ui name="Manage-DistributionLists-DistributionList-ACL">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> ACL</ui>
<ui name="Manage-DistributionLists-DistributionList-ACL(modify)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> ACL (modify) </ui>
<ui name="Manage-DistributionLists-DistributionList-ACL(view)">Home -> Manage -> Distribution Lists -> [pick a distribution list] -> ACL (view) </ui>

<ui name="Manage-Resources-Resource-Properties">Home -> Manage -> Resources -> [pick a resource] -> Properties</ui>
<ui name="Manage-Resources-Resource-Properties(modify)">Home -> Manage -> Resources -> [pick a resource] -> Properties (modify) </ui>
<ui name="Manage-Resources-Resource-Properties(view)">Home -> Manage -> Resources -> [pick a resource] -> Properties (view) </ui>

<ui name="Manage-Resources-Resource-LocationAndContactInfo">Home -> Manage -> Resources -> [pick a resource] -> Location and Contact Information</ui>
<ui name="Manage-Resources-Resource-LocationAndContactInfo(modify)">Home -> Manage -> Resources -> [pick a resource] -> Location and Contact Information (modify) </ui>
<ui name="Manage-Resources-Resource-LocationAndContactInfo(view)">Home -> Manage -> Resources -> [pick a resource] -> Location and Contact Information (view) </ui>
   
<ui name="Configure-COSes-COS-GeneralInfo">Home -> Configure -> Class of Service -> [pick a COS] -> General Information</ui>
<ui name="Configure-COSes-COS-GeneralInfo(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> General Information (modify) </ui>
<ui name="Configure-COSes-COS-GeneralInfo(view)">Home -> Configure -> Class of Service -> [pick a COS] -> General Information (view) </ui>
 
<ui name="Configure-COSes-COS-Features">Home -> Configure -> Class of Service -> [pick a COS] -> Features</ui>
<ui name="Configure-COSes-COS-Features(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> Features (modify) </ui>
<ui name="Configure-COSes-COS-Features(view)">Home -> Configure -> Class of Service -> [pick a COS] -> Features (view) </ui>

<ui name="Configure-COSes-COS-Preferences">Home -> Configure -> Class of Service -> [pick a COS] -> Preferences</ui>
<ui name="Configure-COSes-COS-Preferences(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> Preferences (modify) </ui>
<ui name="Configure-COSes-COS-Preferences(view)">Home -> Configure -> Class of Service -> [pick a COS] -> Preferences (view) </ui>

<ui name="Configure-COSes-COS-Themes">Home -> Configure -> Class of Service -> [pick a COS] -> Themes</ui>
<ui name="Configure-COSes-COS-Themes(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> Themes (modify) </ui>
<ui name="Configure-COSes-COS-Themes(view)">Home -> Configure -> Class of Service -> [pick a COS] -> Themes (view) </ui>
    
<ui name="Configure-COSes-COS-Zimlets">Home -> Configure -> Class of Service -> [pick a COS] -> Zimlets</ui>
<ui name="Configure-COSes-COS-Zimlets(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> Zimlets (modify) </ui>
<ui name="Configure-COSes-COS-Zimlets(view)">Home -> Configure -> Class of Service -> [pick a COS] -> Zimlets (view) </ui>
    
<ui name="Configure-COSes-COS-ServerPool">Home -> Configure -> Class of Service -> [pick a COS] -> Server Pool</ui>
<ui name="Configure-COSes-COS-ServerPool(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> Server Pool (modify) </ui>
<ui name="Configure-COSes-COS-ServerPool(view)">Home -> Configure -> Class of Service -> [pick a COS] -> Server Pool (view) </ui>
    
<ui name="Configure-COSes-COS-Advanced">Home -> Configure -> Class of Service -> [pick a COS] -> Advanced</ui>
<ui name="Configure-COSes-COS-Advanced(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> Advanced (modify) </ui>
<ui name="Configure-COSes-COS-Advanced(view)">Home -> Configure -> Class of Service -> [pick a COS] -> Advanced (view) </ui>
   
<ui name="Configure-COSes-COS-ACL">Home -> Configure -> Class of Service -> [pick a COS] -> AC</ui>
<ui name="Configure-COSes-COS-ACL(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> ACL (modify) </ui>
<ui name="Configure-COSes-COS-ACL(view)">Home -> Configure -> Class of Service -> [pick a COS] -> ACL (view) </ui>
   
<ui name="Configure-COSes-COS-MobileAccess">Home -> Configure -> Class of Service -> [pick a COS] -> Mobile Access</ui>
<ui name="Configure-COSes-COS-MobileAccess(modify)">Home -> Configure -> Class of Service -> [pick a COS] -> Mobile Access (modify) </ui>
<ui name="Configure-COSes-COS-MobileAccess(view)">Home -> Configure -> Class of Service -> [pick a COS] -> Mobile Access (view) </ui>
        
<ui name="Configure-Domains-Domain-New">Home -> Configure -> Domains -> New tool (for creating top domain)</ui>
  
        
<ui name="Configure-Domains-Domain-GeneralInfo">Home -> Configure -> Domains -> [pick a domain] -> General Information</ui>
<ui name="Configure-Domains-Domain-GeneralInfo(modify)">Home -> Configure -> Domains -> [pick a domain] -> General Information (modify) </ui>
<ui name="Configure-Domains-Domain-GeneralInfo(view)">Home -> Configure -> Domains -> [pick a domain] -> General Information (view) </ui>
            
<ui name="Configure-Domains-Domain-GAL">Home -> Configure -> Domains -> [pick a domain] -> GAL</ui>
<ui name="Configure-Domains-Domain-GAL-configure">Home -> Configure -> Domains -> [pick a domain] -> GAL (modify) </ui>
<ui name="Configure-Domains-Domain-GAL-configure(modify)">Home -> Configure -> Domains -> [pick a domain] -> GAL (modify) </ui>
<ui name="Configure-Domains-Domain-GAL-configure(view)">Home -> Configure -> Domains -> [pick a domain] -> GAL (view) </ui>
          
<ui name="Configure-Domains-Domain-Authentication">Home -> Configure -> Domains -> [pick a domain] -> Authentication</ui>
<ui name="Configure-Domains-Domain-Authentication(modify)">Home -> Configure -> Domains -> [pick a domain] -> Authentication (modify) </ui>
<ui name="Configure-Domains-Domain-Authentication(view)">Home -> Configure -> Domains -> [pick a domain] -> Authentication (view) </ui>
          
<ui name="Configure-Domains-Domain-VirtualHosts">Home -> Configure -> Domains -> [pick a domain] -> Virtual Hosts</ui>
<ui name="Configure-Domains-Domain-VirtualHosts(modify)">Home -> Configure -> Domains -> [pick a domain] -> Virtual Hosts (modify) </ui>
<ui name="Configure-Domains-Domain-VirtualHosts(view)">Home -> Configure -> Domains -> [pick a domain] -> Virtual Hosts (view) </ui>

<ui name="Configure-Domains-Domain-FreeBusyInterop">Home -> Configure -> Domains -> [pick a domain] -> Free/Busy interop</ui>
<ui name="Configure-Domains-Domain-FreeBusyInterop(modify)">Home -> Configure -> Domains -> [pick a domain] -> Free/Busy interop (modify) </ui>
<ui name="Configure-Domains-Domain-FreeBusyInterop(view)">Home -> Configure -> Domains -> [pick a domain] -> Free/Busy interop (view) </ui>
        
<ui name="Configure-Domains-Domain-Zimlets">Home -> Configure -> Domains -> [pick a domain] -> Zimlets</ui>
<ui name="Configure-Domains-Domain-Zimlets(modify)">Home -> Configure -> Domains -> [pick a domain] -> Zimlets (modify) </ui>
<ui name="Configure-Domains-Domain-Zimlets(view)">Home -> Configure -> Domains -> [pick a domain] -> Zimlets (view) </ui>

<ui name="Configure-Domains-Domain-Themes">Home -> Configure -> Domains -> [pick a domain] -> Themes</ui>
<ui name="Configure-Domains-Domain-Themes(modify)">Home -> Configure -> Domains -> [pick a domain] -> Themes (modify) </ui>
<ui name="Configure-Domains-Domain-Themes(view)">Home -> Configure -> Domains -> [pick a domain] -> Themes (view) </ui>
    
<ui name="Configure-Domains-Domain-AccountLimits">Home -> Configure -> Domains -> [pick a domain] -> Account Limits</ui>
<ui name="Configure-Domains-Domain-AccountLimits(modify)">Home -> Configure -> Domains -> [pick a domain] -> Account Limits (modify) </ui>
<ui name="Configure-Domains-Domain-AccountLimits(view)">Home -> Configure -> Domains -> [pick a domain] -> Account Limits (view) </ui>
    
<ui name="Configure-Domains-Domain-ACL">Home -> Configure -> Domains -> [pick a domain] -> AC</ui>
<ui name="Configure-Domains-Domain-ACL(modify)">Home -> Configure -> Domains -> [pick a domain] -> ACL (modify) </ui>
<ui name="Configure-Domains-Domain-ACL(view)">Home -> Configure -> Domains -> [pick a domain] -> ACL (view) </ui>
    
<ui name="Configure-Servers-Server-GeneralInfo">Home -> Configure -> Servers -> [pick a server] -> General Information</ui>
<ui name="Configure-Servers-Server-GeneralInfo(modify)">Home -> Configure -> Servers -> [pick a server] -> General Information (modify) </ui>
<ui name="Configure-Servers-Server-GeneralInfo(view)">Home -> Configure -> Servers -> [pick a server] -> General Information (view) </ui>

<ui name="Configure-Servers-Server-Services">Home -> Configure -> Servers -> [pick a server] -> Services</ui>
<ui name="Configure-Servers-Server-Services(modify)">Home -> Configure -> Servers -> [pick a server] -> Services (modify) </ui>
<ui name="Configure-Servers-Server-Services(view)">Home -> Configure -> Servers -> [pick a server] -> Services (view) </ui>
        
<ui name="Configure-Servers-Server-MTA">Home -> Configure -> Servers -> [pick a server] -> MTA</ui>
<ui name="Configure-Servers-Server-MTA(modify)">Home -> Configure -> Servers -> [pick a server] -> MTA (modify) </ui>
<ui name="Configure-Servers-Server-MTA(view)">Home -> Configure -> Servers -> [pick a server] -> MTA (view) </ui>
        
<ui name="Configure-Servers-Server-IMAP">Home -> Configure -> Servers -> [pick a server] -> IMAP</ui>
<ui name="Configure-Servers-Server-IMAP(modify)">Home -> Configure -> Servers -> [pick a server] -> IMAP (modify) </ui>
<ui name="Configure-Servers-Server-IMAP(view)">Home -> Configure -> Servers -> [pick a server] -> IMAP (view) </ui>
        
<ui name="Configure-Servers-Server-POP">Home -> Configure -> Servers -> [pick a server] -> POP</ui>
<ui name="Configure-Servers-Server-POP(modify)">Home -> Configure -> Servers -> [pick a server] -> POP (modify) </ui>
<ui name="Configure-Servers-Server-POP(view)">Home -> Configure -> Servers -> [pick a server] -> POP (view) </ui>
      
<ui name="Configure-Servers-Server-Volumes">Home -> Configure -> Servers -> [pick a server] -> Volumes</ui>
<ui name="Configure-Servers-Server-Volumes(modify)">Home -> Configure -> Servers -> [pick a server] -> Volumes (modify) </ui>
<ui name="Configure-Servers-Server-Volumes(view)">Home -> Configure -> Servers -> [pick a server] -> Volumes (view) </ui>
      
<ui name="Configure-Servers-Server-BackupRestore">Home -> Configure -> Servers -> [pick a server] -> Backup/Restore</ui>
<ui name="Configure-Servers-Server-BackupRestore(modify)">Home -> Configure -> Servers -> [pick a server] -> Backup/Restore (modify)</ui>
<ui name="Configure-Servers-Server-BackupRestore(view)">Home -> Configure -> Servers -> [pick a server] -> Backup/Restore (view)</ui>
      
<ui name="Configure-Servers-Server-ACL">Home -> Configure -> Servers -> [pick a server] -> ACL</ui>
<ui name="Configure-Servers-Server-ACL(modify)">Home -> Configure -> Servers -> [pick a server] -> ACL (modify)</ui>
<ui name="Configure-Servers-Server-ACL(view)">Home -> Configure -> Servers -> [pick a server] -> ACL (view)</ui>

<ui name="Configure-Zimlets-Zimlet-ACL">Home -> Configure -> Zimlets -> [pick a zimlet] -> ACL</ui>
<ui name="Configure-Zimlets-Zimlet-ACL(modify)">Home -> Configure -> Zimlets -> [pick a zimlet] -> ACL (modify)</ui>
<ui name="Configure-Zimlets-Zimlet-ACL(view)">Home -> Configure -> Zimlets -> [pick a zimlet] -> ACL (view)</ui>

<ui name="Configure-AdminExtensions-AdminExtension-ACL">Home -> Configure -> Admin Extensions -> [pick an admin extension] -> ACL</ui>
<ui name="Configure-AdminExtensions-AdminExtension-ACL(modify)">Home -> Configure -> Admin Extensions -> [pick an admin extension] -> ACL (modify)</ui>
<ui name="Configure-AdminExtensions-AdminExtension-ACL(view)">Home -> Configure -> Admin Extensions -> [pick an admin extension] -> ACL (view)</ui>
      
<ui name="Configure-GlobalSettings-GeneralInfo">Home -> Configure -> Global Settings-> General Information</ui>
<ui name="Configure-GlobalSettings-GeneralInfo(modify)">Home -> Configure -> Global Settings-> General Information (modify)</ui>
<ui name="Configure-GlobalSettings-GeneralInfo(view)">Home -> Configure -> Global Settings-> General Information (view)</ui>
      
<ui name="Configure-GlobalSettings-Attachments">Home -> Configure -> Global Settings-> Attachments</ui>
<ui name="Configure-GlobalSettings-Attachments(modify)">Home -> Configure -> Global Settings-> Attachments (modify)</ui>
<ui name="Configure-GlobalSettings-Attachments(view)">Home -> Configure -> Global Settings-> Attachments (view)</ui>
      
<ui name="Configure-GlobalSettings-MTA">Home -> Configure -> Global Settings-> MTA</ui>
<ui name="Configure-GlobalSettings-MTA(modify)">Home -> Configure -> Global Settings-> MTA (modify)</ui>
<ui name="Configure-GlobalSettings-MTA(view)">Home -> Configure -> Global Settings-> MTA (view)</ui>
     
<ui name="Configure-GlobalSettings-IMAP">Home -> Configure -> Global Settings-> IMAP</ui>
<ui name="Configure-GlobalSettings-IMAP(modify)">Home -> Configure -> Global Settings-> IMAP (modify)</ui>
<ui name="Configure-GlobalSettings-IMAP(view)">Home -> Configure -> Global Settings-> IMAP (view)</ui>
    
<ui name="Configure-GlobalSettings-POP">Home -> Configure -> Global Settings-> POP</ui>
<ui name="Configure-GlobalSettings-POP(modify)">Home -> Configure -> Global Settings-> POP (modify)</ui>
<ui name="Configure-GlobalSettings-POP(view)">Home -> Configure -> Global Settings-> POP (view)</ui>
      
<ui name="Configure-GlobalSettings-AS/AV">Home -> Configure -> Global Settings-> AS/AV</ui>
<ui name="Configure-GlobalSettings-AS/AV(modify)">Home -> Configure -> Global Settings-> AS/AV (modify)</ui>
<ui name="Configure-GlobalSettings-AS/AV(view)">Home -> Configure -> Global Settings-> AS/AV (view)</ui>
     
<ui name="Configure-GlobalSettings-FreeBusyInterop">Home -> Configure -> Global Settings-> Free/Busy interop</ui>
<ui name="Configure-GlobalSettings-FreeBusyInterop(modify)">Home -> Configure -> Global Settings-> Free/Busy interop (modify)</ui>
<ui name="Configure-GlobalSettings-FreeBusyInterop(view)">Home -> Configure -> Global Settings-> Free/Busy interop (view)</ui>
    
<ui name="Configure-GlobalSettings-Themes">Home -> Configure -> Global Settings-> Themes</ui>
<ui name="Configure-GlobalSettings-Themes(modify)">Home -> Configure -> Global Settings-> Themes (modify)</ui>
<ui name="Configure-GlobalSettings-Themes(view)">Home -> Configure -> Global Settings-> Themes (view)</ui>
    
<ui name="Configure-GlobalSettings-BackupRestore">Home -> Configure -> Global Settings-> Backup/Restore</ui>
<ui name="Configure-GlobalSettings-BackupRestore(modify)">Home -> Configure -> Global Settings-> Backup/Restore (modify)</ui>
<ui name="Configure-GlobalSettings-BackupRestore(view)">Home -> Configure -> Global Settings-> Backup/Restore (view)</ui>
    
<ui name="Configure-GlobalSettings-ACL">Home -> Configure -> Global Settings-> ACL</ui>
<ui name="Configure-GlobalSettings-ACL(modify)">Home -> Configure -> Global Settings-> ACL (modify)</ui>
<ui name="Configure-GlobalSettings-ACL(view)">Home -> Configure -> Global Settings-> ACL (view)</ui>
    
<ui name="Configure-GlobalSettings-HSM">Home -> Configure -> Global Settings-> HSM</ui>
<ui name="Configure-GlobalSettings-HSM(modify)">Home -> Configure -> Global Settings-> HSM (modify)</ui>
<ui name="Configure-GlobalSettings-HSM(view)">Home -> Configure -> Global Settings-> HSM (view)</ui>
    
<ui name="Configure-GlobalSettings-License">Home -> Configure -> Global Settings-> License</ui>
<ui name="Configure-GlobalSettings-License(modify)">Home -> Configure -> Global Settings-> License (modify)</ui>
<ui name="Configure-GlobalSettings-License(view)">Home -> Configure -> Global Settings-> License (view)</ui>
    
<ui name="Manage-Accounts">Home -> Manage -> Accounts</ui>
<ui name="Manage-Aliases">Home -> Manage -> Aliases</ui>
<ui name="Manage-DistributionLists">Home -> Manage -> Distribution Lists</ui>
<ui name="Manage-Resources">Home -> Manage -> Resources</ui>
<ui name="Manage-COS">Home -> Configure -> Class of Service</ui>
    
<ui name="Monitor-ServerStatus">Home -> Monitor -> Server Status</ui>
<ui name="Monitor-ServerStatistics">Home -> Monitor -> Server Statistics</ui>
<ui name="Monitor-MailQueues">Home -> Monitor -> Mail Queues</ui>

<ui name="Configure-Certificates">Home -> Configure -> Certificates</ui>
<ui name="Configure-Domains">Home -> Configure -> Domains</ui>
<ui name="Configure-Servers">Home -> Configure -> Servers</ui>
<ui name="Configure-Zimlets">Home -> Configure -> Zimlets</ui>
<ui name="Configure-Zimlets-Deploy">Home -> Configure -> Zimlets -> Deploy tool</ui>
<ui name="Configure-AdminExtensions">Home -> Configure -> Admin Extensions</ui>
<ui name="Configure-GlobalSettings">Home -> Configure -> Global Settings</ui>
<ui name="Configure-Voice/Chat">Home -> Configure -> Voice/Chat Service</ui>
   
<ui name="Search-SavedSearches-SavedSearch-Edit">Home -> Search -> Saved Searches -> [pick a saved search] -> Edit</ui>
  
<ui name="ToolsAndMigration-AccountMigration">Home -> Tools and Migration -> Account Migration</ui>
<ui name="ToolsAndMigration-Backups">Home -> Tools and Migration -> Backups</ui>
<ui name="ToolsAndMigration-SearchMail">Home -> Tools and Migration -> Search Mail</ui>
<ui name="ToolsAndMigration-SoftwareUpdates">Home -> Tools and Migration -> Software Updates</ui>
<ui name="ToolsAndMigration-SoftwareUpdates(modify)">Home -> Tools and Migration -> Software Updates (modify)</ui>
<ui name="ToolsAndMigration-SoftwareUpdates(view)">Home -> Tools and Migration -> Software Updates (view)</ui>

<ui name="home">Home</ui>
  
</rights>


zimbra-rights-adminconsole.xml


<?xml version="1.0" encoding="UTF-8"?>

<rights>

<include file="zimbra-rights.xml"/>
<include file="zimbra-rights-roles.xml"/>
<include file="adminconsole-ui.xml"/>

<!--
  =======================================================
    Admin Console Accounts List View
  =======================================================
-->
<!-- Admin Console Accounts Info Tab -->
<right name="setAdminConsoleAccountsInfoTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for accounts contact tab </desc>
  <ui name="Manage-Accounts-Account-GeneralInfo(modify)"/>
  <attrs>
    <a n="givenName"/>
    <a n="initials"/>
    <a n="sn"/>
    <a n="displayName"/>
    <a n="zimbraMailCanonicalAddress"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraAccountStatus"/>
    <!-- <a n="zimbraCOSId"/> -->
    <!-- <a n="zimbraIsAdminAccount -->
    <a n="zimbraIsDelegatedAdminAccount"/>
    <!-- admin groups? -->
    <a n="zimbraDomainAdminMaxMailQuota"/>
    <!-- rights to change password -->
    <a n="zimbraPasswordMustChange"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
  </attrs>
</right>

<right name="viewAdminConsoleAccountsInfoTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for accounts contact tab </desc>
  <ui name="Manage-Accounts-Account-GeneralInfo(view)"/>
  <attrs>
    <a n="givenName"/>
    <a n="initials"/>
    <a n="uid"/>
    <a n="cn"/>
    <a n="sn"/>
    <a n="displayName"/>
    <a n="zimbraMailCanonicalAddress"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraAccountStatus"/>
    <!-- <a n="zimbraCOSId"/> -->
    <!-- <a n="zimbraIsAdminAccount -->
    <a n="zimbraIsDelegatedAdminAccount"/>
    <!-- admin groups? -->
    <a n="zimbraDomainAdminMaxMailQuota"/>
    <!-- rights to change password -->
    <a n="zimbraPasswordMustChange"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
    <a n="zimbraLastLogonTimestamp"/>
  </attrs>
</right>

<right name="adminConsoleAccountsInfoTabRights" type="combo">
  <desc> Admin Console rights for Accounts Info Tab </desc>
  <ui name="Manage-Accounts-Account-GeneralInfo"/>
  <rights>
    <r n="setAdminConsoleAccountsInfoTab"/>
    <r n="viewAdminConsoleAccountsInfoTab"/>
    <r n="getAccountInfo"/>
    <r n="createAccount"/>
    <r n="deleteAccount"/>
    <r n="renameAccount"/>
    <r n="setAccountPassword"/>
  </rights>
</right>

<!-- Admin Console Accounts Contact Tab -->
<right name="setAdminConsoleAccountsContactTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for accounts contact tab </desc>
  <ui name="Manage-Accounts-Account-ContactInfo(modify)"/>
  <attrs>
    <a n="telephoneNumber"/>
    <a n="homePhone"/>
    <a n="mobile"/>
    <a n="pager"/>
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
    <a n="title"/>
    <a n="facsimileTelephoneNumber"/>
  </attrs>
</right>

<right name="viewAdminConsoleAccountsContactTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for accounts contact tab </desc>
  <ui name="Manage-Accounts-Account-ContactInfo(view)"/>
  <attrs>
    <a n="telephoneNumber"/>
    <a n="homePhone"/>
    <a n="mobile"/>
    <a n="pager"/>    
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
    <a n="title"/>
    <a n="facsimileTelephoneNumber"/>
  </attrs>
</right>

<right name="adminConsoleAccountsContactTabRights" type="combo">
  <desc> Admin Console rights for Accounts Contact Tab </desc>
  <ui name="Manage-Accounts-Account-ContactInfo"/>
  <rights>
    <r n="setAdminConsoleAccountsContactTab"/>
    <r n="viewAdminConsoleAccountsContactTab"/>
  </rights>
</right>

<!-- Admin Console Accounts MemberOf Tab -->
<!-- <right name="setAdminConsoleAccountsMemberOfTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts MemberOf Tab </desc>
  <attrs></attrs>
</right> -->
<!-- <right name="viewAdminConsoleAccountsMemberOfTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts MemberOf Tab </desc>
  <attrs></attrs>
</right> -->
<right name="adminConsoleAccountsMemberOfTabRights" type="combo">
  <desc> Admin Console rights for Accounts MemberOf Tab </desc>
  <ui name="Manage-Accounts-Account-MemberOf"/>
  <rights>
    <r n="getAccountMembership"/>
  </rights>
</right>

<!-- Admin Console Accounts Aliases Tab -->
<right name="setAdminConsoleAccountsAliasesTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Aliases Tab </desc>
  <ui name="Manage-Accounts-Account-Aliases(modify)"/>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsAliasesTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Aliases Tab </desc>
  <ui name="Manage-Accounts-Account-Aliases(view)"/>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="adminConsoleAccountsAliasesTabRights" type="combo">
  <desc> Admin Console rights for Accounts Aliases Tab </desc>
  <ui name="Manage-Accounts-Account-Aliases"/>
  <rights>
    <r n="setAdminConsoleAccountsAliasesTab"/>
    <r n="viewAdminConsoleAccountsAliasesTab"/>
    <r n="createAlias"/>
    <r n="deleteAlias"/>
    <r n="addAccountAlias"/>
    <r n="removeAccountAlias"/>
  </rights>
</right>

<!-- Admin Console Accounts Features Tab -->
<right name="setAdminConsoleAccountsFeaturesTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Features Tab </desc>
  <ui name="Manage-Accounts-Account-Features(modify)"/>
  <attrs>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraPop3Enabled"/>
    <a n="zimbraFeatureReadReceiptsEnabled"/>
    <a n="zimbraFeatureMailEnabled"/>
    <a n="zimbraFeatureContactsEnabled"/>
    <a n="zimbraFeatureCalendarEnabled"/>
    <a n="zimbraFeatureTasksEnabled"/>
    <a n="zimbraFeatureNotebookEnabled"/>
    <a n="zimbraFeatureBriefcasesEnabled"/>
    <a n="zimbraFeatureIMEnabled"/>
    <a n="zimbraFeatureOptionsEnabled"/>
    <a n="zimbraFeatureTaggingEnabled"/>
    <a n="zimbraFeatureSharingEnabled"/>
    <a n="zimbraFeatureChangePasswordEnabled"/>
    <a n="zimbraFeatureSkinChangeEnabled"/>
    <a n="zimbraFeatureHtmlComposeEnabled"/>
    <a n="zimbraFeatureShortcutAliasesEnabled"/>
    <a n="zimbraFeatureGalEnabled"/>
    <a n="zimbraFeatureGalAutoCompleteEnabled"/>
    <a n="zimbraFeatureMailPriorityEnabled"/>
    <a n="zimbraFeatureFlaggingEnabled"/>
    <a n="zimbraFeatureImapDataSourceEnabled"/>
    <a n="zimbraFeaturePop3DataSourceEnabled"/>
    <a n="zimbraFeatureConversationsEnabled"/>
    <a n="zimbraFeatureFiltersEnabled"/>
    <a n="zimbraFeatureOutOfOfficeReplyEnabled"/>
    <a n="zimbraFeatureNewMailNotificationEnabled"/>
      <!-- deprecated PollingInterval -->
    <a n="zimbraFeatureMailPollingIntervalPreferenceEnabled"/>
    <a n="zimbraFeatureIdentitiesEnabled"/>
    <a n="zimbraFeatureGroupCalendarEnabled"/>
    <a n="zimbraFeatureInstantNotify"/>
    <a n="zimbraFeatureAdvancedSearchEnabled"/>
    <a n="zimbraFeatureSavedSearchesEnabled"/>
    <a n="zimbraFeatureInitialSearchPreferenceEnabled"/>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsFeaturesTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Features Tab </desc>
  <ui name="Manage-Accounts-Account-Features(view)"/>
  <attrs>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraPop3Enabled"/>
    <a n="zimbraFeatureReadReceiptsEnabled"/>
    <a n="zimbraFeatureMailEnabled"/>
    <a n="zimbraFeatureContactsEnabled"/>
    <a n="zimbraFeatureCalendarEnabled"/>
    <a n="zimbraFeatureTasksEnabled"/>
    <a n="zimbraFeatureNotebookEnabled"/>
    <a n="zimbraFeatureBriefcasesEnabled"/>
    <a n="zimbraFeatureIMEnabled"/>
    <a n="zimbraFeatureOptionsEnabled"/>
    <a n="zimbraFeatureTaggingEnabled"/>
    <a n="zimbraFeatureSharingEnabled"/>
    <a n="zimbraFeatureChangePasswordEnabled"/>
    <a n="zimbraFeatureSkinChangeEnabled"/>
    <a n="zimbraFeatureHtmlComposeEnabled"/>
    <a n="zimbraFeatureShortcutAliasesEnabled"/>
    <a n="zimbraFeatureGalEnabled"/>
    <a n="zimbraFeatureGalAutoCompleteEnabled"/>
    <a n="zimbraFeatureMailPriorityEnabled"/>
    <a n="zimbraFeatureFlaggingEnabled"/>
    <a n="zimbraFeatureImapDataSourceEnabled"/>
    <a n="zimbraFeaturePop3DataSourceEnabled"/>
    <a n="zimbraFeatureConversationsEnabled"/>
    <a n="zimbraFeatureFiltersEnabled"/>
    <a n="zimbraFeatureOutOfOfficeReplyEnabled"/>
    <a n="zimbraFeatureNewMailNotificationEnabled"/>
      <!-- deprecated PollingInterval -->
    <a n="zimbraFeatureMailPollingIntervalPreferenceEnabled"/>
    <a n="zimbraFeatureIdentitiesEnabled"/>
    <a n="zimbraFeatureGroupCalendarEnabled"/>
    <a n="zimbraFeatureInstantNotify"/>
    <a n="zimbraFeatureAdvancedSearchEnabled"/>
    <a n="zimbraFeatureSavedSearchesEnabled"/>
    <a n="zimbraFeatureInitialSearchPreferenceEnabled"/>
  </attrs>
</right>
<right name="adminConsoleAccountsFeaturesTabRights" type="combo">
  <desc> Admin Console rights for Accounts Features Tab </desc>
  <ui name="Manage-Accounts-Account-Features"/>
  <rights>
    <r n="setAdminConsoleAccountsFeaturesTab"/>
    <r n="viewAdminConsoleAccountsFeaturesTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Forwarding Tab -->
<right name="setAdminConsoleAccountsForwardingTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Forwarding Tab </desc>
  <ui name="Manage-Accounts-Account-Forwarding(modify)"/>
  <attrs>
    <a n="zimbraFeatureMailForwardingEnabled"/>
    <a n="zimbraPrefMailLocalDeliveryDisabled"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="zimbraPrefMailForwardingAddress"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsForwardingTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Forwarding Tab </desc>
  <ui name="Manage-Accounts-Account-Forwarding(view)"/>
  <attrs>
    <a n="zimbraFeatureMailForwardingEnabled"/>
    <a n="zimbraPrefMailLocalDeliveryDisabled"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="zimbraPrefMailForwardingAddress"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
  </attrs>
</right>
<right name="adminConsoleAccountsForwardingTabRights" type="combo">
  <desc> Admin Console rights for Accounts Forwarding Tab </desc>
  <ui name="Manage-Accounts-Account-Forwarding"/>
  <rights>
    <r n="setAdminConsoleAccountsForwardingTab"/>
    <r n="viewAdminConsoleAccountsForwardingTab"/>
  </rights>
</right>


<!-- Admin Console Accounts Preferences Tab -->
<right name="setAdminConsoleAccountsPreferencesTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Preferences Tab </desc>
  <ui name="Manage-Accounts-Account-Preferences(modify)"/>
  <attrs>
    <a n="zimbraPrefAppleIcalDelegationEnabled"/>
    <a n="zimbraPrefCalendarShowPastDueReminders"/>
    <a n="zimbraPrefCalendarToasterEnabled"/>
    <a n="zimbraPrefCalendarAllowCancelEmailToSelf"/>
    <a n="zimbraPrefCalendarAllowPublishMethodInvite"/>
    <a n="zimbraPrefCalendarAllowForwardedInvite"/>
    <a n="zimbraPrefCalendarReminderFlashTitle"/>
    <a n="zimbraPrefCalendarNotifyDelegatedChanges"/>
    <a n="zimbraPrefCalendarFirstDayOfWeek"/>
    <a n="zimbraPrefCalendarInitialView"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
    <a n="zimbraPrefClientType"/>
    <a n="zimbraPrefTimeZoneId"/>
    <a n="zimbraAllowAnyFromAddress"/>
    <a n="zimbraAllowFromAddress"/>
    <a n="zimbraPrefCalendarAlwaysShowMiniCal"/>
    <a n="zimbraPrefCalendarUseQuickAdd"/>
    <a n="zimbraPrefSaveToSent"/>
    <a n="zimbraPrefMailSignature"/>
    <a n="zimbraPrefMailSignatureEnabled"/>
    <a n="zimbraPrefSentMailFolder"/>
    <a n="zimbraPrefGroupMailBy"/>
    <a n="zimbraPrefIncludeSpamInSearch"/>
    <a n="zimbraPrefIncludeTrashInSearch"/>
    <a n="zimbraPrefMailInitialSearch"/>
    <a n="zimbraMaxMailItemsPerPage"/>
    <a n="zimbraPrefMailItemsPerPage"/>
    <a n="zimbraPrefMailPollingInterval"/>
    <a n="zimbraPrefMailFlashTitle"/>
    <a n="zimbraPrefMailFlashIcon"/>
    <a n="zimbraPrefMailSoundsEnabled"/>
    <a n="zimbraMailMinPollingInterval"/>
    <a n="zimbraPrefOutOfOfficeFromDate"/>
    <a n="zimbraPrefOutOfOfficeUntilDate"/>
    <a n="zimbraPrefOutOfOfficeReply"/>
    <a n="zimbraPrefOutOfOfficeReplyEnabled"/>
    <a n="zimbraPrefReplyToAddress"/>
    <a n="zimbraPrefUseKeyboardShortcuts"/>
    <a n="zimbraPrefContactsPerPage"/>
    <a n="zimbraMemberOf"/>
    <a n="zimbraPrefComposeInNewWindow"/>
    <a n="zimbraPrefForwardReplyInOriginalFormat"/>
    <a n="zimbraPrefAutoAddAddressEnabled"/>
    <a n="zimbraPrefComposeFormat"/>
    <a n="zimbraPrefMessageViewHtmlPreferred"/>
    <a n="zimbraPrefNewMailNotificationAddress"/>
    <a n="zimbraPrefNewMailNotificationEnabled"/>
    <a n="zimbraPrefOutOfOfficeReply"/>
    <a n="zimbraPrefShowSearchString"/>
    <a n="zimbraPrefMailSignatureStyle"/>
    <a n="zimbraPrefUseTimeZoneListInCalendar"/>
    <a n="zimbraPrefImapSearchFoldersEnabled"/>
    <a n="zimbraPrefMailForwardingAddress"/>
    <a n="zimbraPrefMailLocalDeliveryDisabled"/>
    <a n="zimbraPrefCalendarApptReminderWarningTime"/>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraPrefGalAutoCompleteEnabled"/>
    <a n="zimbraPrefWarnOnExit"/>
    <a n="zimbraPrefShowSelectionCheckbox"/>
    <a n="zimbraPrefHtmlEditorDefaultFontSize"/>
    <a n="zimbraPrefHtmlEditorDefaultFontFamily"/>
    <a n="zimbraPrefHtmlEditorDefaultFontColor"/>
    <a n="zimbraMailSignatureMaxLength"/>
    <a n="zimbraPrefDisplayExternalImages" />
    <a n="zimbraPrefOutOfOfficeCacheDuration"/>
    <a n="zimbraPrefMailDefaultCharset"/>
    <a n="zimbraPrefLocale"/>
    <a n="zimbraJunkMessagesIndexingEnabled"/>
    <a n="zimbraPrefMailSendReadReceipts"/>
    <a n="zimbraPrefReadReceiptsToAddress"/>
    <a n="zimbraPrefAdminConsoleWarnOnExit" />
    <a n="zimbraPrefMandatorySpellCheckEnabled"/>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsPreferencesTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Preferences Tab </desc>
  <ui name="Manage-Accounts-Account-Preferences(view)"/>
  <attrs>
    <a n="zimbraPrefAppleIcalDelegationEnabled"/>
    <a n="zimbraPrefCalendarShowPastDueReminders"/>
    <a n="zimbraPrefCalendarToasterEnabled"/>
    <a n="zimbraPrefCalendarAllowCancelEmailToSelf"/>
    <a n="zimbraPrefCalendarAllowPublishMethodInvite"/>
    <a n="zimbraPrefCalendarAllowForwardedInvite"/>
    <a n="zimbraPrefCalendarReminderFlashTitle"/>
    <a n="zimbraPrefCalendarNotifyDelegatedChanges"/>
    <a n="zimbraPrefCalendarFirstDayOfWeek"/>
    <a n="zimbraPrefCalendarInitialView"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
    <a n="zimbraPrefClientType"/>
    <a n="zimbraPrefTimeZoneId"/>
    <a n="zimbraAllowAnyFromAddress"/>
    <a n="zimbraAllowFromAddress"/>
    <a n="zimbraPrefCalendarAlwaysShowMiniCal"/>
    <a n="zimbraPrefCalendarUseQuickAdd"/>
    <a n="zimbraPrefSaveToSent"/>
    <a n="zimbraPrefMailSignature"/>
    <a n="zimbraPrefMailSignatureEnabled"/>
    <a n="zimbraPrefSentMailFolder"/>
    <a n="zimbraPrefGroupMailBy"/>
    <a n="zimbraPrefIncludeSpamInSearch"/>
    <a n="zimbraPrefIncludeTrashInSearch"/>
    <a n="zimbraPrefMailInitialSearch"/>
    <a n="zimbraMaxMailItemsPerPage"/>
    <a n="zimbraPrefMailItemsPerPage"/>
    <a n="zimbraPrefMailPollingInterval"/>
    <a n="zimbraPrefMailFlashTitle"/>
    <a n="zimbraPrefMailFlashIcon"/>
    <a n="zimbraPrefMailSoundsEnabled"/>
    <a n="zimbraMailMinPollingInterval"/>
    <a n="zimbraPrefOutOfOfficeFromDate"/>
    <a n="zimbraPrefOutOfOfficeUntilDate"/>
    <a n="zimbraPrefOutOfOfficeReply"/>
    <a n="zimbraPrefOutOfOfficeReplyEnabled"/>
    <a n="zimbraPrefReplyToAddress"/>
    <a n="zimbraPrefUseKeyboardShortcuts"/>
    <a n="zimbraPrefContactsPerPage"/>
    <a n="zimbraMemberOf"/>
    <a n="zimbraPrefComposeInNewWindow"/>
    <a n="zimbraPrefForwardReplyInOriginalFormat"/>
    <a n="zimbraPrefAutoAddAddressEnabled"/>
    <a n="zimbraPrefComposeFormat"/>
    <a n="zimbraPrefMessageViewHtmlPreferred"/>
    <a n="zimbraPrefNewMailNotificationAddress"/>
    <a n="zimbraPrefNewMailNotificationEnabled"/>
    <a n="zimbraPrefOutOfOfficeReply"/>
    <a n="zimbraPrefShowSearchString"/>
    <a n="zimbraPrefMailSignatureStyle"/>
    <a n="zimbraPrefUseTimeZoneListInCalendar"/>
    <a n="zimbraPrefImapSearchFoldersEnabled"/>
    <a n="zimbraPrefMailForwardingAddress"/>
    <a n="zimbraPrefMailLocalDeliveryDisabled"/>
    <a n="zimbraPrefCalendarApptReminderWarningTime"/>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraPrefGalAutoCompleteEnabled"/>
    <a n="zimbraPrefWarnOnExit"/>
    <a n="zimbraPrefShowSelectionCheckbox"/>
    <a n="zimbraPrefHtmlEditorDefaultFontSize"/>
    <a n="zimbraPrefHtmlEditorDefaultFontFamily"/>
    <a n="zimbraPrefHtmlEditorDefaultFontColor"/>
    <a n="zimbraMailSignatureMaxLength"/>
    <a n="zimbraPrefDisplayExternalImages" />
    <a n="zimbraPrefOutOfOfficeCacheDuration"/>
    <a n="zimbraPrefMailDefaultCharset"/>
    <a n="zimbraPrefLocale"/>
    <a n="zimbraJunkMessagesIndexingEnabled"/>
    <a n="zimbraPrefMailSendReadReceipts"/>
    <a n="zimbraPrefReadReceiptsToAddress"/>
    <a n="zimbraPrefAdminConsoleWarnOnExit" />
    <a n="zimbraPrefMandatorySpellCheckEnabled"/>
  </attrs>
</right>
<right name="adminConsoleAccountsPreferencesTabRights" type="combo">
  <desc> Admin Console rights for Accounts Preferences Tab </desc>
  <ui name="Manage-Accounts-Account-Preferences"/>
  <rights>
    <r n="setAdminConsoleAccountsPreferencesTab"/>
    <r n="viewAdminConsoleAccountsPreferencesTab"/>
  </rights>
</right>

<!-- Admin Console Accounts FreeBusyInterop Tab -->
<right name="setAdminConsoleAccountsFreeBusyInteropTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts FreeBusyInterop Tab </desc>
  <ui name="Manage-Accounts-Account-FreeBusyInterop(modify)"/>
  <attrs>
    <a n="zimbraForeignPrincipal"/>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsFreeBusyInteropTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts FreeBusyInterop Tab </desc>
  <ui name="Manage-Accounts-Account-FreeBusyInterop(view)"/>
  <attrs>
    <a n="zimbraForeignPrincipal"/>
  </attrs>
</right>
<right name="adminConsoleAccountsFreeBusyInteropTabRights" type="combo">
  <desc> Admin Console rights for Accounts FreeBusyInterop Tab </desc>
  <ui name="Manage-Accounts-Account-FreeBusyInterop"/>
  <rights>
    <r n="setAdminConsoleAccountsFreeBusyInteropTab"/>
    <r n="viewAdminConsoleAccountsFreeBusyInteropTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Themes Tab -->
<right name="setAdminConsoleAccountsThemesTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Themes Tab </desc>
  <ui name="Manage-Accounts-Account-Themes(modify)"/>
  <attrs>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraAvailableSkin"/>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsThemesTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Themes Tab </desc>
  <ui name="Manage-Accounts-Account-Themes(view)"/>
  <attrs>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraAvailableSkin"/>
  </attrs>
</right>
<right name="adminConsoleAccountsThemesTabRights" type="combo">
  <desc> Admin Console rights for Accounts Themes Tab </desc>
  <ui name="Manage-Accounts-Account-Themes"/>
  <rights>
    <r n="setAdminConsoleAccountsThemesTab"/>
    <r n="viewAdminConsoleAccountsThemesTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Zimlets Tab -->
<right name="setAdminConsoleAccountsZimletsTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Zimlets Tab </desc>
  <ui name="Manage-Accounts-Account-Zimlets(modify)"/>
  <attrs>
    <a n="zimbraZimletAvailableZimlets"/>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsZimletsTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Zimlets Tab </desc>
  <ui name="Manage-Accounts-Account-Zimlets(view)"/>
  <attrs>
    <a n="zimbraZimletAvailableZimlets"/>
  </attrs>
</right>
<right name="adminConsoleAccountsZimletsTabRights" type="combo">
  <desc> Admin Console rights for Accounts Zimlets Tab </desc>
  <ui name="Manage-Accounts-Account-Zimlets"/>
  <rights>
    <r n="setAdminConsoleAccountsZimletsTab"/>
    <r n="viewAdminConsoleAccountsZimletsTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Advanced Tab -->
<!-- syntax or bad attr somewhere in the advanced tab config --> 
<!-- <right name="setAdminConsoleAccountsAdvancedTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Advanced Tab </desc>
  <attrs>
    <a n="zimbraAttachmentsBlocked"\>
    <a n="zimbraMailQuota"\>
    <a n="zimbraContactMaxNumEntries"\>
    <a n="zimbraQuotaWarnPercent"\>
    <a n="zimbraQuotaWarnInterval"\>
    <a n="zimbraQuotaWarnMessage"\>
    <a n="zimbraPasswordLocked"\>
    <a n="zimbraPasswordMinLength"\>
    <a n="zimbraPasswordMaxLength"\>
    <a n="zimbraPasswordMinUpperCaseChars"\>
    <a n="zimbraPasswordMinLowerCaseChars"\>
    <a n="zimbraPasswordMinPunctuationChars"\>
    <a n="zimbraPasswordMinNumericChars"\>
    <a n="zimbraPasswordMinAge"\>
    <a n="zimbraPasswordMaxAge"\>
    <a n="zimbraPasswordEnforceHistory"\>
    <a n="zimbraPasswordLockoutEnabled"\>
    <a n="zimbraPasswordLockoutMaxFailures"\>
    <a n="zimbraPasswordLockoutDuration"\>
    <a n="zimbraPasswordLockoutFailureLifetime"\>
    <a n="zimbraAdminAuthTokenLifetime"\>
    <a n="zimbraAuthTokenLifetime"\>
    <a n="zimbraMailIdleSessionTimeout"\>
    <a n="zimbraMailMessageLifetime"\>
    <a n="zimbraMailTrashLifetime"\>
    <a n="zimbraMailSpamLifetime"\>
    <a n="zimbraFreebusyExchangeUserOrg"\>
  </attrs>
</right>
<right name="viewAdminConsoleAccountsAdvancedTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Advanced Tab </desc>
  <attrs>
    <a n="zimbraAttachmentsBlocked"\>
    <a n="zimbraMailQuota"\>
    <a n="zimbraContactMaxNumEntries"\>
    <a n="zimbraQuotaWarnPercent"\>
    <a n="zimbraQuotaWarnInterval"\>
    <a n="zimbraQuotaWarnMessage"\>
    <a n="zimbraPasswordLocked"\>
    <a n="zimbraPasswordMinLength"\>
    <a n="zimbraPasswordMaxLength"\>
    <a n="zimbraPasswordMinUpperCaseChars"\>
    <a n="zimbraPasswordMinLowerCaseChars"\>
    <a n="zimbraPasswordMinPunctuationChars"\>
    <a n="zimbraPasswordMinNumericChars"\>
    <a n="zimbraPasswordMinAge"\>
    <a n="zimbraPasswordMaxAge"\>
    <a n="zimbraPasswordEnforceHistory"\>
    <a n="zimbraPasswordLockoutEnabled"\>
    <a n="zimbraPasswordLockoutMaxFailures"\>
    <a n="zimbraPasswordLockoutDuration"\>
    <a n="zimbraPasswordLockoutFailureLifetime"\>
    <a n="zimbraAdminAuthTokenLifetime"\>
    <a n="zimbraAuthTokenLifetime"\>
    <a n="zimbraMailIdleSessionTimeout"\>
    <a n="zimbraMailMessageLifetime"\>
    <a n="zimbraMailTrashLifetime"\>
    <a n="zimbraMailSpamLifetime"\>
    <a n="zimbraFreebusyExchangeUserOrg"\>
  </attrs>
</right>
<right name="adminConsoleAccountsAdvancedTabRights" type="combo">
  <desc> Admin Console rights for Accounts Advanced Tab </desc>
  <rights>
    <r n="setAdminConsoleAccountsAdvancedTab"/>
    <r n="viewAdminConsoleAccountsAdvancedTab"/>
  </rights>
</right> -->

<!-- Admin Console Accounts Zimbra Mobile Tab -->
<!-- Admin Console Accounts ACL Tab -->
  <right name="setAdminConsoleAccountsACLTab" type="setAttrs" targetType="account">
    <desc> Admin Console set attr rights for Account ACL Tab </desc>
    <ui name="Manage-Accounts-Account-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleAccountsACLTab" type="getAttrs" targetType="account">
    <desc> Admin Console view attr rights for Account ACL Tab </desc>
    <ui name="Manage-Accounts-Account-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleAccountsACLTabRights" type="combo">
    <desc> Admin Console rights for Account ACL Tab </desc>
    <ui name="Manage-Accounts-Account-ACL"/>
    <rights>
      <r n="setAdminConsoleAccountsACLTab"/>
      <r n="viewAdminConsoleAccountsACLTab"/>
    </rights>
  </right>
<!-- Admin Console Accounts Admin Views Tab -->

<!--
  =======================================================
    Admin Console Alias List View
  =======================================================
-->
<!-- nothing to do here -->

<!--
  =======================================================
    Admin Console Distribution List List View
  =======================================================
-->
<!-- Admin Console DL Members Tab -->
<right name="setAdminConsoleDLMembersTab" type="setAttrs" targetType="dl">
  <desc> Admin Console set attr rights for DL Members Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Members(modify)"/>
  <attrs>
    <a n="cn"/>
    <a n="displayName"/>
    <a n="description"/>
    <a n="zimbraIsAdminGroup"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
  </attrs>
</right>
<right name="viewAdminConsoleDLMembersTab" type="getAttrs" targetType="dl">
  <desc> Admin Console view attr rights for DL Members Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Members(view)"/>
  <attrs>
    <a n="cn"/>
    <a n="displayName"/>
    <a n="description"/>
    <a n="mail"/>
    <a n="uid"/>
    <a n="zimbraId"/>
    <a n="zimbraIsAdminGroup"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraMailForwardingAddress"/>
  </attrs>
</right>
<right name="adminConsoleDLMembersTabRights" type="combo">
  <desc> Admin Console rights for DL Members Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Members"/>
  <rights>
    <r n="setAdminConsoleDLMembersTab"/>
    <r n="viewAdminConsoleDLMembersTab"/>
    <r n="renameDistributionList"/>
    <r n="createDistributionList"/>
    <r n="deleteDistributionList"/>
    <r n="addDistributionListMember"/>
    <r n="removeDistributionListMember"/>
    <r n="addDistributionListAlias"/>
    <r n="removeDistributionListAlias"/>
  </rights>
</right>

<!-- Admin Console DL Notes Tab -->
<right name="setAdminConsoleDLNotesTab" type="setAttrs" targetType="dl">
  <desc> Admin Console set attr rights for DL Notes Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Notes(modify)"/>
  <attrs>
    <a n="zimbraNotes"/>
  </attrs>
</right>
<right name="viewAdminConsoleDLNotesTab" type="getAttrs" targetType="dl">
  <desc> Admin Console view attr rights for DL Notes Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Notes(view)"/>
  <attrs>
    <a n="zimbraNotes"/>
  </attrs>
</right>
<right name="adminConsoleDLNotesTabRights" type="combo">
  <desc> Admin Console rights for DL Notes Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Notes"/>
  <rights>
    <r n="setAdminConsoleDLNotesTab"/>
    <r n="viewAdminConsoleDLNotesTab"/>
  </rights>
</right>

<!-- Admin Console DL MemberOf Tab -->
<right name="adminConsoleDLMemberOfTabRights" type="combo">
  <desc> Admin Console rights for DL MemberOf Tab </desc>
  <rights>
    <r n="getDistributionListMembership"/>
  </rights>
</right>

<!-- Admin Console DL Aliases Tab -->
<right name="setAdminConsoleDLAliasesTab" type="setAttrs" targetType="dl">
  <desc> Admin Console set attr rights for DL Aliases Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Aliases(modify)"/>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="viewAdminConsoleDLAliasesTab" type="getAttrs" targetType="dl">
  <desc> Admin Console view attr rights for DL Aliases Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Aliases(view)"/>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="adminConsoleDLAliasesTabRights" type="combo">
  <desc> Admin Console rights for DL Aliases Tab </desc>
  <ui name="Manage-DistributionLists-DistributionList-Aliases"/>
  <rights>
    <r n="setAdminConsoleDLAliasesTab"/>
    <r n="viewAdminConsoleDLAliasesTab"/>
    <r n="createAlias"/>
    <r n="deleteAlias"/>
    <r n="addDistributionListAlias"/>
    <r n="removeDistributionListAlias"/>
  </rights>
</right>

<!-- Admin Console DL Shares Tab -->
<right name="setAdminConsoleDLSharesTab" type="setAttrs" targetType="dl">
  <desc> Admin Console set attr rights for DL Shares Tab </desc>
  <attrs>
    <a n="zimbraDistributionListSendShareMessageToNewMembers"/>
    <a n="zimbraDistributionListSendShareMessageFromAddress"/>
  </attrs>
</right>
<right name="viewAdminConsoleDLSharesTab" type="getAttrs" targetType="dl">
  <desc> Admin Console view attr rights for DL Shares Tab </desc>
  <attrs>
    <a n="zimbraDistributionListSendShareMessageToNewMembers"/>
    <a n="zimbraDistributionListSendShareMessageFromAddress"/>
  </attrs>
</right>
<right name="adminConsoleDLSharesTabRights" type="combo">
  <desc> Admin Console rights for DL Shares Tab </desc>
  <rights>
    <r n="setAdminConsoleDLSharesTab"/>
    <r n="viewAdminConsoleDLSharesTab"/>
  </rights>
</right>
<!-- Admin Console DL ACL Tab -->
  <right name="setAdminConsoleDLACLTab" type="setAttrs" targetType="dl">
    <desc> Admin Console set attr rights for DL ACL Tab </desc>
    <ui name="Manage-DistributionLists-DistributionList-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDLACLTab" type="getAttrs" targetType="dl">
    <desc> Admin Console view attr rights for DL ACL Tab </desc>
    <ui name="Manage-DistributionLists-DistributionList-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleDLACLTabRights" type="combo">
    <desc> Admin Console rights for DL ACL Tab </desc>
    <ui name="Manage-DistributionLists-DistributionList-ACL"/>
    <rights>
      <r n="setAdminConsoleDLACLTab"/>
      <r n="viewAdminConsoleDLACLTab"/>
    </rights>
  </right>
<!-- Admin Console DL Admin View Tab -->


<!--
  =======================================================
    Admin Console Resource List View
  =======================================================
-->
<!-- Admin Console Resources Properties Tab -->
<right name="setAdminConsoleResourcesPropertiesTab" type="setAttrs" targetType="calresource">
  <desc> Admin Console set attr rights for Resources Properties Tab </desc>
  <ui name="Manage-Resources-Resource-Properties(modify)"/>
  <attrs>
    <a n="displayName"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
    <a n="cn"/>
    <a n="mail"/>
    <a n="uid"/>
    <a n="zimbraAccountStatus"/>
    <a n="zimbraAccountCalendarUserType"/>
    <a n="zimbraCalResType"/>
    <a n="zimbraCalResAutoAcceptDecline"/>
    <a n="zimbraCalResAutoDeclineIfBusy"/>
    <a n="zimbraCalResAutoDeclineRecurring"/>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="zimbraLocale"/>
    <a n="zimbraCalResMaxNumConflictsAllowed"/>
    <a n="zimbraCalResMaxPercentConflictsAllowed"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
  </attrs>
</right>
<right name="viewAdminConsoleResourcesPropertiesTab" type="getAttrs" targetType="calresource">
  <desc> Admin Console view attr rights for Resources Properties Tab </desc>
  <ui name="Manage-Resources-Resource-Properties(view)"/>
  <attrs>
    <a n="displayName"/>
    <a n="zimbraId"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="cn"/>
    <a n="uid"/>
    <!-- <a n="zimbraCOSId"/> -->
    <a n="zimbraAccountStatus"/>
    <a n="zimbraAccountCalendarUserType"/>
    <a n="zimbraCalResType"/>
    <a n="zimbraCalResAutoAcceptDecline"/>
    <a n="zimbraCalResAutoDeclineIfBusy"/>
    <a n="zimbraCalResAutoDeclineRecurring"/>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="zimbraLocale"/>
    <a n="zimbraCreateTimestamp"/>
    <a n="zimbraCalResMaxNumConflictsAllowed"/>
    <a n="zimbraCalResMaxPercentConflictsAllowed"/>
  </attrs>
</right>
<right name="adminConsoleResourcesPropertiesTabRights" type="combo">
  <desc> Admin Console rights for Resources Properties Tab </desc>
  <ui name="Manage-Resources-Resource-Properties"/>
  <rights>
    <r n="setAdminConsoleResourcesPropertiesTab"/>
    <r n="viewAdminConsoleResourcesPropertiesTab"/>
    <r n="addCalendarResourceAlias"/>
    <r n="removeCalendarResourceAlias"/>
    <r n="getCalendarResourceInfo"/>
    <r n="createCalendarResource"/>
    <r n="renameCalendarResource"/>
    <r n="deleteCalendarResource"/>
    <r n="setCalendarResourcePassword"/>
  </rights>
</right>
<!-- Admin Console Resources Location/Contact Tab -->
<right name="setAdminConsoleResourcesContactTab" type="setAttrs" targetType="calresource">
  <desc> Admin Console set attr rights for Resources Contact Tab </desc>
  <ui name="Manage-Resources-Resource-LocationAndContactInfo(modify)"/>
  <attrs>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="telephoneNumber"/>
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
  </attrs>
</right>
<right name="viewAdminConsoleResourcesContactTab" type="getAttrs" targetType="calresource">
  <desc> Console view attr rights for Resources Contact Tab </desc>
  <ui name="Manage-Resources-Resource-LocationAndContactInfo(view)"/>
  <attrs>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="telephoneNumber"/>
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
  </attrs>
</right>
<right name="adminConsoleResourcesContactTabRights" type="combo">
  <desc> Admin Console rights for Resources Contact Tab </desc>
  <ui name="Manage-Resources-Resource-LocationAndContactInfo"/>
  <rights>
    <r n="setAdminConsoleResourcesContactTab"/>
    <r n="viewAdminConsoleResourcesContactTab"/>
  </rights>
</right>
<!--
  =======================================================
    Admin Console Configuration Section
  =======================================================
-->
<!-- Admin Console Class of Service COS -->
  <!-- Admin Console General Info Tab -->
  <right name="viewAdminConsoleCOSInfoTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS General Info Tab </desc>
    <ui name="Configure-COSes-COS-GeneralInfo(view)"/>
    <attrs>
      <a n="cn"/>
      <a n="description"/>
      <a n="zimbraNotes"/>
    </attrs>
  </right>
  <right name="setAdminConsoleCOSInfoTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS General Info Tab </desc>
    <ui name="Configure-COSes-COS-GeneralInfo(modify)"/>
    <attrs>
      <a n="cn"/>
      <a n="description"/>
      <a n="zimbraNotes"/>
    </attrs>
  </right>
  <right name="adminConsoleCOSInfoTabRights" type="combo">
    <desc> Admin Console rights for COS General Info Tab </desc>
    <ui name="Configure-COSes-COS-GeneralInfo"/>
    <rights>
      <r n="setAdminConsoleCOSInfoTab"/>
      <r n="viewAdminConsoleCOSInfoTab"/>
    </rights>
  </right>

  <!-- Admin Console Features Tab -->
  <right name="viewAdminConsoleCOSFeaturesTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS General Features Tab </desc>
    <ui name="Configure-COSes-COS-Features(view)"/>
    <attrs>
      <!-- Major Features -->
      <a n="zimbraFeatureMailEnabled"/>
      <a n="zimbraFeatureContactsEnabled"/>
      <a n="zimbraFeatureCalendarEnabled"/>
      <a n="zimbraFeatureTasksEnabled"/>
      <a n="zimbraFeatureNotebookEnabled"/>
      <a n="zimbraFeatureBriefcasesEnabled"/>
      <a n="zimbraFeatureIMEnabled"/>
      <a n="zimbraFeatureOptionsEnabled"/>
      <!-- General Features -->
      <a n="zimbraFeatureTaggingEnabled"/>
      <a n="zimbraFeatureSharingEnabled"/>
      <a n="zimbraFeatureChangePasswordEnabled"/>
      <a n="zimbraFeatureSkinChangeEnabled"/>
      <a n="zimbraFeatureHtmlComposeEnabled"/>
      <a n="zimbraFeatureShortcutAliasesEnabled"/>
      <a n="zimbraFeatureGalEnabled"/>
      <a n="zimbraFeatureGalAutoCompleteEnabled"/>
      <!-- Mail Features -->
      <a n="zimbraFeatureMailPriorityEnabled"/>
      <a n="zimbraFeatureFlaggingEnabled"/>
      <a n="zimbraPop3Enabled"/>
      <a n="zimbraImapEnabled"/>
      <a n="zimbraFeaturePop3DataSourceEnabled"/>
      <a n="zimbraFeatureImapDataSourceEnabled"/>
      <a n="zimbraFeatureMailForwardingEnabled"/>
      <a n="zimbraFeatureConversationsEnabled"/>
      <a n="zimbraFeatureFiltersEnabled"/>
      <a n="zimbraFeatureOutOfOfficeReplyEnabled"/>
      <a n="zimbraFeatureNewMailNotificationEnabled"/>
      <!-- deprecated PollingInterval -->
      <a n="zimbraFeatureMailPollingIntervalPreferenceEnabled"/>
      <a n="zimbraFeatureIdentitiesEnabled"/>
      <a n="zimbraFeatureReadReceiptsEnabled"/>
      <!-- Calendar Features -->
      <a n="zimbraFeatureGroupCalendarEnabled"/>
      <!-- IM Features -->
      <a n="zimbraFeatureInstantNotify"/>
      <!-- Search Features -->
      <a n="zimbraFeatureAdvancedSearchEnabled"/>
      <a n="zimbraFeatureSavedSearchesEnabled"/>
      <a n="zimbraFeatureInitialSearchPreferenceEnabled"/>
      <!-- Unexposed features -->
      <!-- <a n="zimbraFeatureViewInHtmlEnabled"/>
      <a n="zimbraFeatureMobileSyncEnabled"/>
      <a n="zimbraFeatureVoiceEnabled"/>
      <a n="zimbraFeaturePortalEnabled"/>
      <a n="zimbraFeatureSignaturesEnabled"/>
      <a n="zimbraFeatureMailUpsellEnabled"/>
      <a n="zimbraFeatureMailUpsellURL"/>
      <a n="zimbraFeatureContactsUpsellEnabled"/>
      <a n="zimbraFeatureContactsUpsellURL"/>
      <a n="zimbraFeatureCalendarUpsellEnabled"/>
      <a n="zimbraFeatureCalendarUpsellURL"/>
      <a n="zimbraFeatureVoiceUpsellEnabled"/>
      <a n="zimbraFeatureVoiceUpsellURL"/>
      <a n="zimbraFeatureZimbraAssistantEnabled"/>
      <a n="zimbraFeatureComposeInNewWindowEnabled"/>
      <a n="zimbraFeatureOpenMailInNewWindowEnabled"/>
      <a n="zimbraFeatureWebSearchEnabled"/>
      <a n="zimbraFeatureNewAddrBookEnabled"/>
      <a n="zimbraFeatureMailForwardingInFiltersEnabled"/>
      <a n="zimbraFeatureGalSyncEnabled"/>
      <a n="zimbraFeatureImportExportFolderEnabled"/>
      <a n="zimbraFeatureDiscardInFiltersEnabled"/>
      <a n="zimbraFeatureConfirmationPageEnabled"/>
      <a n="zimbraFeatureMobilePolicyEnabled"/> -->
    </attrs>
  </right>
  <right name="setAdminConsoleCOSFeaturesTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS General Features Tab </desc>
    <ui name="Configure-COSes-COS-Features(modify)"/>
    <attrs>
      <!-- Major Features -->
      <a n="zimbraFeatureMailEnabled"/>
      <a n="zimbraFeatureContactsEnabled"/>
      <a n="zimbraFeatureCalendarEnabled"/>
      <a n="zimbraFeatureTasksEnabled"/>
      <a n="zimbraFeatureNotebookEnabled"/>
      <a n="zimbraFeatureBriefcasesEnabled"/>
      <a n="zimbraFeatureIMEnabled"/>
      <a n="zimbraFeatureOptionsEnabled"/>
      <!-- General Features -->
      <a n="zimbraFeatureTaggingEnabled"/>
      <a n="zimbraFeatureSharingEnabled"/>
      <a n="zimbraFeatureChangePasswordEnabled"/>
      <a n="zimbraFeatureSkinChangeEnabled"/>
      <a n="zimbraFeatureHtmlComposeEnabled"/>
      <a n="zimbraFeatureShortcutAliasesEnabled"/>
      <a n="zimbraFeatureGalEnabled"/>
      <a n="zimbraFeatureGalAutoCompleteEnabled"/>
      <!-- Mail Features -->
      <a n="zimbraFeatureMailPriorityEnabled"/>
      <a n="zimbraFeatureFlaggingEnabled"/>
      <a n="zimbraPop3Enabled"/>
      <a n="zimbraImapEnabled"/>
      <a n="zimbraFeaturePop3DataSourceEnabled"/>
      <a n="zimbraFeatureImapDataSourceEnabled"/>
      <a n="zimbraFeatureMailForwardingEnabled"/>
      <a n="zimbraFeatureConversationsEnabled"/>
      <a n="zimbraFeatureFiltersEnabled"/>
      <a n="zimbraFeatureOutOfOfficeReplyEnabled"/>
      <a n="zimbraFeatureNewMailNotificationEnabled"/>
      <!-- deprecated PollingInterval -->
      <a n="zimbraFeatureMailPollingIntervalPreferenceEnabled"/> 
      <a n="zimbraFeatureIdentitiesEnabled"/>
      <a n="zimbraFeatureReadReceiptsEnabled"/>
      <!-- Calendar Features -->
      <a n="zimbraFeatureGroupCalendarEnabled"/>
      <!-- IM Features -->
      <a n="zimbraFeatureInstantNotify"/>
      <!-- Search Features -->
      <a n="zimbraFeatureAdvancedSearchEnabled"/>
      <a n="zimbraFeatureSavedSearchesEnabled"/>
      <a n="zimbraFeatureInitialSearchPreferenceEnabled"/>
      <!-- Unexposed features -->
      <!-- <a n="zimbraFeatureViewInHtmlEnabled"/>
      <a n="zimbraFeatureMobileSyncEnabled"/>
      <a n="zimbraFeatureVoiceEnabled"/>
      <a n="zimbraFeaturePortalEnabled"/>
      <a n="zimbraFeatureSignaturesEnabled"/>
      <a n="zimbraFeatureMailUpsellEnabled"/>
      <a n="zimbraFeatureMailUpsellURL"/>
      <a n="zimbraFeatureContactsUpsellEnabled"/>
      <a n="zimbraFeatureContactsUpsellURL"/>
      <a n="zimbraFeatureCalendarUpsellEnabled"/>
      <a n="zimbraFeatureCalendarUpsellURL"/>
      <a n="zimbraFeatureVoiceUpsellEnabled"/>
      <a n="zimbraFeatureVoiceUpsellURL"/>
      <a n="zimbraFeatureZimbraAssistantEnabled"/>
      <a n="zimbraFeatureComposeInNewWindowEnabled"/>
      <a n="zimbraFeatureOpenMailInNewWindowEnabled"/>
      <a n="zimbraFeatureWebSearchEnabled"/>
      <a n="zimbraFeatureNewAddrBookEnabled"/>
      <a n="zimbraFeatureMailForwardingInFiltersEnabled"/>
      <a n="zimbraFeatureGalSyncEnabled"/>
      <a n="zimbraFeatureImportExportFolderEnabled"/>
      <a n="zimbraFeatureDiscardInFiltersEnabled"/>
      <a n="zimbraFeatureConfirmationPageEnabled"/>
      <a n="zimbraFeatureMobilePolicyEnabled"/> -->
    </attrs>
  </right>
  <right name="adminConsoleCOSFeaturesTabRights" type="combo">
    <desc> Admin Console rights for COS General Features Tab </desc>
    <ui name="Configure-COSes-COS-Features"/>
    <rights>
      <r n="setAdminConsoleCOSFeaturesTab"/>
      <r n="viewAdminConsoleCOSFeaturesTab"/>
    </rights>
  </right>

  <!-- Admin Console Preferences Tab -->
  <right name="viewAdminConsoleCOSPreferencesTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS General Preferences Tab </desc>
    <ui name="Configure-COSes-COS-Preferences(view)"/>
    <attrs>
      <!-- General Options -->
      <a n="zimbraPrefClientType"/>
      <a n="zimbraPrefShowSearchString"/>
      <a n="zimbraPrefMailInitialSearch"/>
      <a n="zimbraPrefImapSearchFoldersEnabled"/>
      <!-- <a n="zimbraPrefShortcuts"/> -->
      <a n="zimbraPrefUseKeyboardShortcuts"/>
      <a n="zimbraPrefWarnOnExit"/>
      <a n="zimbraPrefShowSelectionCheckbox"/>
      <a n="zimbraPrefIMAutoLogin"/>
      <a n="zimbraJunkMessagesIndexingEnabled"/>
      <a n="zimbraPrefLocale"/>
      <!-- Mail Options -->
      <a n="zimbraPrefMessageViewHtmlPreferred"/>
      <a n="zimbraPrefDisplayExternalImages"/>
      <a n="zimbraPrefGroupMailBy"/>
      <a n="zimbraPrefMailItemsPerPage"/>
      <a n="zimbraPrefMailDefaultCharset"/>
      <!-- deprecated PollingInterval -->
      <!-- should these be wrapped in -->
      <!-- zimbraFeatureMailPollingIntervalPreferenceEnabled -->
      <a n="zimbraPrefMailPollingInterval"/>
      <a n="zimbraMailMinPollingInterval"/>
      <a n="zimbraPrefOutOfOfficeCacheDuration"/>
      <a n="zimbraPrefMailSendReadReceipts"/>
      <a n="zimbraPrefSaveToSent"/>
      <a n="zimbraAllowAnyFromAddress"/>
      <a n="zimbraPrefComposeInNewWindow"/>
      <a n="zimbraPrefComposeFormat"/>
      <a n="zimbraPrefHtmlEditorDefaultFontFamily"/>
      <a n="zimbraPrefHtmlEditorDefaultFontSize"/>
      <a n="zimbraPrefHtmlEditorDefaultFontColor"/>
      <a n="zimbraPrefForwardReplyInOriginalFormat"/>
      <a n="zimbraPrefMailSignatureStyle"/> <!-- ? Deprecated? -->
      <a n="zimbraMailSignatureMaxLength"/>
      <!-- <a n="zimbraPrefNewMailNotificationEnabled"/> -->
      <!-- <a n="zimbraPrefNewMailNotificationAddress"/> -->
      <!-- Address Book Options -->
      <a n="zimbraPrefAutoAddAddressEnabled"/>
      <a n="zimbraPrefGalAutoCompleteEnabled"/>
      <a n="zimbraPrefContactsPerPage"/>
      <!-- <a n="zimbraPrefContactsInitialView"/> -->
      <!-- Calendar Options -->
      <a n="zimbraPrefTimeZoneId"/>
      <a n="zimbraPrefCalendarApptReminderWarningTime"/>
      <a n="zimbraPrefCalendarAlwaysShowMiniCal"/>
      <a n="zimbraPrefCalendarUseQuickAdd"/>
      <a n="zimbraPrefUseTimeZoneListInCalendar"/>
      <!-- <a n="zimbraPrefCalendarInitialView"/> -->
      <!-- <a n="zimbraPrefCalendarFirstDayOfWeek"/> -->
      <!-- <a n="zimbraPrefCalendarNotifyDelegatedChanges"/> -->
      <!-- <a n="zimbraPrefCalendarInitialCheckedCalendars"/> -->
      <!-- <a n="zimbraPrefCalendarReminderDuration1"/> -->
      <!-- <a n="zimbraPrefCalendarReminderDuration2"/> -->
      <!-- <a n="zimbraPrefCalendarReminderEmail"/> -->
      <!-- <a n="zimbraPrefCalendarReminderSendEmail"/> -->
      <!-- <a n="zimbraPrefCalendarReminderMobile"/> -->
      <!-- <a n="zimbraPrefCalendarReminderYMessenger"/> -->
      <!-- <a n="zimbraPrefCalendarApptVisibility"/> -->
      <!-- <a n="zimbraPrefCalendarAutoAddInvites"/> -->
      <!-- <a n="zimbraPrefCalendarSendInviteDeniedAutoReply"/> -->
      <!-- <a n="zimbraPrefCalendarForwardInvitesTo"/> -->
      <!-- <a n="zimbraPrefCalendarDayHourStart"/> -->
      <!-- <a n="zimbraPrefCalendarDayHourEnd"/> -->
      <!-- <a n="zimbraPrefCalendarReminderSoundsEnabled"/> -->
      <!-- <a n="zimbraPrefCalendarReminderFlashTitle"/> -->
      <!-- <a n="zimbraPrefCalendarAllowForwardedInvite"/> -->
      <!-- <a n="zimbraPrefCalendarAllowPublishMethodInvite"/> -->
      <!-- <a n="zimbraPrefCalendarAllowCancelEmailToSelf"/> -->
      <!-- <a n="zimbraPrefCalendarToasterEnabled"/> -->
      <!-- <a n="zimbraPrefCalendarShowPastDueReminders"/> -->
      <!-- <a n="zimbraPrefAppleIcalDelegationEnabled"/> -->
    </attrs>
  </right>
  <right name="setAdminConsoleCOSPreferencesTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS General Preferences Tab </desc>
    <ui name="Configure-COSes-COS-Preferences(modify)"/>
    <attrs>
      <!-- General Options -->
      <a n="zimbraPrefClientType"/>
      <a n="zimbraPrefShowSearchString"/>
      <a n="zimbraPrefMailInitialSearch"/>
      <a n="zimbraPrefImapSearchFoldersEnabled"/>
      <!-- <a n="zimbraPrefShortcuts"/> -->
      <a n="zimbraPrefUseKeyboardShortcuts"/>
      <a n="zimbraPrefWarnOnExit"/>
      <a n="zimbraPrefShowSelectionCheckbox"/>
      <a n="zimbraPrefIMAutoLogin"/>
      <a n="zimbraJunkMessagesIndexingEnabled"/>
      <a n="zimbraPrefLocale"/>
      <!-- Mail Options -->
      <a n="zimbraPrefMessageViewHtmlPreferred"/>
      <a n="zimbraPrefDisplayExternalImages"/>
      <a n="zimbraPrefGroupMailBy"/>
      <a n="zimbraPrefMailItemsPerPage"/>
      <a n="zimbraPrefMailDefaultCharset"/>
      <!-- should these be wrapped in zimbraFeatureMailPollingIntervalPreferenceEnabled -->
      <a n="zimbraPrefMailPollingInterval"/>
      <a n="zimbraMailMinPollingInterval"/>
      <a n="zimbraPrefOutOfOfficeCacheDuration"/>
      <a n="zimbraPrefMailSendReadReceipts"/>
      <a n="zimbraPrefSaveToSent"/>
      <a n="zimbraAllowAnyFromAddress"/>
      <a n="zimbraPrefComposeInNewWindow"/>
      <a n="zimbraPrefComposeFormat"/>
      <a n="zimbraPrefHtmlEditorDefaultFontFamily"/>
      <a n="zimbraPrefHtmlEditorDefaultFontSize"/>
      <a n="zimbraPrefHtmlEditorDefaultFontColor"/>
      <a n="zimbraPrefForwardReplyInOriginalFormat"/>
      <a n="zimbraPrefMailSignatureStyle"/> <!-- ? Deprecated? -->
      <a n="zimbraMailSignatureMaxLength"/>
      <!-- <a n="zimbraPrefNewMailNotificationEnabled"/> -->
      <!-- <a n="zimbraPrefNewMailNotificationAddress"/> -->
      <!-- Address Book Options -->
      <a n="zimbraPrefAutoAddAddressEnabled"/>
      <a n="zimbraPrefGalAutoCompleteEnabled"/>
      <a n="zimbraPrefContactsPerPage"/>
      <!-- <a n="zimbraPrefContactsInitialView"/> -->
      <!-- Calendar Options -->
      <a n="zimbraPrefTimeZoneId"/>
      <a n="zimbraPrefCalendarApptReminderWarningTime"/>
      <a n="zimbraPrefCalendarAlwaysShowMiniCal"/>
      <a n="zimbraPrefCalendarUseQuickAdd"/>
      <a n="zimbraPrefUseTimeZoneListInCalendar"/>
      <!-- <a n="zimbraPrefCalendarInitialView"/> -->
      <!-- <a n="zimbraPrefCalendarFirstDayOfWeek"/> -->
      <!-- <a n="zimbraPrefCalendarNotifyDelegatedChanges"/> -->
      <!-- <a n="zimbraPrefCalendarInitialCheckedCalendars"/> -->
      <!-- <a n="zimbraPrefCalendarReminderDuration1"/> -->
      <!-- <a n="zimbraPrefCalendarReminderDuration2"/> -->
      <!-- <a n="zimbraPrefCalendarReminderEmail"/> -->
      <!-- <a n="zimbraPrefCalendarReminderSendEmail"/> -->
      <!-- <a n="zimbraPrefCalendarReminderMobile"/> -->
      <!-- <a n="zimbraPrefCalendarReminderYMessenger"/> -->
      <!-- <a n="zimbraPrefCalendarApptVisibility"/> -->
      <!-- <a n="zimbraPrefCalendarAutoAddInvites"/> -->
      <!-- <a n="zimbraPrefCalendarSendInviteDeniedAutoReply"/> -->
      <!-- <a n="zimbraPrefCalendarForwardInvitesTo"/> -->
      <!-- <a n="zimbraPrefCalendarDayHourStart"/> -->
      <!-- <a n="zimbraPrefCalendarDayHourEnd"/> -->
      <!-- <a n="zimbraPrefCalendarReminderSoundsEnabled"/> -->
      <!-- <a n="zimbraPrefCalendarReminderFlashTitle"/> -->
      <!-- <a n="zimbraPrefCalendarAllowForwardedInvite"/> -->
      <!-- <a n="zimbraPrefCalendarAllowPublishMethodInvite"/> -->
      <!-- <a n="zimbraPrefCalendarAllowCancelEmailToSelf"/> -->
      <!-- <a n="zimbraPrefCalendarToasterEnabled"/> -->
      <!-- <a n="zimbraPrefCalendarShowPastDueReminders"/> -->
      <!-- <a n="zimbraPrefAppleIcalDelegationEnabled"/> -->
    </attrs>
  </right>
  <right name="adminConsoleCOSPreferencesTabRights" type="combo">
    <desc> Admin Console rights for COS General Preferences Tab </desc>
    <ui name="Configure-COSes-COS-Preferences"/>
    <rights>
      <r n="setAdminConsoleCOSPreferencesTab"/>
      <r n="viewAdminConsoleCOSPreferencesTab"/>
    </rights>
  </right>
  <!-- Admin Console Themes Tab -->
  <right name="viewAdminConsoleCOSThemesTab" type="setAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS Themes Tab </desc>
    <ui name="Configure-COSes-COS-Themes(view)"/>
    <attrs>
      <a n="zimbraPrefSkin"/>
      <a n="zimbraAvailableSkin"/>
    </attrs>
  </right>
  <right name="setAdminConsoleCOSThemesTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS Themes Tab </desc>
    <ui name="Configure-COSes-COS-Themes(modify)"/>
    <attrs>
      <a n="zimbraPrefSkin"/>
      <a n="zimbraAvailableSkin"/>
    </attrs>
  </right>
  <right name="adminConsoleCOSThemesTabRights" type="combo">
    <desc> Admin Console rights for COS Themes Tab </desc>
    <ui name="Configure-COSes-COS-Themes"/>
    <rights>
      <r n="setAdminConsoleCOSThemesTab"/>
      <r n="viewAdminConsoleCOSThemesTab"/>
    </rights>
  </right>
  <!-- Admin Console Zimlets Tab -->
  <right name="setAdminConsoleCOSZimletsTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS Zimlets Tab </desc>
    <ui name="Configure-COSes-COS-Zimlets(modify)"/>
    <attrs>
      <a n="zimbraZimletAvailableZimlets"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleCOSZimletsTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS Zimlets Tab </desc>
    <ui name="Configure-COSes-COS-Zimlets(view)"/>
    <attrs>
      <a n="zimbraZimletAvailableZimlets"/>
    </attrs>
  </right>
  <right name="adminConsoleCOSZimletsTabRights" type="combo">
    <desc> Admin Console rights for COS Zimlets Tab </desc>
    <ui name="Configure-COSes-COS-Zimlets"/>
    <rights>
      <r n="setAdminConsoleCOSZimletsTab"/>
      <r n="viewAdminConsoleCOSZimletsTab"/>
    </rights>
  </right>
  <!-- Admin Console Server Pool Tab -->
  <right name="setAdminConsoleCOSServerPoolTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS Server Pool Tab </desc>
    <ui name="Configure-COSes-COS-ServerPool(modify)"/>
    <attrs>
      <a n="zimbraMailHostPool"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleCOSServerPoolTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS Server Pool Tab </desc>
    <ui name="Configure-COSes-COS-ServerPool(view)"/>
    <attrs>
      <a n="zimbraMailHostPool"/>
    </attrs>
  </right>
  <right name="adminConsoleCOSServerPoolTabRights" type="combo">
    <desc> Admin Console rights for COS Server Pool Tab </desc>
    <ui name="Configure-COSes-COS-ServerPool"/>
    <rights>
      <r n="setAdminConsoleCOSServerPoolTab"/>
      <r n="viewAdminConsoleCOSServerPoolTab"/>
    </rights>
  </right>

  <!-- Admin Console Advanced Tab -->
  <right name="setAdminConsoleCOSAdvancedTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS Advanced Tab </desc>
    <ui name="Configure-COSes-COS-Advanced(modify)"/>
    <attrs>
      <!-- Attachment Settings -->
      <a n="zimbraAttachmentsBlocked"/>
      <a n="zimbraAttachmentsViewInHtmlOnly"/>
      <a n="zimbraAttachmentsIndexingEnabled"/>
      <!-- Quotas -->
      <a n="zimbraMailQuota"/>
      <a n="zimbraDomainAdminMaxMailQuota"/>
      <a n="zimbraContactMaxNumEntries"/>
      <a n="zimbraQuotaWarnPercent"/>
      <a n="zimbraQuotaWarnInterval"/>
      <a n="zimbraQuotaWarnMessage"/>
      <!-- Password -->
      <a n="zimbraPasswordLocked"/>
      <a n="zimbraPasswordMinLength"/>
      <a n="zimbraPasswordMaxLength"/>
      <a n="zimbraPasswordMinUpperCaseChars"/>
      <a n="zimbraPasswordMinLowerCaseChars"/>  <!-- not exposed -->
      <a n="zimbraPasswordMinPunctuationChars"/>
      <a n="zimbraPasswordMinNumericChars"/>
      <a n="zimbraPasswordMinAge"/>
      <a n="zimbraPasswordMaxAge"/>
      <a n="zimbraPasswordEnforceHistory"/>
      <!-- Failed Login Policy -->
      <a n="zimbraPasswordLockoutEnabled"/>
      <a n="zimbraPasswordLockoutMaxFailures"/>
      <a n="zimbraPasswordLockoutDuration"/>
      <a n="zimbraPasswordLockoutFailureLifetime"/>
      <!-- timeout Policy -->
      <a n="zimbraAdminAuthTokenLifetime"/>
      <a n="zimbraAuthTokenLifetime"/>
      <a n="zimbraMailIdleSessionTimeout"/>
      <!-- Email Retention Policy -->
      <a n="zimbraMailMessageLifetime"/>
      <a n="zimbraMailTrashLifetime"/>
      <a n="zimbraMailSpamLifetime"/>
      <!-- Freebusy Interop -->
      <a n="zimbraFreebusyExchangeUserOrg"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleCOSAdvancedTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS Advanced Tab </desc>
    <ui name="Configure-COSes-COS-Advanced(view)"/>
    <attrs>
      <!-- Attachment Settings -->
      <a n="zimbraAttachmentsBlocked"/>
      <a n="zimbraAttachmentsViewInHtmlOnly"/>
      <a n="zimbraAttachmentsIndexingEnabled"/>
      <!-- Quotas -->
      <a n="zimbraMailQuota"/>
      <a n="zimbraDomainAdminMaxMailQuota"/>
      <a n="zimbraContactMaxNumEntries"/>
      <a n="zimbraQuotaWarnPercent"/>
      <a n="zimbraQuotaWarnInterval"/>
      <a n="zimbraQuotaWarnMessage"/>
      <!-- Password -->
      <a n="zimbraPasswordLocked"/>
      <a n="zimbraPasswordMinLength"/>
      <a n="zimbraPasswordMaxLength"/>
      <a n="zimbraPasswordMinUpperCaseChars"/>
      <a n="zimbraPasswordMinLowerCaseChars"/>  <!-- not exposed -->
      <a n="zimbraPasswordMinPunctuationChars"/>
      <a n="zimbraPasswordMinNumericChars"/>
      <a n="zimbraPasswordMinAge"/>
      <a n="zimbraPasswordMaxAge"/>
      <a n="zimbraPasswordEnforceHistory"/>
      <!-- Failed Login Policy -->
      <a n="zimbraPasswordLockoutEnabled"/>
      <a n="zimbraPasswordLockoutMaxFailures"/>
      <a n="zimbraPasswordLockoutDuration"/>
      <a n="zimbraPasswordLockoutFailureLifetime"/>
      <!-- timeout Policy -->
      <a n="zimbraAdminAuthTokenLifetime"/>
      <a n="zimbraAuthTokenLifetime"/>
      <a n="zimbraMailIdleSessionTimeout"/>
      <!-- Email Retention Policy -->
      <a n="zimbraMailMessageLifetime"/>
      <a n="zimbraMailTrashLifetime"/>
      <a n="zimbraMailSpamLifetime"/>
      <!-- Freebusy Interop -->
      <a n="zimbraFreebusyExchangeUserOrg"/>
    </attrs>
  </right>
  <right name="adminConsoleCOSAdvancedTabRights" type="combo">
    <desc> Admin Console rights for COS Advanced Tab </desc>
    <ui name="Configure-COSes-COS-Advanced"/>
    <rights>
      <r n="setAdminConsoleCOSAdvancedTab"/>
      <r n="viewAdminConsoleCOSAdvancedTab"/>
    </rights>
  </right>

  <!-- Admin Console ACL Tab -->
  <right name="setAdminConsoleCOSACLTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS ACL Tab </desc>
    <ui name="Configure-COSes-COS-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleCOSACLTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS ACL Tab </desc>
    <ui name="Configure-COSes-COS-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleCOSACLTabRights" type="combo">
    <desc> Admin Console rights for COS ACL Tab </desc>
    <ui name="Configure-COSes-COS-ACL"/>
    <rights>
      <r n="setAdminConsoleCOSACLTab"/>
      <r n="viewAdminConsoleCOSACLTab"/>
    </rights>
  </right>

  <!-- Admin Console Zimbra Mobile Tab -->
  <right name="setAdminConsoleCOSMobileTab" type="setAttrs" targetType="cos">
    <desc> Admin Console set attr rights for COS Mobile Tab </desc>
    <ui name="Configure-COSes-COS-MobileAccess(modify)"/>
    <attrs>
      <a n="zimbraFeatureMobileSyncEnabled"/>
      <a n="zimbraFeatureMobilePolicyEnabled"/>
      <a n="zimbraMobilePolicyAllowNonProvisionableDevices"/>
      <a n="zimbraMobilePolicyAllowPartialProvisioning"/>
      <a n="zimbraMobilePolicyRefreshInterval"/>
      <a n="zimbraMobilePolicyDevicePasswordEnabled"/>
      <a n="zimbraMobilePolicyMinDevicePasswordLength"/>
      <a n="zimbraMobilePolicyAllowSimpleDevicePassword"/>
      <a n="zimbraMobilePolicyAlphanumericDevicePasswordRequired"/>
      <a n="zimbraMobilePolicyMinDevicePasswordComplexCharacters"/>
      <a n="zimbraMobilePolicyDevicePasswordExpiration"/>
      <a n="zimbraMobilePolicyDevicePasswordHistory"/>
      <a n="zimbraMobilePolicyMaxInactivityTimeDeviceLock"/>
      <a n="zimbraMobilePolicyMaxDevicePasswordFailedAttempts"/>
      <a n="zimbraMobilePolicyPasswordRecoveryEnabled"/>
      <a n="zimbraMobilePolicyDeviceEncryptionEnabled"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleCOSMobileTab" type="getAttrs" targetType="cos">
    <desc> Admin Console view attr rights for COS Mobile Tab </desc>
    <ui name="Configure-COSes-COS-MobileAccess(view)"/>
    <attrs>
      <a n="zimbraFeatureMobileSyncEnabled"/>
      <a n="zimbraFeatureMobilePolicyEnabled"/>
      <a n="zimbraMobilePolicyAllowNonProvisionableDevices"/>
      <a n="zimbraMobilePolicyAllowPartialProvisioning"/>
      <a n="zimbraMobilePolicyRefreshInterval"/>
      <a n="zimbraMobilePolicyDevicePasswordEnabled"/>
      <a n="zimbraMobilePolicyMinDevicePasswordLength"/>
      <a n="zimbraMobilePolicyAllowSimpleDevicePassword"/>
      <a n="zimbraMobilePolicyAlphanumericDevicePasswordRequired"/>
      <a n="zimbraMobilePolicyMinDevicePasswordComplexCharacters"/>
      <a n="zimbraMobilePolicyDevicePasswordExpiration"/>
      <a n="zimbraMobilePolicyDevicePasswordHistory"/>
      <a n="zimbraMobilePolicyMaxInactivityTimeDeviceLock"/>
      <a n="zimbraMobilePolicyMaxDevicePasswordFailedAttempts"/>
      <a n="zimbraMobilePolicyPasswordRecoveryEnabled"/>
      <a n="zimbraMobilePolicyDeviceEncryptionEnabled"/>
    </attrs>
  </right>
  <right name="adminConsoleCOSMobileTabRights" type="combo">
    <desc> Admin Console rights for COS Mobile Tab </desc>
    <ui name="Configure-COSes-COS-MobileAccess"/>
    <rights>
      <r n="setAdminConsoleCOSMobileTab"/>
      <r n="viewAdminConsoleCOSMobileTab"/>
    </rights>
  </right>

<!-- Admin Console Domains -->
  <!-- Admin Console Domain General Info Tab -->
  <right name="setAdminConsoleDomainInfoTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain Info Tab </desc>
    <ui name="Configure-Domains-Domain-GeneralInfo(modify)"/>
    <attrs>
      <a n="zimbraDomainName"/>
      <a n="description"/>
      <a n="zimbraDomainStatus"/>
      <a n="zimbraPrefTimeZoneId"/>
      <a n="zimbraPublicServiceHostname"/>
      <a n="zimbraDNSCheckHostname"/>
      <a n="zimbraAdminConsoleDNSCheckEnabled"/>
      <a n="zimbraDomainDefaultCOSId"/>
      <a n="zimbraNotes"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainInfoTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain Info Tab </desc>
    <ui name="Configure-Domains-Domain-GeneralInfo(view)"/>
    <attrs>
      <a n="zimbraDomainName"/>
      <a n="zimbraDomainType"/>  
      <a n="description"/>
      <a n="zimbraDomainStatus"/>
      <a n="zimbraPrefTimeZoneId"/>
      <a n="zimbraPublicServiceHostname"/>
      <a n="zimbraDNSCheckHostname"/>
      <a n="zimbraAdminConsoleDNSCheckEnabled"/>
      <a n="zimbraDomainDefaultCOSId"/>
      <a n="zimbraNotes"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainInfoTabRights" type="combo">
    <desc> Admin Console rights for Domain Info Tab </desc>
    <ui name="Configure-Domains-Domain-GeneralInfo"/>
    <rights>
      <r n="setAdminConsoleDomainInfoTab"/>
      <r n="viewAdminConsoleDomainInfoTab"/>
    </rights>
  </right>

  <!-- Admin Console Domain GAL Tab -->
  <right name="setAdminConsoleDomainGALTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain GAL Tab </desc>
    <ui name="Configure-Domains-Domain-GAL-configure(modify)"/>
    <attrs>
      <a n="zimbraGalMode"/>
      <a n="zimbraGalMaxResults"/>    
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainGALTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain GAL Tab </desc>
    <ui name="Configure-Domains-Domain-GAL-configure(view)"/>
    <attrs>
      <a n="zimbraGalMode"/>
      <a n="zimbraGalMaxResults"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainGALTabRights" type="combo">
    <desc> Admin Console rights for Domain GAL Tab </desc>
    <ui name="Configure-Domains-Domain-GAL-configure"/>
    <rights>
      <r n="setAdminConsoleDomainGALTab"/>
      <r n="viewAdminConsoleDomainGALTab"/>
      <r n="configureExternalGAL"/>
    </rights>
  </right>
  
  <right name="adminConsoleCreateGALRights" type="setAttrs" targetType="account">
    <desc> Admin Console set attr rights for create GAL sync account </desc>
    <ui name="Configure-Domains-Domain-GAL"/>
	<attrs>
	  <a n="zimbraIsSystemResource"/>
	  <a n="zimbraContactMaxNumEntries"/>
	</attrs>
  </right>

  <right name="adminConsoleConfigGALRights" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for configure GAL </desc>
    <ui name="Configure-Domains-Domain-GAL-configure(modify)"/>
	<attrs>
	  <a n="zimbraGalAccountId"/>
	  <a n="zimbraGalMode"/>
	  <a n="zimbraGalLdapURL"/>
	  <a n="zimbraGalLdapSearchBase"/>
	  <a n="zimbraGalLdapBindDn"/>
	  <a n="zimbraGalLdapBindPassword"/>
	  <a n="zimbraGalLdapFilter"/>
	  <a n="zimbraGalAutoCompleteLdapFilter"/>
	  <a n="zimbraGalSyncLdapURL"/>
	  <a n="zimbraGalSyncLdapBindPassword"/>
	  <a n="zimbraGalSyncLdapBindDn"/>
	  <a n="zimbraGalSyncLdapFilter"/>
	  <a n="zimbraGalSyncLdapSearchBase"/>
	</attrs>
  </right>

  <!-- Admin Console Domain Authentication Tab -->
  <right name="setAdminConsoleDomainAuthenticationTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain Authentication Tab </desc>
    <ui name="Configure-Domains-Domain-Authentication(modify)"/>
    <attrs>
      <a n="zimbraAuthMech"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainAuthenticationTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain Authentication Tab </desc>
    <ui name="Configure-Domains-Domain-Authentication(view)"/>
    <attrs>
      <a n="zimbraAuthMech"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainAuthenticationTabRights" type="combo">
    <desc> Admin Console rights for Domain Authentication Tab </desc>
    <ui name="Configure-Domains-Domain-Authentication"/>
    <rights>
      <r n="setAdminConsoleDomainAuthenticationTab"/>
      <r n="viewAdminConsoleDomainAuthenticationTab"/>
      <r n="configureExternalAuth"/>
    </rights>
  </right>

  <!-- Admin Console Domain Virtual Hosts Tab -->
  <right name="setAdminConsoleDomainVirtualHostsTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain VirtualHosts Tab </desc>
    <ui name="Configure-Domains-Domain-VirtualHosts(modify)"/>
    <attrs>
      <a n="zimbraVirtualHostname"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainVirtualHostsTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain VirtualHosts Tab </desc>
    <ui name="Configure-Domains-Domain-VirtualHosts(view)"/>
    <attrs>
      <a n="zimbraVirtualHostname"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainVirtualHostsTabRights" type="combo">
    <desc> Admin Console rights for Domain VirtualHosts Tab </desc>
    <ui name="Configure-Domains-Domain-VirtualHosts"/>
    <rights>
      <r n="setAdminConsoleDomainVirtualHostsTab"/>
      <r n="viewAdminConsoleDomainVirtualHostsTab"/>
    </rights>
  </right>

  <!-- Admin Console Domain Documents Tab -->
  <right name="setAdminConsoleDomainDocumentsTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain Documents Tab </desc>
    <attrs>
      <a n="zimbraNotebookAccount"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainDocumentsTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain Documents Tab </desc>
    <attrs>
      <a n="zimbraNotebookAccount"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainDocumentsTabRights" type="combo">
    <desc> Admin Console rights for Domain Documents Tab </desc>
    <rights>
      <r n="setAdminConsoleDomainDocumentsTab"/>
      <r n="viewAdminConsoleDomainDocumentsTab"/>
      <r n="configureWikiAccount"/>
    </rights>
  </right>

  <!-- Admin Console Domain Freebusy Tab -->
  <right name="setAdminConsoleDomainFreebusyTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain Freebusy Tab </desc>
    <ui name="Configure-Domains-Domain-FreeBusyInterop(modify)"/>
    <attrs>
      <a n="zimbraFreebusyExchangeURL"/>
      <a n="zimbraFreebusyExchangeAuthScheme"/>
      <a n="zimbraFreebusyExchangeAuthUsername"/>
      <a n="zimbraFreebusyExchangeAuthPassword"/>
      <a n="zimbraFreebusyExchangeUserOrg"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainFreebusyTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain Freebusy Tab </desc>
    <ui name="Configure-Domains-Domain-FreeBusyInterop(view)"/>
    <attrs>
      <a n="zimbraFreebusyExchangeURL"/>
      <a n="zimbraFreebusyExchangeAuthScheme"/>
      <a n="zimbraFreebusyExchangeAuthUsername"/>
      <a n="zimbraFreebusyExchangeAuthPassword"/>
      <a n="zimbraFreebusyExchangeUserOrg"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainFreebusyTabRights" type="combo">
    <desc> Admin Console rights for Domain Freebusy Tab </desc>
    <ui name="Configure-Domains-Domain-FreeBusyInterop"/>
    <rights>
      <r n="setAdminConsoleDomainFreebusyTab"/>
      <r n="viewAdminConsoleDomainFreebusyTab"/>
      <!-- check the settings ? -->
    </rights>
  </right>

  <!-- Admin Console Domain Zimlets Tab -->
  <right name="setAdminConsoleDomainZimletsTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain Zimlets Tab </desc>
    <ui name="Configure-Domains-Domain-Zimlets(modify)"/>
    <attrs>
      <a n="zimbraZimletDomainAvailableZimlets"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainZimletsTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain Zimlets Tab </desc>
    <ui name="Configure-Domains-Domain-Zimlets(view)"/>
    <attrs>
      <a n="zimbraZimletDomainAvailableZimlets"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainZimletsTabRights" type="combo">
    <desc> Admin Console rights for Domain Zimlets Tab </desc>
    <ui name="Configure-Domains-Domain-Zimlets"/>
    <rights>
      <r n="setAdminConsoleDomainZimletsTab"/>
      <r n="viewAdminConsoleDomainZimletsTab"/>
    </rights>
  </right>

  <!-- Admin Console Domain Themes Tab -->
  <right name="setAdminConsoleDomainThemesTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain Themes Tab </desc>
    <ui name="Configure-Domains-Domain-Themes(modify)"/>
    <attrs>
      <a n="zimbraSkinForegroundColor"/>
      <a n="zimbraSkinBackgroundColor"/>
      <a n="zimbraSkinSecondaryColor"/>
      <a n="zimbraSkinSelectionColor"/>
      <a n="zimbraSkinLogoURL"/>
      <a n="zimbraSkinLogoAppBanner"/>
      <a n="zimbraSkinLogoLoginBanner"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainThemesTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain Themes Tab </desc>
    <ui name="Configure-Domains-Domain-Themes(view)"/>
    <attrs>
      <a n="zimbraSkinForegroundColor"/>
      <a n="zimbraSkinBackgroundColor"/>
      <a n="zimbraSkinSecondaryColor"/>
      <a n="zimbraSkinSelectionColor"/>
      <a n="zimbraSkinLogoURL"/>
      <a n="zimbraSkinLogoAppBanner"/>
      <a n="zimbraSkinLogoLoginBanner"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainThemesTabRights" type="combo">
    <desc> Admin Console rights for Domain Themes Tab </desc>
    <ui name="Configure-Domains-Domain-Themes"/>
    <rights>
      <r n="setAdminConsoleDomainThemesTab"/>
      <r n="viewAdminConsoleDomainThemesTab"/>
      <!-- reset all color of the themes -->
      <!-- reset all logo attributes -->
    </rights>
  </right>

  <!-- Admin Console Domain Account Limits Tab -->
  <right name="setAdminConsoleDomainLimitsTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain Limits Tab </desc>
    <ui name="Configure-Domains-Domain-AccountLimits(modify)"/>
    <attrs>
      <a n="zimbraDomainMaxAccounts"/>
      <a n="zimbraDomainCOSMaxAccounts"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainLimitsTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain Limits Tab </desc>
    <ui name="Configure-Domains-Domain-AccountLimits(view)"/>
    <attrs>
      <a n="zimbraDomainMaxAccounts"/>
      <a n="zimbraDomainCOSMaxAccounts"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainLimitsTabRights" type="combo">
    <desc> Admin Console rights for Domain Limits Tab </desc>
    <ui name="Configure-Domains-Domain-AccountLimits"/>
    <rights>
      <r n="setAdminConsoleDomainLimitsTab"/>
      <r n="viewAdminConsoleDomainLimitsTab"/>
    </rights>
  </right>

  <!-- Admin Console Domain ACL Tab -->
  <right name="setAdminConsoleDomainACLTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Domain ACL Tab </desc>
    <ui name="Configure-Domains-Domain-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleDomainACLTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Domain ACL Tab </desc>
    <ui name="Configure-Domains-Domain-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleDomainACLTabRights" type="combo">
    <desc> Admin Console rights for Domain ACL Tab </desc>
    <ui name="Configure-Domains-Domain-ACL"/>
    <rights>
      <r n="setAdminConsoleDomainACLTab"/>
      <r n="viewAdminConsoleDomainACLTab"/>
    </rights>
  </right>

<!-- Admin Console Servers -->
  <!-- Admin Console Server General Info Tab -->
  <right name="setAdminConsoleServerInfoTab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-GeneralInfo(modify)"/>
    <attrs>
      <a n="cn"/>
      <a n="description"/>
      <a n="zimbraServiceHostname"/>
      <a n="zimbraLmtpAdvertisedName"/>
      <a n="zimbraLmtpBindAddress"/>
      <a n="zimbraScheduledTaskNumThreads"/>
      <a n="zimbraMailPurgeSleepInterval"/>
      <a n="zimbraReverseProxyLookupTarget"/>
      <a n="zimbraNotes"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleServerInfoTab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-GeneralInfo(view)"/>
    <attrs>
      <a n="cn"/>
      <a n="description"/>
      <a n="zimbraServiceHostname"/>
      <a n="zimbraLmtpAdvertisedName"/>
      <a n="zimbraLmtpBindAddress"/>
      <a n="zimbraScheduledTaskNumThreads"/>
      <a n="zimbraMailPurgeSleepInterval"/>
      <a n="zimbraReverseProxyLookupTarget"/>
      <a n="zimbraNotes"/>
    </attrs>
  </right>
  <right name="adminConsoleServerInfoTabRights" type="combo">
    <desc> Admin Console rights for Server Info Tab </desc>
    <ui name="Configure-Servers-Server-GeneralInfo"/>
    <rights>
      <r n="setAdminConsoleServerInfoTab"/>
      <r n="viewAdminConsoleServerInfoTab"/>
    </rights>
  </right>

  <!-- Admin Console Server Services Tab -->
  <right name="setAdminConsoleServerServicesTab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-Services(modify)"/>
    <attrs>
      <a n="zimbraServiceEnabled"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleServerServicesTab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-Services(view)"/>
    <attrs>
      <a n="zimbraServiceEnabled"/>
      <a n="zimbraServiceInstalled"/>
    </attrs>
  </right>
  <right name="adminConsoleServerServicesTabRights" type="combo">
    <desc> Admin Console rights for Server Services Tab </desc>
    <ui name="Configure-Servers-Server-Services"/>
    <rights>
      <r n="setAdminConsoleServerServicesTab"/>
      <r n="viewAdminConsoleServerServicesTab"/>
    </rights>
  </right>

  <!-- Admin Console Server MTA Tab -->
  <right name="setAdminConsoleServerMTATab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-MTA(modify)"/>
    <attrs>
      <a n="zimbraMtaAuthEnabled"/>
      <a n="zimbraMtaTlsAuthOnly"/>
      <a n="zimbraSmtpHostname"/>
      <!-- <a n="zimbraSmtpPort"/> -->
      <a n="zimbraMtaRelayHost"/>
      <a n="zimbraSmtpTimeout"/>
      <a n="zimbraMtaMyNetworks"/>
      <a n="zimbraMtaDnsLookupsEnabled"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleServerMTATab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-MTA(view)"/>
    <attrs>
      <a n="zimbraMtaAuthEnabled"/>
      <a n="zimbraMtaTlsAuthOnly"/>
      <a n="zimbraSmtpHostname"/>
      <a n="zimbraSmtpPort"/>
      <a n="zimbraMtaRelayHost"/>
      <a n="zimbraSmtpTimeout"/>
      <a n="zimbraMtaMyNetworks"/>
      <a n="zimbraMtaDnsLookupsEnabled"/>
    </attrs>
  </right>
  <right name="adminConsoleServerMTATabRights" type="combo">
    <desc> Admin Console rights for Server MTA Tab </desc>
    <ui name="Configure-Servers-Server-MTA"/>
    <rights>
      <r n="setAdminConsoleServerMTATab"/>
      <r n="viewAdminConsoleServerMTATab"/>
    </rights>
  </right>

  <!-- Admin Console Server IMAP Tab -->
  <right name="setAdminConsoleServerIMAPTab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-IMAP(modify)"/>
    <attrs>
      <a n="zimbraImapServerEnabled"/>
      <a n="zimbraImapSSLServerEnabled"/>
      <a n="zimbraImapCleartextLoginEnabled"/>
      <a n="zimbraImapNumThreads"/>
      <a n="zimbraImapBindPort"/>
      <a n="zimbraImapSSLBindPort"/>
      <a n="zimbraImapProxyBindPort"/>
      <a n="zimbraImapSSLProxyBindPort"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleServerIMAPTab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-IMAP(view)"/>
    <attrs>
      <a n="zimbraImapServerEnabled"/>
      <a n="zimbraImapSSLServerEnabled"/>
      <a n="zimbraImapCleartextLoginEnabled"/>
      <a n="zimbraImapNumThreads"/>
      <a n="zimbraImapBindPort"/>
      <a n="zimbraImapSSLBindPort"/>
      <a n="zimbraImapProxyBindPort"/>
      <a n="zimbraImapSSLProxyBindPort"/>
    </attrs>
  </right>
  <right name="adminConsoleServerIMAPTabRights" type="combo">
    <desc> Admin Console rights for Server IMAP Tab </desc>
    <ui name="Configure-Servers-Server-IMAP"/>
    <rights>
      <r n="setAdminConsoleServerIMAPTab"/>
      <r n="viewAdminConsoleServerIMAPTab"/>
    </rights>
  </right>

  <!-- Admin Console Server POP Tab -->
  <right name="setAdminConsoleServerPOPTab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-POP(modify)"/>
    <attrs>
      <a n="zimbraPop3ServerEnabled"/>
      <a n="zimbraPop3SSLServerEnabled"/>
      <a n="zimbraPop3CleartextLoginEnabled"/>
      <a n="zimbraPop3NumThreads"/>
      <a n="zimbraPop3AdvertisedName"/>
      <a n="zimbraPop3BindAddress"/>
      <a n="zimbraPop3BindPort"/>
      <a n="zimbraPop3SSLServerEnabled"/>
      <a n="zimbraPop3ProxyBindPort"/>
      <a n="zimbraPop3SSLProxyBindPort"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleServerPOPTab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-POP(view)"/>
    <attrs>
      <a n="zimbraPop3ServerEnabled"/>
      <a n="zimbraPop3SSLServerEnabled"/>
      <a n="zimbraPop3CleartextLoginEnabled"/>
      <a n="zimbraPop3NumThreads"/>
      <a n="zimbraPop3AdvertisedName"/>
      <a n="zimbraPop3BindAddress"/>
      <a n="zimbraPop3BindPort"/>
      <a n="zimbraPop3SSLServerEnabled"/>
      <a n="zimbraPop3ProxyBindPort"/>
      <a n="zimbraPop3SSLProxyBindPort"/>
    </attrs>
  </right>
  <right name="adminConsoleServerPOPTabRights" type="combo">
    <desc> Admin Console rights for Server POP Tab </desc>
    <ui name="Configure-Servers-Server-POP"/>
    <rights>
      <r n="setAdminConsoleServerPOPTab"/>
      <r n="viewAdminConsoleServerPOPTab"/>
    </rights>
  </right>

  <!-- Admin Console Server Volumes Tab -->
  <right name="setAdminConsoleServerVolumesTab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server Volumes Tab </desc>
    <ui name="Configure-Servers-Server-Volumes(modify)"/>
    <attrs>
      <a n="zimbraHsmPolicy"/>
      <a n="zimbraHsmAge"/> <!-- deprecated -->
    </attrs>
  </right>
  <right name="viewAdminConsoleServerVolumesTab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server Volumes Tab </desc>
    <ui name="Configure-Servers-Server-Volumes(view)"/>
    <attrs>
      <a n="zimbraHsmPolicy"/>
      <a n="zimbraHsmAge"/>
    </attrs>
  </right>
  <right name="adminConsoleServerVolumesTabRights" type="combo">
    <desc> Admin Console rights for Server Volumes Tab </desc>
    <ui name="Configure-Servers-Server-Volumes"/>
    <rights>
      <r n="setAdminConsoleServerVolumesTab"/>
      <r n="viewAdminConsoleServerVolumesTab"/>
      <r n="manageVolume"/>
      <r n="flushCache"/>
      <r n="applianceAll"/>
    </rights>
  </right>

  <!-- Admin Console Server Backup/Restore Tab -->
  <right name="setAdminConsoleServerBackupRestoreTab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server backup/restore Tab </desc>
    <ui name="Configure-Servers-Server-BackupRestore(modify)"/>
    <attrs>
      <a n="zimbraBackupMode"/>
      <a n="zimbraBackupAutoGroupedInterval"/>
      <a n="zimbraBackupAutoGroupedNumGroups"/>
      <a n="zimbraBackupAutoGroupedThrottled"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleServerBackupRestoreTab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server backup/restore Tab </desc>
    <ui name="Configure-Servers-Server-BackupRestore(view)"/>
    <attrs>
      <a n="zimbraBackupMode"/>
      <a n="zimbraBackupAutoGroupedInterval"/>
      <a n="zimbraBackupAutoGroupedNumGroups"/>
      <a n="zimbraBackupAutoGroupedThrottled"/>
    </attrs>
  </right>
  <right name="adminConsoleServerBackupRestoreTabRights" type="combo">
    <desc> Admin Console rights for Server BackupRestore Tab </desc>
    <ui name="Configure-Servers-Server-BackupRestore"/>
    <rights>
      <r n="setAdminConsoleServerBackupRestoreTab"/>
      <r n="viewAdminConsoleServerBackupRestoreTab"/>
    </rights>
  </right>

  <!-- Admin Console Server ACL Tab -->
  <right name="setAdminConsoleServerACLTab" type="setAttrs" targetType="server">
    <desc> Admin Console set attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleServerACLTab" type="getAttrs" targetType="server">
    <desc> Admin Console view attr rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleServerACLTabRights" type="combo">
    <desc> Admin Console rights for Server ACL Tab </desc>
    <ui name="Configure-Servers-Server-ACL"/>
    <rights>
      <r n="setAdminConsoleServerACLTab"/>
      <r n="viewAdminConsoleServerACLTab"/>
    </rights>
  </right>


<!-- Admin Console Zimlets -->
  <!-- Admin Console Zimlets ACL Tab -->
  <right name="setAdminConsoleZimletACLTab" type="setAttrs" targetType="zimlet">
    <desc> Admin Console set attr rights for Zimlet ACL Tab </desc>
    <ui name="Configure-Zimlets-Zimlet-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleZimletACLTab" type="getAttrs" targetType="zimlet">
    <desc> Admin Console view attr rights for Zimlet ACL Tab </desc>
    <ui name="Configure-Zimlets-Zimlet-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleZimletACLTabRights" type="combo">
    <desc> Admin Console rights for Zimlet ACL Tab </desc>
    <ui name="Configure-Zimlets-Zimlet-ACL"/>
    <rights>
      <r n="setAdminConsoleZimletACLTab"/>
      <r n="viewAdminConsoleZimletACLTab"/>
    </rights>
  </right>

<!-- Admin Console Admin Extensions -->
  <!-- Admin Console Admin Extension ACL Tab  -->
  <right name="setAdminConsoleExtensionACLTab" type="setAttrs" targetType="domain">
    <desc> Admin Console set attr rights for Extensions ACL Tab </desc>
    <ui name="Configure-AdminExtensions-AdminExtension-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleExtensionACLTab" type="getAttrs" targetType="domain">
    <desc> Admin Console view attr rights for Extensions ACL Tab </desc>
    <ui name="Configure-AdminExtensions-AdminExtension-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleExtensionACLTabRights" type="combo">
    <desc> Admin Console rights for Extensions ACL Tab </desc>
    <ui name="Configure-AdminExtensions-AdminExtension-ACL"/>
    <rights>
      <r n="setAdminConsoleExtensionACLTab"/>
      <r n="viewAdminConsoleExtensionACLTab"/>
    </rights>
  </right>

<!-- Admin Console Global Settings -->
  <!-- Admin Console Global Settings General Info Tab -->
  <right name="setAdminConsoleGlobalInfoTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for Global Info Tab </desc>
    <ui name="Configure-GlobalSettings-GeneralInfo(modify)"/>
    <attrs>
      <a n="zimbraGalMaxResults"/>
      <a n="zimbraDefaultDomainName"/>
      <a n="zimbraScheduledTaskNumThreads"/>
      <a n="zimbraMailPurgeSleepInterval"/>
      <a n="zimbraFileUploadMaxSize"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalInfoTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for Global Info Tab </desc>
    <ui name="Configure-GlobalSettings-GeneralInfo(view)"/>
    <attrs>
      <a n="zimbraGalMaxResults"/>
      <a n="zimbraDefaultDomainName"/>
      <a n="zimbraScheduledTaskNumThreads"/>
      <a n="zimbraMailPurgeSleepInterval"/>
      <a n="zimbraFileUploadMaxSize"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalInfoTabRights" type="combo">
    <desc> Admin Console rights for Global Info Tab </desc>
    <ui name="Configure-GlobalSettings-GeneralInfo"/>
    <rights>
      <r n="setAdminConsoleGlobalInfoTab"/>
      <r n="viewAdminConsoleGlobalInfoTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings Attachments Tab -->
  <right name="setAdminConsoleGlobalAttachmentsTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for Global Attachments Tab </desc>
    <ui name="Configure-GlobalSettings-Attachments(modify)"/>
    <attrs>
      <a n="zimbraAttachmentsBlocked"/>
      <a n="zimbraMtaBlockedExtension"/>
      <a n="zimbraMtaCommonBlockedExtension"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalAttachmentsTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for Global Attachments Tab </desc>
    <ui name="Configure-GlobalSettings-Attachments(view)"/>
    <attrs>
      <a n="zimbraAttachmentsBlocked"/>
      <a n="zimbraMtaBlockedExtension"/>
      <a n="zimbraMtaCommonBlockedExtension"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalAttachmentsTabRights" type="combo">
    <desc> Admin Console rights for Global Attachments Tab </desc>
    <ui name="Configure-GlobalSettings-Attachments"/>
    <rights>
      <r n="setAdminConsoleGlobalAttachmentsTab"/>
      <r n="viewAdminConsoleGlobalAttachmentsTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings MTA Tab -->
  <right name="setAdminConsoleGlobalMTATab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for Global MTA Tab </desc>
    <ui name="Configure-GlobalSettings-MTA(modify)"/>
    <attrs>
      <a n="zimbraMtaAuthEnabled"/>
      <a n="zimbraMtaTlsAuthOnly"/>
      <a n="zimbraSmtpHostname"/>
      <a n="zimbraSmtpPort"/>
      <a n="zimbraMtaRelayHost"/>
      <a n="zimbraDNSCheckHostname"/>
      <a n="zimbraAdminConsoleDNSCheckEnabled"/>
      <a n="zimbraMtaMaxMessageSize"/>
      <a n="zimbraSmtpSendAddOriginatingIP"/>
      <a n="zimbraMtaRestriction"/>
      <a n="zimbraMtaDnsLookupsEnabled"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalMTATab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for Global MTA Tab </desc>
    <ui name="Configure-GlobalSettings-MTA(view)"/>
    <attrs>
      <a n="zimbraMtaAuthEnabled"/>
      <a n="zimbraMtaTlsAuthOnly"/>
      <a n="zimbraSmtpHostname"/>
      <a n="zimbraSmtpPort"/>
      <a n="zimbraMtaRelayHost"/>
      <a n="zimbraDNSCheckHostname"/>
      <a n="zimbraAdminConsoleDNSCheckEnabled"/>
      <a n="zimbraMtaMaxMessageSize"/>
      <a n="zimbraSmtpSendAddOriginatingIP"/>
      <a n="zimbraMtaRestriction"/>
      <a n="zimbraMtaDnsLookupsEnabled"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalMTATabRights" type="combo">
    <desc> Admin Console rights for Global MTA Tab </desc>
    <ui name="Configure-GlobalSettings-MTA"/>
    <rights>
      <r n="setAdminConsoleGlobalMTATab"/>
      <r n="viewAdminConsoleGlobalMTATab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings IMAP Tab -->
  <right name="setAdminConsoleGlobalIMAPTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for Global IMAP Tab </desc>
    <ui name="Configure-GlobalSettings-IMAP(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalIMAPTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for Global IMAP Tab </desc>
    <ui name="Configure-GlobalSettings-IMAP(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalIMAPTabRights" type="combo">
    <desc> Admin Console rights for Global IMAP Tab </desc>
    <ui name="Configure-GlobalSettings-IMAP"/>
    <rights>
      <r n="setAdminConsoleGlobalIMAPTab"/>
      <r n="viewAdminConsoleGlobalIMAPTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings POP Tab -->
  <right name="setAdminConsoleGlobalPOPTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for Global POP Tab </desc>
    <ui name="Configure-GlobalSettings-POP(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalPOPTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for Global POP Tab </desc>
    <ui name="Configure-GlobalSettings-POP(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalPOPTabRights" type="combo">
    <desc> Admin Console rights for Global POP Tab </desc>
    <ui name="Configure-GlobalSettings-POP"/>
    <rights>
      <r n="setAdminConsoleGlobalPOPTab"/>
      <r n="viewAdminConsoleGlobalPOPTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings AS/AV Tab -->
  <right name="setAdminConsoleGlobalASAVTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for Global AS/AV Tab </desc>
    <ui name="Configure-GlobalSettings-AS/AV(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalASAVTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for Global AS/AV Tab </desc>
    <ui name="Configure-GlobalSettings-AS/AV(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalASAVTabRights" type="combo">
    <desc> Admin Console rights for Global AS/AV Tab </desc>
    <ui name="Configure-GlobalSettings-AS/AV"/>
    <rights>
      <r n="setAdminConsoleGlobalASAVTab"/>
      <r n="viewAdminConsoleGlobalASAVTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings Free/busy Interop Tab -->
  <right name="setAdminConsoleGlobalFreebusyTab" type="setAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalFreebusy Tab </desc>
    <ui name="Configure-GlobalSettings-FreeBusyInterop(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalFreebusyTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalFreebusy Tab </desc>
    <ui name="Configure-GlobalSettings-FreeBusyInterop(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalFreebusyTabRights" type="combo">
    <desc> Admin Console rights for GlobalFreebusy Tab </desc>
    <ui name="Configure-GlobalSettings-FreeBusyInterop"/>
    <rights>
      <r n="setAdminConsoleGlobalFreebusyTab"/>
      <r n="viewAdminConsoleGlobalFreebusyTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings Themes Tab -->
  <right name="setAdminConsoleGlobalThemesTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for GlobalThemes Tab </desc>
    <ui name="Configure-GlobalSettings-Themes(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalThemesTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalThemes Tab </desc>
    <ui name="Configure-GlobalSettings-Themes(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalThemesTabRights" type="combo">
    <desc> Admin Console rights for GlobalThemes Tab </desc>
    <ui name="Configure-GlobalSettings-Themes"/>
    <rights>
      <r n="setAdminConsoleGlobalThemesTab"/>
      <r n="viewAdminConsoleGlobalThemesTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings Backup/Restore Tab -->
  <right name="setAdminConsoleGlobalBackupRestoreTab" type="setAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalBackupRestore Tab </desc>
    <ui name="Configure-GlobalSettings-BackupRestore(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalBackupRestoreTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalBackupRestore Tab </desc>
    <ui name="Configure-GlobalSettings-BackupRestore(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalBackupRestoreTabRights" type="combo">
    <desc> Admin Console rights for GlobalBackupRestore Tab </desc>
    <ui name="Configure-GlobalSettings-BackupRestore"/>
    <rights>
      <r n="setAdminConsoleGlobalBackupRestoreTab"/>
      <r n="viewAdminConsoleGlobalBackupRestoreTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings ACL Tab -->
  <right name="setAdminConsoleGlobalACLTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for GlobalACL Tab </desc>
    <ui name="Configure-GlobalSettings-ACL(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalACLTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalACL Tab </desc>
    <ui name="Configure-GlobalSettings-ACL(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalACLTabRights" type="combo">
    <desc> Admin Console rights for GlobalACL Tab </desc>
    <ui name="Configure-GlobalSettings-ACL"/>
    <rights>
      <r n="setAdminConsoleGlobalACLTab"/>
      <r n="viewAdminConsoleGlobalACLTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings HSM Tab -->
  <right name="setAdminConsoleGlobalHSMTab" type="setAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalHSM Tab </desc>
    <ui name="Configure-GlobalSettings-HSM(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalHSMTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalHSM Tab </desc>
    <ui name="Configure-GlobalSettings-HSM(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalHSMTabRights" type="combo">
    <desc> Admin Console rights for GlobalHSM Tab </desc>
    <ui name="Configure-GlobalSettings-HSM"/>
    <rights>
      <r n="setAdminConsoleGlobalHSMTab"/>
      <r n="viewAdminConsoleGlobalHSMTab"/>
    </rights>
  </right>

  <!-- Admin Console Global Settings License Tab -->
  <right name="setAdminConsoleGlobalLicenseTab" type="setAttrs" targetType="config">
    <desc> Admin Console set attr rights for GlobalLicense Tab </desc>
    <ui name="Configure-GlobalSettings-License(modify)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="viewAdminConsoleGlobalLicenseTab" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for GlobalLicense Tab </desc>
    <ui name="Configure-GlobalSettings-License(view)"/>
    <attrs>
      <a n="zimbraACE"/>
    </attrs>
  </right>
  <right name="adminConsoleGlobalLicenseTabRights" type="combo">
    <desc> Admin Console rights for GlobalLicense Tab </desc>
    <ui name="Configure-GlobalSettings-License"/>
    <rights>
      <r n="setAdminConsoleGlobalLicenseTab"/>
      <r n="viewAdminConsoleGlobalLicenseTab"/>
    </rights>
  </right>


<!-- Admin Console Rights -->
<!-- Admin Console Global ACL -->

<!--
  =======================================================
    Admin Console Monitoring Section
  =======================================================
-->
<!-- Admin Console Server Status -->
<right name="viewAdminConsoleServerStatus" type="getAttrs" targetType="config">
    <desc> Admin Console view attr rights for server status Tab </desc>
    <ui name="Monitor-ServerStatus"/>
    <attrs>
      <a n="zimbraLogHostname"/>
    </attrs>
</right>

<!-- Admin Console Server Statistics -->

<!-- ======================================================= -->
<!--       Admin Console Tools Section -->
<!-- ======================================================= -->
<!-- Admin Console Mail Queues -->
<!-- Admin Console Certificates -->
<!-- Admin Console Backups -->

<!--
  =======================================================
    Admin Console Searches Section
  =======================================================
-->


<!-- <right type="getAttrs" name="adminConsoleDomainInfoRights" targetType="domain">
  <desc> Admin Console Domain Rights </desc>
  <attrs>
    <a n="zimbraDomainName"/>
  </attrs>
</right> -->
<!-- Admin Console Resources ACL Tab -->


<!--
  =======================================================
    Roll-up Combo Rights
  =======================================================
-->
<right type="combo" name="adminConsoleAccountRights">
  <desc>Admin Console Account Rights</desc>
  <ui name="Manage-Accounts"/>
  <rights>
    <r n="getMailboxInfo"/> <!-- where does this go -->
    <r n="adminConsoleAccountsInfoTabRights"/>
    <r n="adminConsoleAccountsContactTabRights"/>
    <r n="adminConsoleAccountsMemberOfTabRights"/>
    <r n="adminConsoleAccountsAliasesTabRights"/>
    <r n="adminConsoleAccountsForwardingTabRights"/>
    <r n="adminConsoleAccountsThemesTabRights"/>
    <r n="listAccount"/>
    <r n="viewAccountAdminUI"/>
    <r n="get.account.zimbraIsSystemResource"/>
    <r n="get.account.zimbraIsSystemAccount"/>
  </rights>
</right>

<right type="combo" name="adminConsoleAliasRights">
  <desc>Admin Console Alias Rights</desc>
  <ui name="Manage-Aliases"/>
  <rights>
    <r n="viewAccountAdminUI"/>
    <r n="listAlias"/>  
  </rights>
</right>

<right type="combo" name="adminConsoleDLRights">
  <desc>Admin Console DL Rights</desc>
  <ui name="Manage-DistributionLists"/>
  <rights>
    <r n="adminConsoleDLMembersTabRights"/>
    <r n="adminConsoleDLNotesTabRights"/>
    <r n="adminConsoleDLMemberOfTabRights"/>
    <r n="adminConsoleDLAliasesTabRights"/>
    <r n="adminConsoleDLSharesTabRights"/>
    <r n="listDistributionList"/>
    <r n="viewDistributionListAdminUI"/>
  </rights>
</right>

<right type="combo" name="adminConsoleResourceRights">
  <desc>Admin Console Resource Rights</desc>
  <ui name="Manage-Resources"/>
  <rights>
    <r n="adminConsoleResourcesPropertiesTabRights"/>
    <r n="adminConsoleResourcesContactTabRights"/>
    <r n="listCalendarResource"/>
    <r n="viewAccountAdminUI"/>
  </rights>
</right>

<right type="combo" name="adminConsoleCOSRights">
  <desc>Admin Console COS Rights</desc>
  <ui name="Manage-COS"/>
  <rights>
    <r n="adminConsoleResourcesPropertiesTabRights"/>
    <r n="adminConsoleCOSInfoTabRights"/>
    <r n="adminConsoleCOSFeaturesTabRights"/>
    <r n="adminConsoleCOSPreferencesTabRights"/>
    <r n="adminConsoleCOSThemesTabRights"/>
    <r n="adminConsoleCOSZimletsTabRights"/>
    <r n="adminConsoleCOSServerPoolTabRights"/>
    <r n="adminConsoleCOSAdvancedTabRights"/>
    <r n="adminConsoleCOSACLTabRights"/>
    <r n="adminConsoleCOSMobileTabRights"/>
    <r n="listCos"/>
    <r n="modifyCos"/>
    <r n="renameCos"/>
    <r n="deleteCos"/>
  </rights>
</right>

<right type="combo" name="adminConsoleDomainRights">
  <desc ui="">Admin Console Domain Rights</desc>
  <ui name="Configure-Domains"/>
  <rights>
    <!-- View Accounts Button ?-->
    <r n="adminConsoleDomainInfoTabRights"/>
    <r n="adminConsoleDomainGALTabRights"/>
    <r n="adminConsoleDomainAuthenticationTabRights"/>
    <r n="adminConsoleDomainVirtualHostsTabRights"/>
    <r n="adminConsoleDomainDocumentsTabRights"/>
    <r n="adminConsoleDomainFreebusyTabRights"/>
    <r n="adminConsoleDomainZimletsTabRights"/>
    <r n="adminConsoleDomainThemesTabRights"/>
    <r n="adminConsoleDomainLimitsTabRights"/>
    <r n="adminConsoleDomainACLTabRights"/>
    <r n="listAlias"/>
    <r n="listDomain"/>
    <r n="deleteDomain"/>
    <r n="countAccount"/>
    <r n="checkDomainMXRecord"/>
  </rights>
</right>

<right type="combo" name="adminConsoleSubDomainRights">
  <desc ui="">Admin Console Sub Domain Rights</desc>
  <ui name="Configure-Domains"/>
  <rights>
    <!-- View Accounts Button ?-->
    <r n="adminConsoleDomainInfoTabRights"/>
    <r n="adminConsoleDomainGALTabRights"/>
    <r n="adminConsoleDomainAuthenticationTabRights"/>
    <r n="adminConsoleDomainVirtualHostsTabRights"/>
    <r n="adminConsoleDomainDocumentsTabRights"/>
    <r n="adminConsoleDomainFreebusyTabRights"/>
    <r n="adminConsoleDomainZimletsTabRights"/>
    <r n="adminConsoleDomainThemesTabRights"/>
    <r n="adminConsoleDomainLimitsTabRights"/>
    <r n="adminConsoleDomainACLTabRights"/>
    <r n="listAlias"/>
    <r n="listDomain"/>
    <r n="deleteDomain"/>
    <r n="countAccount"/>
    <r n="checkDomainMXRecord"/>
  </rights>
</right>

<right type="combo" name="adminConsoleSavedSearchRights">
  <desc>Admin Console Saved Search Rights</desc>
  <ui name="Search-SavedSearches-SavedSearch-Edit"/>
  <rights>
    <r n="setAdminSavedSearch"/>
    <r n="viewAdminSavedSearch"/>
  </rights>
</right>

<right type="combo" name="adminConsoleCreateTopDomainRights">
  <!-- set on the global target -->
  <desc>Admin Console Create Top Domain Rights</desc>
  <ui name="Configure-Domains-Domain-New"/>
  <rights>
      <r n="createSubDomain"/>
      <r n="createTopDomain"/>
      <r n="adminConsoleCreateGALRights"/>
      <r n="adminConsoleAccountRights"></r>
      <r n="adminConsoleDLRights"></r>
      <r n="adminConsoleResourceRights"></r>
      <r n="adminConsoleAliasRights"></r>
      <r n="adminConsoleSavedSearchRights"></r>
      <r n="adminConsoleDomainRights"></r>
  </rights>
</right>


<right type="combo" name="adminConsoleCreateSubDomainModifierRights">
   <!-- set on the domain target with subDomain modifier * to allow da
   have the same right on the subdomain -->
  <desc>Admin Console Create Sub Domain Rights</desc>
  <ui name="Configure-Domains-Domain-New"/>
  <rights>
       <r n="adminConsoleDomainRights"/>
  </rights>
</right>

<right type="combo" name="adminConsoleCreateSubDomainRights">
  <desc>Admin Console Create Sub Domain Account Rights</desc>
  <ui name="Configure-Domains-Domain-New"/>
  <rights>
    <!-- View Accounts Button ?-->
    <r n="adminConsoleAccountRights"></r>
    <r n="adminConsoleDLRights"></r>
    <r n="adminConsoleResourceRights"></r>
    <r n="adminConsoleAliasRights"></r>
    <r n="adminConsoleSavedSearchRights"></r>
    <r n="adminConsoleDomainRights"></r>
    <r n="adminConsoleCreateGALRights"></r>
    <r n="createSubDomain"/>
  </rights>
</right>


<right type="combo" name="adminConsoleServerRights">
  <desc>Admin Console Server Rights</desc>
  <ui name="Configure-Servers"/>
  <rights>
    <!-- View Accounts Button ?-->
    <r n="adminConsoleServerInfoTabRights"/>
    <r n="adminConsoleServerServicesTabRights"/>
    <r n="adminConsoleServerMTATabRights"/>
    <r n="adminConsoleServerIMAPTabRights"/>
    <r n="adminConsoleServerPOPTabRights"/>
    <r n="adminConsoleServerVolumesTabRights"/>
    <r n="adminConsoleServerBackupRestoreTabRights"/>
    <r n="adminConsoleServerACLTabRights"/>
    <r n="listServer"/>
    <r n="deleteServer"/>
    <r n="modifyServer"/>
    <r n="flushCache"/>
  </rights>
</right>

<right type="combo" name="adminConsoleZimletRights">
  <desc>Admin Console Zimlet Rights</desc>
  <ui name="Configure-Zimlets"/>
  <rights>
    <r n="adminConsoleZimletACLTabRights"/>
    <r n="listZimlet"/>
    <r n="deleteZimlet"/>
    <r n="modifyZimlet"/>
    <!-- todo deploy zimlet ? -->
    <!-- todo toggle status zimlet ? -->
    <!-- todo undeploy zimlet ? -->
  </rights>
</right>

<right type="combo" name="adminConsoleExtensionRights">
  <desc>Admin Console Extension Rights</desc>
  <ui name="Configure-AdminExtensions"/>
  <rights>
    <r n="adminConsoleExtensionACLTabRights"/>
    <!-- todo deploy extension ? -->
    <!-- todo undeploy extension ? -->
  </rights>
</right>


<right type="combo" name="adminConsoleGlobalRights">
  <desc>Admin Console Global Rights</desc>
  <ui name="Configure-GlobalSettings"/>
  <rights>
    <r n="adminConsoleGlobalInfoTabRights"/>
    <r n="adminConsoleGlobalAttachmentsTabRights"/>
    <r n="adminConsoleGlobalMTATabRights"/>
    <r n="adminConsoleGlobalIMAPTabRights"/>
    <r n="adminConsoleGlobalPOPTabRights"/>
    <r n="adminConsoleGlobalASAVTabRights"/>
    <r n="adminConsoleGlobalFreebusyTabRights"/>
    <r n="adminConsoleGlobalThemesTabRights"/>
    <r n="adminConsoleGlobalBackupRestoreTabRights"/>
    <r n="adminConsoleGlobalACLTabRights"/>
    <r n="adminConsoleGlobalHSMTabRights"/>
    <r n="adminConsoleGlobalLicenseTabRights"/>
  </rights>
</right>

<right type="combo" name="adminConsoleServerStatusRights">
  <desc>Admin Console Server Status Rights</desc>
  <ui name="Monitor-ServerStatus"/>
  <rights>
    <r n="getServiceStatus"/>
    <r n="listServer"/>
    <r n="viewAdminConsoleServerStatus" />  
  </rights>
</right>

<right type="combo" name="adminConsoleServerStatisticRights">
  <desc>Admin Console Server Statistics Rights</desc>
  <ui name="Monitor-ServerStatistics"/>
  <rights>
    <r n="getServerStats"/>
    <r n="listServer"/>
    <r n="getSessions"/>
  </rights>
</right>

<right type="combo" name="adminConsoleMailQueueRights">
  <desc>Admin Console Mail Queue Rights</desc>
  <ui name="Monitor-MailQueues"/>
  <rights>
    <r n="mailQueueRights"/>
  </rights>
</right>

<right type="combo" name="adminConsoleBackupRights">
  <desc>Admin Console Backup Rights</desc>
  <ui name="ToolsAndMigration-Backups"/>
  <rights>
    <r n="backupAccount"/>
    <r n="restoreAccount"/>
    <r n="moveAccountMailbox"/>
    <r n="moveCalendarResourceMailbox"/>
    <r n="moveMailboxFromServer"/>
    <r n="moveMailboxToServer"/>
    <r n="modifyZimlet"/>
    <r n="listZimlet"/>
    <r n="listServer"/>
  </rights>
</right>

<right type="combo" name="adminConsoleCrossMailboxSearchRights">
  <desc>Admin Console Cross Mailbox Search Rights</desc>
  <ui name="ToolsAndMigration-SearchMail"/>
  <rights>
    <r n="crossMailboxSearchRights"/>
    <r n="listAccount"/>
    <r n="createAccount"/>
  </rights>
</right>


<right type="combo" name="adminConsoleCertificateRights">
  <desc>Rights for configuring SSL certificate on a server through Admin Console</desc>
  <ui name="Configure-Certificates"/>
  <rights>
   <r n="listServer" />
   <r n="getCertificateInfo"/>
   <r n="installCertificate"/>
   <r n="getCSR"/>   
   <r n="generateCSR"/> 
  </rights>
</right>

<right name="viewAdminConsoleSoftwareUpdatesConfigAttrs" type="getAttrs" targetType="config">
  <desc> Admin Console view attr rights for software updates tab </desc>
  <ui name="ToolsAndMigration-SoftwareUpdates(view)"/>
  <attrs>
	<a n="zimbraVersionCheckLastAttempt"/>
	<a n="zimbraVersionCheckLastSuccess"/>
	<a n="zimbraVersionCheckLastResponse"/>
	<a n="zimbraVersionCheckNotificationEmail"/>
	<a n="zimbraVersionCheckSendNotifications"/>
	<a n="zimbraVersionCheckNotificationEmailFrom"/>
	<a n="zimbraVersionCheckNotificationSubject"/>
	<a n="zimbraVersionCheckNotificationBody"/>
	<a n="zimbraVersionCheckInterval"/>
	<a n="zimbraVersionCheckServer"/>
	<a n="zimbraVersionCheckURL"/>
	</attrs>
</right>

<right name="setAdminConsoleSoftwareUpdatesConfigAttrs" type="setAttrs" targetType="config">
  <desc> Admin Console view attr rights for software updates tab </desc>
  <ui name="ToolsAndMigration-SoftwareUpdates(modify)"/>
  <attrs>
	<a n="zimbraVersionCheckLastAttempt"/>
	<a n="zimbraVersionCheckLastSuccess"/>
	<a n="zimbraVersionCheckLastResponse"/>
	<a n="zimbraVersionCheckNotificationEmail"/>
	<a n="zimbraVersionCheckSendNotifications"/>
	<a n="zimbraVersionCheckNotificationEmailFrom"/>
	<a n="zimbraVersionCheckNotificationSubject"/>
	<a n="zimbraVersionCheckNotificationBody"/>
	<a n="zimbraVersionCheckInterval"/>
	<a n="zimbraVersionCheckServer"/>
	<a n="zimbraVersionCheckURL"/>  </attrs>
</right>

<right name="viewAdminConsoleSoftwareUpdatesServerAttrs" type="getAttrs" targetType="server">
  <desc> Admin Console view attr rights for software updates tab </desc>
  <ui name="ToolsAndMigration-SoftwareUpdates(view)"/>
  <attrs>
    <a n="zimbraId"/>
    <a n="cn"/>
    <a n="zimbraSmtpHostname"/>
    <a n="zimbraServiceInstalled"/>
    <a n="zimbraServiceEnabled"/>
    <a n="zimbraServiceHostname"/>
  </attrs>
</right>

<right type="combo" name="adminConsoleMigrationRights">
  <desc>Rights for running migration tasks on a server through Admin Console</desc>
  <ui name="ToolsAndMigration-AccountMigration"/>
  <rights>
   <r n="listServer" />
   <r n="getServer" />
   <r n="createMigrationTask"/>   
  </rights>
</right>

<right type="combo" name="adminConsoleSoftwareUpdatesRights">
  <desc>Rights for configuring software updates component a server through Admin Console</desc>
  <ui name="ToolsAndMigration-SoftwareUpdates"/>  
  <rights>
   <r n="listServer" />
   <r n="listAccount" />
   <r n="checkSoftwareUpdates"/>
   <r n="viewAdminConsoleSoftwareUpdatesConfigAttrs"/>
   <r n="setAdminConsoleSoftwareUpdatesConfigAttrs"/>
   <r n="viewAdminConsoleSoftwareUpdatesServerAttrs"/>   
  </rights>
</right>

<right type="combo" name="adminConsoleClientUploadRights">
    <desc>Rights for uploading client software through Admin Console</desc>
    <ui name="Configure-Zimlets-Deploy"/>
    <rights>
        <r n="uploadClientSoftware" />
        <r n="modifyZimlet"/>
        <r n="listZimlet"/>
    </rights>
</right>

<right type="combo" name="adminConsoleUCServiceRights">
    <desc>Rights for viewing Voice/Chat services through Admin Console</desc>
    <ui name="Configure-Voice/Chat"/>
    <rights>
        <r n="listUCService" />
    </rights>
</right>

<right type="combo" name="adminConsoleRights">
  <desc>Admin Console Rights and Views</desc>
  <ui name="home"/>
  <rights>
    <r n="adminConsoleAccountRights"/>
    <r n="adminConsoleAliasRights"/>
    <r n="adminConsoleDLRights"/>
    <r n="adminConsoleResourceRights"/>
    <r n="adminConsoleCOSRights"/>
    <r n="adminConsoleDomainRights"/>
    <r n="adminConsoleServerRights"/>
    <r n="adminConsoleZimletRights"/>
    <r n="adminConsoleExtensionRights"/>
    <r n="adminConsoleGlobalRights"/>
    <r n="adminConsoleServerStatusRights"/>
    <r n="adminConsoleServerStatisticRights"/>
    <r n="adminConsoleMailQueueRights"/>
    <r n="adminConsoleCertificateRights"/>
    <r n="adminConsoleBackupRights"/>
    <r n="adminConsoleCrossMailboxSearchRights"/>
    <r n="adminConsoleSavedSearchRights"/>
    <r n="adminConsoleSoftwareUpdatesRights"/>
    <r n="adminConsoleMigrationRights"/>
    <r n="adminConsoleClientUploadRights"/>
    <r n="adminConsoleUCServiceRights"/>
  </rights>
</right>

</rights>


zimbra-rights-adminconsole-domainadmin.xml


<?xml version="1.0" encoding="UTF-8"?>


<rights>

<include file="zimbra-rights.xml"/>
<!-- 
========================================================
      domain admin read-only attrs
========================================================
-->

<right name="getDomainAdminAccountAttrs" type="getAttrs" targetType="account">
  <desc>account and calendar resource attrs read only for domain admins</desc>
  <attrs>
  	<a n="zimbraMailHost"/>
  </attrs>
 </right>
 <right name="getDomainAdminCalendarResourceAttrs" type="getAttrs" targetType="calresource">
  <desc>account and calendar resource attrs read only for domain admins</desc>
  <attrs>
  	<a n="zimbraMailHost"/>
  </attrs>
 </right>
<!--
  =======================================================
    Admin Console Accounts List View
  =======================================================
-->
<!-- Admin Console Accounts Info Tab -->
<right name="setDomainAdminConsoleAccountsInfoTab" type="setAttrs" targetType="account">
  <desc> Admin Console Domain Admin set attr rights for Accounts Info Tab </desc>
  <attrs>
    <a n="givenName"/>
    <a n="initials"/>
    <a n="sn"/>
    <a n="displayName"/>
    <a n="zimbraMailCanonicalAddress"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraAccountStatus"/>
    <!-- <a n="zimbraCOSId"/> -->
    <!-- <a n="zimbraIsAdminAccount -->
    <a n="zimbraIsDelegatedAdminAccount"/>
    <!-- admin groups? -->
    <a n="zimbraDomainAdminMaxMailQuota"/>
    <!-- rights to change password -->
    <a n="zimbraPasswordMustChange"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
  </attrs>
</right>

<right name="viewDomainAdminConsoleAccountsInfoTab" type="getAttrs" targetType="account">
  <desc> Admin Console Domain Admin view attr rights for Accounts Info Tab</desc>
  <attrs>
    <a n="zimbraId"/>
    <a n="givenName"/>
    <a n="initials"/>
    <a n="uid"/>
    <a n="cn"/>
    <a n="sn"/>
    <a n="displayName"/>
    <a n="zimbraMailCanonicalAddress"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraAccountStatus"/>
    <!-- <a n="zimbraCOSId"/> -->
    <!-- <a n="zimbraIsAdminAccount -->
    <a n="zimbraIsDelegatedAdminAccount"/>
    <!-- admin groups? -->
    <a n="zimbraDomainAdminMaxMailQuota"/>
    <!-- rights to change password -->
    <a n="zimbraPasswordMustChange"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
    <a n="zimbraLastLogonTimestamp"/>
  </attrs>
</right>

<right type="combo" name="domainAdminConsoleAccountsInfoTabRights">
  <desc> Admin Console Domain Admin rights for Accounts Info Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsInfoTab"/>
    <r n="viewDomainAdminConsoleAccountsInfoTab"/>
    <r n="getAccountInfo"/>
    <r n="createAccount"/>
    <r n="deleteAccount"/>
    <r n="renameAccount"/>
    <r n="setAccountPassword"/>
  </rights>
</right>

<!-- Admin Console Accounts Contact Tab -->
<right name="setDomainAdminConsoleAccountsContactTab" type="setAttrs" targetType="account">
  <desc> Admin Console Domain Admin set attr rights for accounts contact tab </desc>
  <attrs>
    <a n="telephoneNumber"/>
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
	<a n="title"/>
	<a n="facsimileTelephoneNumber"/>
  </attrs>
</right>

<right name="viewDomainAdminConsoleAccountsContactTab" type="getAttrs" targetType="account">
  <desc> Admin Console Domain Admin view attr rights for accounts contact tab </desc>
  <attrs>
    <a n="telephoneNumber"/>
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
    <a n="title"/>
    <a n="facsimileTelephoneNumber"/>
  </attrs>
</right>

<right name="domainAdminConsoleAccountsContactTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for Accounts Contact Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsContactTab"/>
    <r n="viewDomainAdminConsoleAccountsContactTab"/>
  </rights>
</right>

<!-- Admin Console Accounts MemberOf Tab -->
<!-- <right name="setDomainAdminConsoleAccountsMemberOfTab" type="setAttrs" targetType="account">
  <desc> Admin Console Domain Admin set attr rights for Accounts MemberOf Tab </desc>
  <attrs></attrs>
</right> -->
<!-- <right name="viewDomainAdminConsoleAccountsMemberOfTab" type="getAttrs" targetType="account">
  <desc> Admin Console Domain Admin view attr rights for Accounts MemberOf Tab </desc>
  <attrs></attrs>
</right> -->
<right name="domainAdminConsoleAccountsMemberOfTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for Accounts MemberOf Tab </desc>
  <rights>
    <r n="getAccountMembership"/>
  </rights>
</right>

<!-- Admin Console Accounts Aliases Tab -->
<right name="setDomainAdminConsoleAccountsAliasesTab" type="setAttrs" targetType="account">
  <desc> Admin Console Domain Admin set attr rights for Accounts Aliases Tab </desc>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleAccountsAliasesTab" type="getAttrs" targetType="account">
  <desc> Admin Console Domain Admin view attr rights for Accounts Aliases Tab </desc>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="domainAdminConsoleAccountsAliasesTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for Accounts Aliases Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsAliasesTab"/>
    <r n="viewDomainAdminConsoleAccountsAliasesTab"/>
    <r n="createAlias"/>
    <r n="deleteAlias"/>
    <r n="addAccountAlias"/>
    <r n="removeAccountAlias"/>
  </rights>
</right>

<!-- Admin Console Accounts Features Tab -->
<right name="setDomainAdminConsoleAccountsFeaturesTab" type="setAttrs" targetType="account">
  <desc> Admin Console Domain Admin set attr rights for Accounts Features Tab </desc>
  <attrs>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraPop3Enabled"/>
    <a n="zimbraFeatureReadReceiptsEnabled"/>
    <a n="zimbraFeatureMailEnabled"/>
    <a n="zimbraFeatureContactsEnabled"/>
    <a n="zimbraFeatureCalendarEnabled"/>
    <a n="zimbraFeatureTasksEnabled"/>
    <a n="zimbraFeatureNotebookEnabled"/>
    <a n="zimbraFeatureBriefcasesEnabled"/>
    <a n="zimbraFeatureIMEnabled"/>
    <a n="zimbraFeatureOptionsEnabled"/>
    <a n="zimbraFeatureTaggingEnabled"/>
    <a n="zimbraFeatureSharingEnabled"/>
    <a n="zimbraFeatureChangePasswordEnabled"/>
    <a n="zimbraFeatureSkinChangeEnabled"/>
    <a n="zimbraFeatureHtmlComposeEnabled"/>
    <a n="zimbraFeatureShortcutAliasesEnabled"/>
    <a n="zimbraFeatureGalEnabled"/>
    <a n="zimbraFeatureGalAutoCompleteEnabled"/>
    <a n="zimbraFeatureMailPriorityEnabled"/>
    <a n="zimbraFeatureFlaggingEnabled"/>
    <a n="zimbraFeatureImapDataSourceEnabled"/>
    <a n="zimbraFeaturePop3DataSourceEnabled"/>
    <a n="zimbraFeatureConversationsEnabled"/>
    <a n="zimbraFeatureFiltersEnabled"/>
    <a n="zimbraFeatureOutOfOfficeReplyEnabled"/>
    <a n="zimbraFeatureNewMailNotificationEnabled"/>
    <a n="zimbraFeatureMailPollingIntervalPreferenceEnabled"/>
    <a n="zimbraFeatureIdentitiesEnabled"/>
    <a n="zimbraFeatureGroupCalendarEnabled"/>
    <a n="zimbraFeatureInstantNotify"/>
    <a n="zimbraFeatureAdvancedSearchEnabled"/>
    <a n="zimbraFeatureSavedSearchesEnabled"/>
    <a n="zimbraFeatureInitialSearchPreferenceEnabled"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleAccountsFeaturesTab" type="getAttrs" targetType="account">
  <desc> Admin Console Domain Admin view attr rights for Accounts Features Tab </desc>
  <attrs>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraPop3Enabled"/>
    <a n="zimbraFeatureReadReceiptsEnabled"/>
    <a n="zimbraFeatureMailEnabled"/>
    <a n="zimbraFeatureContactsEnabled"/>
    <a n="zimbraFeatureCalendarEnabled"/>
    <a n="zimbraFeatureTasksEnabled"/>
    <a n="zimbraFeatureNotebookEnabled"/>
    <a n="zimbraFeatureBriefcasesEnabled"/>
    <a n="zimbraFeatureIMEnabled"/>
    <a n="zimbraFeatureOptionsEnabled"/>
    <a n="zimbraFeatureTaggingEnabled"/>
    <a n="zimbraFeatureSharingEnabled"/>
    <a n="zimbraFeatureChangePasswordEnabled"/>
    <a n="zimbraFeatureSkinChangeEnabled"/>
    <a n="zimbraFeatureHtmlComposeEnabled"/>
    <a n="zimbraFeatureShortcutAliasesEnabled"/>
    <a n="zimbraFeatureGalEnabled"/>
    <a n="zimbraFeatureGalAutoCompleteEnabled"/>
    <a n="zimbraFeatureMailPriorityEnabled"/>
    <a n="zimbraFeatureFlaggingEnabled"/>
    <a n="zimbraFeatureImapDataSourceEnabled"/>
    <a n="zimbraFeaturePop3DataSourceEnabled"/>
    <a n="zimbraFeatureConversationsEnabled"/>
    <a n="zimbraFeatureFiltersEnabled"/>
    <a n="zimbraFeatureOutOfOfficeReplyEnabled"/>
    <a n="zimbraFeatureNewMailNotificationEnabled"/>
    <a n="zimbraFeatureMailPollingIntervalPreferenceEnabled"/>
    <a n="zimbraFeatureIdentitiesEnabled"/>
    <a n="zimbraFeatureGroupCalendarEnabled"/>
    <a n="zimbraFeatureInstantNotify"/>
    <a n="zimbraFeatureAdvancedSearchEnabled"/>
    <a n="zimbraFeatureSavedSearchesEnabled"/>
    <a n="zimbraFeatureInitialSearchPreferenceEnabled"/>
  </attrs>
</right>
<right name="domainAdminConsoleAccountsFeaturesTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for Accounts Features Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsFeaturesTab"/>
    <r n="viewDomainAdminConsoleAccountsFeaturesTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Forwarding Tab -->
<right name="setDomainAdminConsoleAccountsForwardingTab" type="setAttrs" targetType="account">
  <desc> Admin Console Domain Admin set attr rights for Accounts Forwarding Tab </desc>
  <attrs>
    <a n="zimbraFeatureMailForwardingEnabled"/>
    <a n="zimbraPrefMailLocalDeliveryDisabled"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="zimbraPrefMailForwardingAddress"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleAccountsForwardingTab" type="getAttrs" targetType="account">
  <desc> Admin Console Domain Admin view attr rights for Accounts Forwarding Tab </desc>
  <attrs>
    <a n="zimbraFeatureMailForwardingEnabled"/>
    <a n="zimbraPrefMailLocalDeliveryDisabled"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="zimbraPrefMailForwardingAddress"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
  </attrs>
</right>
<right name="domainAdminConsoleAccountsForwardingTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for Accounts Forwarding Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsForwardingTab"/>
    <r n="viewDomainAdminConsoleAccountsForwardingTab"/>
  </rights>
</right>


<!-- Admin Console Accounts Preferences Tab -->

<!-- Admin Console Accounts FreeBusyInterop Tab -->
<right name="setDomainAdminConsoleAccountsFreeBusyInteropTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts FreeBusyInterop Tab </desc>
  <attrs>
    <a n="zimbraForeignPrincipal"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleAccountsFreeBusyInteropTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts FreeBusyInterop Tab </desc>
  <attrs>
    <a n="zimbraForeignPrincipal"/>
  </attrs>
</right>
<right name="domainAdminConsoleAccountsFreeBusyInteropTabRights" type="combo">
  <desc> Admin Console rights for Accounts FreeBusyInterop Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsFreeBusyInteropTab"/>
    <r n="viewDomainAdminConsoleAccountsFreeBusyInteropTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Themes Tab -->
<right name="setDomainAdminConsoleAccountsThemesTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Themes Tab </desc>
  <attrs>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraAvailableSkin"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleAccountsThemesTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Themes Tab </desc>
  <attrs>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraAvailableSkin"/>
  </attrs>
</right>
<right name="domainAdminConsoleAccountsThemesTabRights" type="combo">
  <desc> Admin Console rights for Accounts Themes Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsThemesTab"/>
    <r n="viewDomainAdminConsoleAccountsThemesTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Zimlets Tab -->
<right name="setDomainAdminConsoleAccountsZimletsTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Zimlets Tab </desc>
  <attrs>
    <a n="zimbraZimletAvailableZimlets"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleAccountsZimletsTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Zimlets Tab </desc>
  <attrs>
    <a n="zimbraZimletAvailableZimlets"/>
  </attrs>
</right>
<right name="domainAdminConsoleAccountsZimletsTabRights" type="combo">
  <desc> Admin Console rights for Accounts Zimlets Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsZimletsTab"/>
    <r n="viewDomainAdminConsoleAccountsZimletsTab"/>
  </rights>
</right>

<!-- Admin Console Accounts Advanced Tab -->
<!-- syntax or bad attr somewhere in the advanced tab config --> 
<!-- <right name="setDomainAdminConsoleAccountsAdvancedTab" type="setAttrs" targetType="account">
  <desc> Admin Console set attr rights for Accounts Advanced Tab </desc>
  <attrs>
    <a n="zimbraAttachmentsBlocked"\>
    <a n="zimbraMailQuota"\>
    <a n="zimbraContactMaxNumEntries"\>
    <a n="zimbraQuotaWarnPercent"\>
    <a n="zimbraQuotaWarnInterval"\>
    <a n="zimbraQuotaWarnMessage"\>
    <a n="zimbraPasswordLocked"\>
    <a n="zimbraPasswordMinLength"\>
    <a n="zimbraPasswordMaxLength"\>
    <a n="zimbraPasswordMinUpperCaseChars"\>
    <a n="zimbraPasswordMinLowerCaseChars"\>
    <a n="zimbraPasswordMinPunctuationChars"\>
    <a n="zimbraPasswordMinNumericChars"\>
    <a n="zimbraPasswordMinAge"\>
    <a n="zimbraPasswordMaxAge"\>
    <a n="zimbraPasswordEnforceHistory"\>
    <a n="zimbraPasswordLockoutEnabled"\>
    <a n="zimbraPasswordLockoutMaxFailures"\>
    <a n="zimbraPasswordLockoutDuration"\>
    <a n="zimbraPasswordLockoutFailureLifetime"\>
    <a n="zimbraAdminAuthTokenLifetime"\>
    <a n="zimbraAuthTokenLifetime"\>
    <a n="zimbraMailIdleSessionTimeout"\>
    <a n="zimbraMailMessageLifetime"\>
    <a n="zimbraMailTrashLifetime"\>
    <a n="zimbraMailSpamLifetime"\>
    <a n="zimbraFreebusyExchangeUserOrg"\>
  </attrs>
</right>
<right name="viewDomainAdminConsoleAccountsAdvancedTab" type="getAttrs" targetType="account">
  <desc> Admin Console view attr rights for Accounts Advanced Tab </desc>
  <attrs>
    <a n="zimbraAttachmentsBlocked"\>
    <a n="zimbraMailQuota"\>
    <a n="zimbraContactMaxNumEntries"\>
    <a n="zimbraQuotaWarnPercent"\>
    <a n="zimbraQuotaWarnInterval"\>
    <a n="zimbraQuotaWarnMessage"\>
    <a n="zimbraPasswordLocked"\>
    <a n="zimbraPasswordMinLength"\>
    <a n="zimbraPasswordMaxLength"\>
    <a n="zimbraPasswordMinUpperCaseChars"\>
    <a n="zimbraPasswordMinLowerCaseChars"\>
    <a n="zimbraPasswordMinPunctuationChars"\>
    <a n="zimbraPasswordMinNumericChars"\>
    <a n="zimbraPasswordMinAge"\>
    <a n="zimbraPasswordMaxAge"\>
    <a n="zimbraPasswordEnforceHistory"\>
    <a n="zimbraPasswordLockoutEnabled"\>
    <a n="zimbraPasswordLockoutMaxFailures"\>
    <a n="zimbraPasswordLockoutDuration"\>
    <a n="zimbraPasswordLockoutFailureLifetime"\>
    <a n="zimbraAdminAuthTokenLifetime"\>
    <a n="zimbraAuthTokenLifetime"\>
    <a n="zimbraMailIdleSessionTimeout"\>
    <a n="zimbraMailMessageLifetime"\>
    <a n="zimbraMailTrashLifetime"\>
    <a n="zimbraMailSpamLifetime"\>
    <a n="zimbraFreebusyExchangeUserOrg"\>
  </attrs>
</right>
<right name="domainAdminConsoleAccountsAdvancedTabRights" type="combo">
  <desc> Admin Console rights for Accounts Advanced Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleAccountsAdvancedTab"/>
    <r n="viewDomainAdminConsoleAccountsAdvancedTab"/>
  </rights>
</right> -->

<!-- Admin Console Accounts Zimbra Mobile Tab -->
<!-- Admin Console Accounts ACL Tab -->
<!-- Admin Console Accounts Admin Views Tab -->

<!--
  =======================================================
    Admin Console Alias List View
  =======================================================
-->
<!-- nothing to do here -->

<!--
  =======================================================
    Admin Console Distribution List List View
  =======================================================
-->
<!-- Admin Console DL Members Tab -->
<right name="setDomainAdminConsoleDLMembersTab" type="setAttrs" targetType="dl">
  <desc> Admin Console set attr rights for DL Members Tab </desc>
  <attrs>
    <a n="cn"/>
    <a n="displayName"/>
    <a n="description"/>
    <a n="zimbraIsAdminGroup"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleDLMembersTab" type="getAttrs" targetType="dl">
  <desc> Admin Console Domain Admin view attr rights for DL Members Tab </desc>
  <attrs>
    <a n="cn"/>
    <a n="displayName"/>
    <a n="description"/>
    <a n="mail"/>
    <a n="uid"/>
    <a n="zimbraId"/>
    <a n="zimbraIsAdminGroup"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraMailForwardingAddress"/>
  </attrs>
</right>
<right name="domainAdminConsoleDLMembersTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for DL Members Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleDLMembersTab"/>
    <r n="viewDomainAdminConsoleDLMembersTab"/>
    <r n="renameDistributionList"/>
    <r n="createDistributionList"/>
    <r n="deleteDistributionList"/>
    <r n="addDistributionListMember"/>
    <r n="removeDistributionListMember"/>
    <r n="addDistributionListAlias"/>
    <r n="removeDistributionListAlias"/>
  </rights>
</right>
<!-- Admin Console DL Notes Tab -->
<right name="setDomainAdminConsoleDLNotesTab" type="setAttrs" targetType="dl">
  <desc> Admin Console Domain Admin set attr rights for DL Notes Tab </desc>
  <attrs>
    <a n="zimbraNotes"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleDLNotesTab" type="getAttrs" targetType="dl">
  <desc> Admin Console Domain Admin view attr rights for DL Notes Tab </desc>
  <attrs>
    <a n="zimbraNotes"/>
  </attrs>
</right>
<right name="domainAdminConsoleDLNotesTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for DL Notes Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleDLNotesTab"/>
    <r n="viewDomainAdminConsoleDLNotesTab"/>
  </rights>
</right>

<!-- Admin Console DL MemberOf Tab -->
<right name="domainAdminConsoleDLMemberOfTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for DL MemberOf Tab </desc>
  <rights>
    <r n="getDistributionListMembership"/>
  </rights>
</right>

<!-- Admin Console DL Aliases Tab -->
<right name="setDomainAdminConsoleDLAliasesTab" type="setAttrs" targetType="dl">
  <desc> Admin Console Domain Admin set attr rights for DL Aliases Tab </desc>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleDLAliasesTab" type="getAttrs" targetType="dl">
  <desc> Admin Console Domain Admin view attr rights for DL Aliases Tab </desc>
  <attrs>
    <a n="zimbraMailAlias"/>
  </attrs>
</right>
<right name="domainAdminConsoleDLAliasesTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for DL Aliases Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleDLAliasesTab"/>
    <r n="viewDomainAdminConsoleDLAliasesTab"/>
    <r n="createAlias"/>
    <r n="deleteAlias"/>
    <r n="addCalendarResourceAlias"/>
    <r n="removeCalendarResourceAlias"/>
  </rights>
</right>

<!-- Admin Console DL Shares Tab -->
<right name="setDomainAdminConsoleDLSharesTab" type="setAttrs" targetType="dl">
  <desc> Admin Console Domain Admin set attr rights for DL Shares Tab </desc>
  <attrs>
    <a n="zimbraDistributionListSendShareMessageToNewMembers"/>
    <a n="zimbraDistributionListSendShareMessageFromAddress"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleDLSharesTab" type="getAttrs" targetType="dl">
  <desc> Admin Console Domain Admin view attr rights for DL Shares Tab </desc>
  <attrs>
    <a n="zimbraDistributionListSendShareMessageToNewMembers"/>
    <a n="zimbraDistributionListSendShareMessageFromAddress"/>
  </attrs>
</right>
<right name="domainAdminConsoleDLSharesTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for DL Shares Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleDLSharesTab"/>
    <r n="viewDomainAdminConsoleDLSharesTab"/>
  </rights>
</right>
<!-- Admin Console DL ACL Tab -->
<!-- Admin Console DL Admin View Tab -->
<!--
  =======================================================
    Admin Console Resource List View
  =======================================================
-->
<!-- Admin Console Resources Properties Tab -->
<right name="setDomainAdminConsoleResourcesPropertiesTab" type="setAttrs" targetType="calresource">
  <desc> Admin Console Domain Admin set attr rights for Resources Properties Tab </desc>
  <attrs>
    <a n="displayName"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
    <a n="cn"/>
    <a n="mail"/>
    <a n="uid"/>
    <a n="zimbraAccountStatus"/>
    <a n="zimbraAccountCalendarUserType"/>
    <a n="zimbraCalResType"/>
    <a n="zimbraCalResAutoAcceptDecline"/>
    <a n="zimbraCalResAutoDeclineIfBusy"/>
    <a n="zimbraCalResAutoDeclineRecurring"/>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="zimbraLocale"/>
    <a n="zimbraCalResMaxNumConflictsAllowed"/>
    <a n="zimbraCalResMaxPercentConflictsAllowed"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleResourcesPropertiesTab" type="getAttrs" targetType="calresource">
  <desc> Admin Console Domain Admin view attr rights for Resources Properties Tab </desc>
  <attrs>
    <a n="displayName"/>
    <a n="zimbraId"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailAlias"/>
    <a n="zimbraHideInGal"/>
    <a n="description"/>
    <a n="zimbraNotes"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="cn"/>
    <a n="uid"/>
    <!-- <a n="zimbraCOSId"/> -->
    <a n="zimbraAccountStatus"/>
    <a n="zimbraAccountCalendarUserType"/>
    <a n="zimbraCalResType"/>
    <a n="zimbraCalResAutoAcceptDecline"/>
    <a n="zimbraCalResAutoDeclineIfBusy"/>
    <a n="zimbraCalResAutoDeclineRecurring"/>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="zimbraLocale"/>
    <a n="zimbraCreateTimestamp"/>
    <a n="zimbraCalResMaxNumConflictsAllowed"/>
    <a n="zimbraCalResMaxPercentConflictsAllowed"/>
  </attrs>
</right>
<right name="domainAdminConsoleResourcesPropertiesTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for Resources Properties Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleResourcesPropertiesTab"/>
    <r n="viewDomainAdminConsoleResourcesPropertiesTab"/>
    <r n="addCalendarResourceAlias"/>
    <r n="removeCalendarResourceAlias"/>
    <r n="getCalendarResourceInfo"/>
    <r n="createCalendarResource"/>
    <r n="renameCalendarResource"/>
    <r n="deleteCalendarResource"/>
    <r n="setCalendarResourcePassword"/>
  </rights>
</right>
<!-- Admin Console Resources Location/Contact Tab -->
<right name="setDomainAdminConsoleResourcesContactTab" type="setAttrs" targetType="calresource">
  <desc> Admin Console Domain Admin set attr rights for Resources Contact Tab </desc>
  <attrs>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="telephoneNumber"/>
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
  </attrs>
</right>
<right name="viewDomainAdminConsoleResourcesContactTab" type="getAttrs" targetType="calresource">
  <desc> Admin Console Domain Admin view attr rights for Resources Contact Tab </desc>
  <attrs>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="telephoneNumber"/>
    <a n="company"/>
    <a n="street"/>
    <a n="l"/>
    <a n="st"/>
    <a n="postalCode"/>
    <a n="co"/>
  </attrs>
</right>
<right name="domainAdminConsoleResourcesContactTabRights" type="combo">
  <desc> Admin Console Domain Admin rights for Resources Contact Tab </desc>
  <rights>
    <r n="setDomainAdminConsoleResourcesContactTab"/>
    <r n="viewDomainAdminConsoleResourcesContactTab"/>
  </rights>
</right>
<!-- Admin Console Resources ACL Tab -->


<!-- <right type="getAttrs" name="adminConsoleDomainInfoRights" targetType="domain">
  <desc> Admin Console Domain Rights </desc>
  <attrs>
    <a n="zimbraDomainName"/>
  </attrs>
</right> -->


<!--
  =======================================================
    Roll-up Combo Rights
  =======================================================
-->
<right type="combo" name="domainAdminConsoleAccountRights">
  <desc>Admin Console Domain Admin Account Rights</desc>
  <rights>
    <r n="getMailboxInfo"/> <!-- where does this go -->
    <r n="getDomainAdminAccountAttrs"/>
    <r n="domainAdminConsoleAccountsInfoTabRights"/>
    <r n="domainAdminConsoleAccountsContactTabRights"/>
    <r n="domainAdminConsoleAccountsMemberOfTabRights"/>
    <r n="domainAdminConsoleAccountsAliasesTabRights"/>
    <r n="domainAdminConsoleAccountsForwardingTabRights"/>
    <r n="listAccount"/>
    <r n="viewAccountAdminUI"/>
    <r n="get.account.zimbraIsSystemResource"/>
    <r n="get.account.zimbraIsSystemAccount"/>
  </rights>
</right>

<right type="combo" name="domainAdminConsoleAliasRights">
  <desc>Admin Console Domain Admin Alias Rights</desc>
  <rights>
    <r n="viewAccountAdminUI"/>
    <r n="listAlias"/>  
  </rights>
</right>

<right type="combo" name="domainAdminConsoleDLRights">
  <desc>Admin Console Domain Admin DL Rights</desc>
  <rights>
    <r n="domainAdminConsoleDLMembersTabRights"/>
    <r n="domainAdminConsoleDLNotesTabRights"/>
    <r n="domainAdminConsoleDLMemberOfTabRights"/>
    <r n="domainAdminConsoleDLAliasesTabRights"/>
    <r n="domainAdminConsoleDLSharesTabRights"/>
    <r n="listDistributionList"/>
    <r n="viewDistributionListAdminUI"/>
  </rights>
</right>

<right type="combo" name="domainAdminConsoleResourceRights">
  <desc>Admin Console Domain Admin Resource Rights</desc>
  <rights>
    <r n="getMailboxInfo"/>
    <r n="getDomainAdminCalendarResourceAttrs"/>
    <r n="domainAdminConsoleResourcesPropertiesTabRights"/>
    <r n="domainAdminConsoleResourcesContactTabRights"/>
    <r n="listCalendarResource"/>
    <r n="viewAccountAdminUI"/>
  </rights>
</right>

<right type="combo" name="domainAdminConsoleSavedSearchRights">
  <desc>Admin Console Domain Admin Saved Search Rights</desc>
  <rights>
    <r n="setAdminSavedSearch"/>
    <r n="viewAdminSavedSearch"/>
  </rights>
</right>

<right type="combo" name="domainAdminConsoleRights">
  <desc>Admin Console Domain Admin Rights and Views</desc>
  <rights>
    <r n="domainAdminConsoleAccountRights"/>
    <r n="domainAdminConsoleAliasRights"/>
    <r n="domainAdminConsoleDLRights"/>
    <r n="domainAdminConsoleResourceRights"/>
    <r n="domainAdminConsoleSavedSearchRights"/>
    <!-- needed to check for create*Rights on the domain -->
    <r n="listDomain"/>
    <!-- <r n="domainAdminDomainRights"/> -->
  </rights>
</right>

</rights>


zimbra-rights-domainadmin.xml


<?xml version="1.0" encoding="UTF-8"?>


<!-- 
========================================================
                current domain admin rights
========================================================
-->

<rights>

<include file="zimbra-rights.xml"/>

<!-- 
========================================================
      domain admin modifiable attrs, the template 
      if filled by:
      
      ZimbraServer> ant generate-domainadmin-rights-xml
========================================================
-->

<right name="setDomainAdminAccountAndCalendarResourceAttrs" type="setAttrs" targetType="account,calresource">
  <desc>account and calendar resource attrs modifiable by domain admins for domain based access manager</desc>
  <attrs>
    <a n="zimbraCOSId"/>
    <a n="zimbraIsDelegatedAdminAccount"/>
    <a n="c"/>
    <a n="cn"/>
    <a n="co"/>
    <a n="company"/>
    <a n="description"/>
    <a n="destinationIndicator"/>
    <a n="displayName"/>
    <a n="facsimileTelephoneNumber"/>
    <a n="givenName"/>
    <a n="gn"/>
    <a n="homePhone"/>
    <a n="initials"/>
    <a n="internationaliSDNNumber"/>
    <a n="l"/>
    <a n="mobile"/>
    <a n="o"/>
    <a n="ou"/>
    <a n="pager"/>
    <a n="physicalDeliveryOfficeName"/>
    <a n="postOfficeBox"/>
    <a n="postalAddress"/>
    <a n="postalCode"/>
    <a n="preferredDeliveryMethod"/>
    <a n="registeredAddress"/>
    <a n="sn"/>
    <a n="st"/>
    <a n="street"/>
    <a n="streetAddress"/>
    <a n="telephoneNumber"/>
    <a n="teletexTerminalIdentifier"/>
    <a n="telexNumber"/>
    <a n="title"/>
    <a n="x121Address"/>
    <a n="zimbraAccountCalendarUserType"/>
    <a n="zimbraAccountStatus"/>
    <a n="zimbraAdminAuthTokenLifetime"/>
    <a n="zimbraAdminSavedSearches"/>
    <a n="zimbraAllowFromAddress"/>
    <a n="zimbraAttachmentsBlocked"/>
    <a n="zimbraAttachmentsIndexingEnabled"/>
    <a n="zimbraAttachmentsViewInHtmlOnly"/>
    <a n="zimbraAuthLdapExternalDn"/>
    <a n="zimbraAuthTokenLifetime"/>
    <a n="zimbraAuthTokenValidityValue"/>
    <a n="zimbraAvailableLocale"/>
    <a n="zimbraAvailableSkin"/>
    <a n="zimbraBatchedIndexingSize"/>
    <a n="zimbraCalendarCalDavSharedFolderCacheDuration"/>
    <a n="zimbraCalendarCalDavSyncEnd"/>
    <a n="zimbraCalendarCalDavSyncStart"/>
    <a n="zimbraCalendarKeepExceptionsOnSeriesTimeChange"/>
    <a n="zimbraCalendarMaxRevisions"/>
    <a n="zimbraCalendarReminderDeviceEmail"/>
    <a n="zimbraChildAccount"/>
    <a n="zimbraChildVisibleAccount"/>
    <a n="zimbraContactAutoCompleteEmailFields"/>
    <a n="zimbraContactEmailFields"/>
    <a n="zimbraContactRankingTableSize"/>
    <a n="zimbraDataSourceCaldavPollingInterval"/>
    <a n="zimbraDataSourceCalendarPollingInterval"/>
    <a n="zimbraDataSourceGalPollingInterval"/>
    <a n="zimbraDataSourceImapPollingInterval"/>
    <a n="zimbraDataSourceLivePollingInterval"/>
    <a n="zimbraDataSourceMinPollingInterval"/>
    <a n="zimbraDataSourcePollingInterval"/>
    <a n="zimbraDataSourcePop3PollingInterval"/>
    <a n="zimbraDataSourceRssPollingInterval"/>
    <a n="zimbraDataSourceYabPollingInterval"/>
    <a n="zimbraDefaultFolderFlags"/>
    <a n="zimbraDumpsterEnabled"/>
    <a n="zimbraDumpsterPurgeEnabled"/>
    <a n="zimbraDumpsterUserVisibleAge"/>
    <a n="zimbraExternalImapHostname"/>
    <a n="zimbraExternalImapPort"/>
    <a n="zimbraExternalImapSSLHostname"/>
    <a n="zimbraExternalImapSSLPort"/>
    <a n="zimbraExternalPop3Hostname"/>
    <a n="zimbraExternalPop3Port"/>
    <a n="zimbraExternalPop3SSLHostname"/>
    <a n="zimbraExternalPop3SSLPort"/>
    <a n="zimbraExternalShareDomainWhitelistEnabled"/>
    <a n="zimbraExternalShareWhitelistDomain"/>
    <a n="zimbraExternalSharingEnabled"/>
    <a n="zimbraFeatureAntispamEnabled"/>
    <a n="zimbraFeatureCalendarUpsellURL"/>
    <a n="zimbraFeatureContactsUpsellURL"/>
    <a n="zimbraFeatureDiscardInFiltersEnabled"/>
    <a n="zimbraFeatureMAPIConnectorEnabled"/>
    <a n="zimbraFeatureMailForwardingEnabled"/>
    <a n="zimbraFeatureMailForwardingInFiltersEnabled"/>
    <a n="zimbraFeatureMailUpsellURL"/>
    <a n="zimbraFeatureManageZimlets"/>
    <a n="zimbraFeatureMobileSyncEnabled"/>
    <a n="zimbraFeatureVoiceUpsellURL"/>
    <a n="zimbraFilterBatchSize"/>
    <a n="zimbraFilterSleepInterval"/>
    <a n="zimbraForeignPrincipal"/>
    <a n="zimbraFreebusyLocalMailboxNotActive"/>
    <a n="zimbraGalSyncAccountBasedAutoCompleteEnabled"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraIMAvailableInteropGateways"/>
    <a n="zimbraIMService"/>
    <a n="zimbraImapEnabled"/>
    <a n="zimbraInterceptAddress"/>
    <a n="zimbraInterceptBody"/>
    <a n="zimbraInterceptFrom"/>
    <a n="zimbraInterceptSendHeadersOnly"/>
    <a n="zimbraInterceptSubject"/>
    <a n="zimbraIsDomainAdminAccount"/>
    <a n="zimbraJunkMessagesIndexingEnabled"/>
    <a n="zimbraLocale"/>
    <a n="zimbraMailCanonicalAddress"/>
    <a n="zimbraMailDumpsterLifetime"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="zimbraMailIdleSessionTimeout"/>
    <a n="zimbraMailMessageLifetime"/>
    <a n="zimbraMailMinPollingInterval"/>
    <a n="zimbraMailQuota"/>
    <a n="zimbraMailSpamLifetime"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailThreadingAlgorithm"/>
    <a n="zimbraMailTrashLifetime"/>
    <a n="zimbraMailTrustedSenderListMaxNumEntries"/>
    <a n="zimbraMaxContactsPerPage"/>
    <a n="zimbraMaxMailItemsPerPage"/>
    <a n="zimbraMaxVoiceItemsPerPage"/>
    <a n="zimbraMobileItemsToTrackPerFolderMaxSize"/>
    <a n="zimbraMobileMetadataMaxSizeEnabled"/>
    <a n="zimbraNewMailNotificationBody"/>
    <a n="zimbraNewMailNotificationFrom"/>
    <a n="zimbraNewMailNotificationSubject"/>
    <a n="zimbraNotes"/>
    <a n="zimbraPasswordAllowedChars"/>
    <a n="zimbraPasswordAllowedPunctuationChars"/>
    <a n="zimbraPasswordEnforceHistory"/>
    <a n="zimbraPasswordLocked"/>
    <a n="zimbraPasswordLockoutDuration"/>
    <a n="zimbraPasswordLockoutEnabled"/>
    <a n="zimbraPasswordLockoutFailureLifetime"/>
    <a n="zimbraPasswordLockoutFailureTime"/>
    <a n="zimbraPasswordLockoutLockedTime"/>
    <a n="zimbraPasswordLockoutMaxFailures"/>
    <a n="zimbraPasswordMaxAge"/>
    <a n="zimbraPasswordMaxLength"/>
    <a n="zimbraPasswordMinAge"/>
    <a n="zimbraPasswordMinAlphaChars"/>
    <a n="zimbraPasswordMinDigitsOrPuncs"/>
    <a n="zimbraPasswordMinLength"/>
    <a n="zimbraPasswordMinLowerCaseChars"/>
    <a n="zimbraPasswordMinNumericChars"/>
    <a n="zimbraPasswordMinPunctuationChars"/>
    <a n="zimbraPasswordMinUpperCaseChars"/>
    <a n="zimbraPasswordMustChange"/>
    <a n="zimbraPhoneticCompany"/>
    <a n="zimbraPhoneticFirstName"/>
    <a n="zimbraPhoneticLastName"/>
    <a n="zimbraPop3Enabled"/>
    <a n="zimbraPortalName"/>
    <a n="zimbraPrefAccountTreeOpen"/>
    <a n="zimbraPrefAdminConsoleWarnOnExit"/>
    <a n="zimbraPrefAdvancedClientEnforceMinDisplay"/>
    <a n="zimbraPrefAllowAddressForDelegatedSender"/>
    <a n="zimbraPrefAppleIcalDelegationEnabled"/>
    <a n="zimbraPrefAutoAddAddressEnabled"/>
    <a n="zimbraPrefAutoCompleteQuickCompletionOnComma"/>
    <a n="zimbraPrefAutoSaveDraftInterval"/>
    <a n="zimbraPrefAutocompleteAddressBubblesEnabled"/>
    <a n="zimbraPrefBccAddress"/>
    <a n="zimbraPrefBriefcaseReadingPaneLocation"/>
    <a n="zimbraPrefCalendarAcceptSignatureId"/>
    <a n="zimbraPrefCalendarAllowCancelEmailToSelf"/>
    <a n="zimbraPrefCalendarAllowForwardedInvite"/>
    <a n="zimbraPrefCalendarAllowPublishMethodInvite"/>
    <a n="zimbraPrefCalendarAlwaysShowMiniCal"/>
    <a n="zimbraPrefCalendarApptAllowAtendeeEdit"/>
    <a n="zimbraPrefCalendarApptReminderWarningTime"/>
    <a n="zimbraPrefCalendarApptVisibility"/>
    <a n="zimbraPrefCalendarAutoAcceptSignatureId"/>
    <a n="zimbraPrefCalendarAutoAddInvites"/>
    <a n="zimbraPrefCalendarAutoDeclineSignatureId"/>
    <a n="zimbraPrefCalendarAutoDenySignatureId"/>
    <a n="zimbraPrefCalendarDayHourEnd"/>
    <a n="zimbraPrefCalendarDayHourStart"/>
    <a n="zimbraPrefCalendarDeclineSignatureId"/>
    <a n="zimbraPrefCalendarDefaultApptDuration"/>
    <a n="zimbraPrefCalendarFirstDayOfWeek"/>
    <a n="zimbraPrefCalendarForwardInvitesTo"/>
    <a n="zimbraPrefCalendarInitialCheckedCalendars"/>
    <a n="zimbraPrefCalendarInitialView"/>
    <a n="zimbraPrefCalendarNotifyDelegatedChanges"/>
    <a n="zimbraPrefCalendarReminderDuration1"/>
    <a n="zimbraPrefCalendarReminderDuration2"/>
    <a n="zimbraPrefCalendarReminderEmail"/>
    <a n="zimbraPrefCalendarReminderFlashTitle"/>
    <a n="zimbraPrefCalendarReminderMobile"/>
    <a n="zimbraPrefCalendarReminderSendEmail"/>
    <a n="zimbraPrefCalendarReminderSoundsEnabled"/>
    <a n="zimbraPrefCalendarReminderYMessenger"/>
    <a n="zimbraPrefCalendarSendInviteDeniedAutoReply"/>
    <a n="zimbraPrefCalendarShowPastDueReminders"/>
    <a n="zimbraPrefCalendarTentativeSignatureId"/>
    <a n="zimbraPrefCalendarToasterEnabled"/>
    <a n="zimbraPrefCalendarUseQuickAdd"/>
    <a n="zimbraPrefCalendarWorkingHours"/>
    <a n="zimbraPrefChildVisibleAccount"/>
    <a n="zimbraPrefClientType"/>
    <a n="zimbraPrefColorMessagesEnabled"/>
    <a n="zimbraPrefComposeDirection"/>
    <a n="zimbraPrefComposeFormat"/>
    <a n="zimbraPrefComposeInNewWindow"/>
    <a n="zimbraPrefContactsDisableAutocompleteOnContactGroupMembers"/>
    <a n="zimbraPrefContactsExpandAppleContactGroups"/>
    <a n="zimbraPrefContactsInitialView"/>
    <a n="zimbraPrefContactsPerPage"/>
    <a n="zimbraPrefConvReadingPaneLocation"/>
    <a n="zimbraPrefConversationOrder"/>
    <a n="zimbraPrefDedupeMessagesSentToSelf"/>
    <a n="zimbraPrefDefaultPrintFontSize"/>
    <a n="zimbraPrefDefaultSignatureId"/>
    <a n="zimbraPrefDeleteInviteOnReply"/>
    <a n="zimbraPrefDisabledZimlets"/>
    <a n="zimbraPrefDisplayExternalImages"/>
    <a n="zimbraPrefFileSharingApplication"/>
    <a n="zimbraPrefFolderColorEnabled"/>
    <a n="zimbraPrefFolderTreeOpen"/>
    <a n="zimbraPrefForwardIncludeOriginalText"/>
    <a n="zimbraPrefForwardReplyFormat"/>
    <a n="zimbraPrefForwardReplyInOriginalFormat"/>
    <a n="zimbraPrefForwardReplyPrefixChar"/>
    <a n="zimbraPrefForwardReplySignatureId"/>
    <a n="zimbraPrefFromAddress"/>
    <a n="zimbraPrefFromDisplay"/>
    <a n="zimbraPrefGalAutoCompleteEnabled"/>
    <a n="zimbraPrefGalSearchEnabled"/>
    <a n="zimbraPrefGetMailAction"/>
    <a n="zimbraPrefGroupMailBy"/>
    <a n="zimbraPrefHtmlEditorDefaultFontColor"/>
    <a n="zimbraPrefHtmlEditorDefaultFontFamily"/>
    <a n="zimbraPrefHtmlEditorDefaultFontSize"/>
    <a n="zimbraPrefIMAutoLogin"/>
    <a n="zimbraPrefIMBuddyListSort"/>
    <a n="zimbraPrefIMCustomStatusMessage"/>
    <a n="zimbraPrefIMFlashIcon"/>
    <a n="zimbraPrefIMFlashTitle"/>
    <a n="zimbraPrefIMHideBlockedBuddies"/>
    <a n="zimbraPrefIMHideOfflineBuddies"/>
    <a n="zimbraPrefIMIdleStatus"/>
    <a n="zimbraPrefIMIdleTimeout"/>
    <a n="zimbraPrefIMInstantNotify"/>
    <a n="zimbraPrefIMLogChats"/>
    <a n="zimbraPrefIMLogChatsEnabled"/>
    <a n="zimbraPrefIMNotifyPresence"/>
    <a n="zimbraPrefIMNotifyStatus"/>
    <a n="zimbraPrefIMReportIdle"/>
    <a n="zimbraPrefIMSoundsEnabled"/>
    <a n="zimbraPrefIMToasterEnabled"/>
    <a n="zimbraPrefIMYahooId"/>
    <a n="zimbraPrefIdentityName"/>
    <a n="zimbraPrefImapSearchFoldersEnabled"/>
    <a n="zimbraPrefInboxReadLifetime"/>
    <a n="zimbraPrefInboxUnreadLifetime"/>
    <a n="zimbraPrefIncludeSharedItemsInSearch"/>
    <a n="zimbraPrefIncludeSpamInSearch"/>
    <a n="zimbraPrefIncludeTrashInSearch"/>
    <a n="zimbraPrefItemsPerVirtualPage"/>
    <a n="zimbraPrefJunkLifetime"/>
    <a n="zimbraPrefLabel"/>
    <a n="zimbraPrefListViewColumns"/>
    <a n="zimbraPrefLocale"/>
    <a n="zimbraPrefMailDefaultCharset"/>
    <a n="zimbraPrefMailFlashIcon"/>
    <a n="zimbraPrefMailFlashTitle"/>
    <a n="zimbraPrefMailFoldersCheckedForNewMsgIndicator"/>
    <a n="zimbraPrefMailForwardingAddress"/>
    <a n="zimbraPrefMailInitialSearch"/>
    <a n="zimbraPrefMailItemsPerPage"/>
    <a n="zimbraPrefMailLocalDeliveryDisabled"/>
    <a n="zimbraPrefMailPollingInterval"/>
    <a n="zimbraPrefMailSelectAfterDelete"/>
    <a n="zimbraPrefMailSendReadReceipts"/>
    <a n="zimbraPrefMailSignature"/>
    <a n="zimbraPrefMailSignatureContactId"/>
    <a n="zimbraPrefMailSignatureEnabled"/>
    <a n="zimbraPrefMailSignatureHTML"/>
    <a n="zimbraPrefMailSignatureStyle"/>
    <a n="zimbraPrefMailSoundsEnabled"/>
    <a n="zimbraPrefMailToasterEnabled"/>
    <a n="zimbraPrefMailTrustedSenderList"/>
    <a n="zimbraPrefMandatorySpellCheckEnabled"/>
    <a n="zimbraPrefMarkMsgRead"/>
    <a n="zimbraPrefMessageViewHtmlPreferred"/>
    <a n="zimbraPrefNewMailNotificationAddress"/>
    <a n="zimbraPrefNewMailNotificationEnabled"/>
    <a n="zimbraPrefOpenMailInNewWindow"/>
    <a n="zimbraPrefOutOfOfficeCacheDuration"/>
    <a n="zimbraPrefOutOfOfficeDirectAddress"/>
    <a n="zimbraPrefOutOfOfficeFromDate"/>
    <a n="zimbraPrefOutOfOfficeReply"/>
    <a n="zimbraPrefOutOfOfficeReplyEnabled"/>
    <a n="zimbraPrefOutOfOfficeUntilDate"/>
    <a n="zimbraPrefPop3DeleteOption"/>
    <a n="zimbraPrefPop3DownloadSince"/>
    <a n="zimbraPrefPop3IncludeSpam"/>
    <a n="zimbraPrefReadReceiptsToAddress"/>
    <a n="zimbraPrefReadingPaneEnabled"/>
    <a n="zimbraPrefReadingPaneLocation"/>
    <a n="zimbraPrefReplyIncludeOriginalText"/>
    <a n="zimbraPrefReplyToAddress"/>
    <a n="zimbraPrefReplyToDisplay"/>
    <a n="zimbraPrefReplyToEnabled"/>
    <a n="zimbraPrefSaveToSent"/>
    <a n="zimbraPrefSearchTreeOpen"/>
    <a n="zimbraPrefSentLifetime"/>
    <a n="zimbraPrefSentMailFolder"/>
    <a n="zimbraPrefSharedAddrBookAutoCompleteEnabled"/>
    <a n="zimbraPrefShortEmailAddress"/>
    <a n="zimbraPrefShortcuts"/>
    <a n="zimbraPrefShowCalendarWeek"/>
    <a n="zimbraPrefShowComposeDirection"/>
    <a n="zimbraPrefShowFragments"/>
    <a n="zimbraPrefShowSearchString"/>
    <a n="zimbraPrefShowSelectionCheckbox"/>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraPrefSortOrder"/>
    <a n="zimbraPrefSpellDictionary"/>
    <a n="zimbraPrefSpellIgnoreAllCaps"/>
    <a n="zimbraPrefSpellIgnoreWord"/>
    <a n="zimbraPrefStandardClientAccessibilityMode"/>
    <a n="zimbraPrefTagTreeOpen"/>
    <a n="zimbraPrefTasksReadingPaneLocation"/>
    <a n="zimbraPrefTimeZoneId"/>
    <a n="zimbraPrefTrashLifetime"/>
    <a n="zimbraPrefUseDefaultIdentitySettings"/>
    <a n="zimbraPrefUseKeyboardShortcuts"/>
    <a n="zimbraPrefUseRfc2231"/>
    <a n="zimbraPrefUseTimeZoneListInCalendar"/>
    <a n="zimbraPrefVoiceItemsPerPage"/>
    <a n="zimbraPrefWarnOnExit"/>
    <a n="zimbraPrefWhenInFolderIds"/>
    <a n="zimbraPrefWhenInFoldersEnabled"/>
    <a n="zimbraPrefWhenSentToAddresses"/>
    <a n="zimbraPrefWhenSentToEnabled"/>
    <a n="zimbraPrefZimletTreeOpen"/>
    <a n="zimbraPrefZimlets"/>
    <a n="zimbraPublicSharingEnabled"/>
    <a n="zimbraQuotaWarnInterval"/>
    <a n="zimbraQuotaWarnMessage"/>
    <a n="zimbraQuotaWarnPercent"/>
    <a n="zimbraReverseProxyUseExternalRoute"/>
    <a n="zimbraSignatureMinNumEntries"/>
    <a n="zimbraSignatureName"/>
    <a n="zimbraSmtpEnableTrace"/>
    <a n="zimbraSpamApplyUserFilters"/>
    <a n="zimbraSyncWindowSize"/>
    <a n="zimbraTextAnalyzer"/>
    <a n="zimbraWebClientShowOfflineLink"/>
    <a n="zimbraZimletAvailableZimlets"/>
    <a n="zimbraZimletLoadSynchronously"/>
    <a n="zimbraZimletUserProperties"/>

  </attrs>
</right>


<right name="setDomainAdminCalendarResourceAttrs" type="setAttrs" targetType="calresource">
  <desc>calendar resource attrs modifiable by domain admins for domain based access manager</desc>
  <attrs>    
    <a n="zimbraCalResAutoAcceptDecline"/>
    <a n="zimbraCalResAutoDeclineIfBusy"/>
    <a n="zimbraCalResAutoDeclineRecurring"/>
    <a n="zimbraCalResBuilding"/>
    <a n="zimbraCalResCapacity"/>
    <a n="zimbraCalResContactEmail"/>
    <a n="zimbraCalResContactName"/>
    <a n="zimbraCalResContactPhone"/>
    <a n="zimbraCalResFloor"/>
    <a n="zimbraCalResLocationDisplayName"/>
    <a n="zimbraCalResMaxNumConflictsAllowed"/>
    <a n="zimbraCalResMaxPercentConflictsAllowed"/>
    <a n="zimbraCalResRoom"/>
    <a n="zimbraCalResSite"/>
    <a n="zimbraCalResType"/>

  </attrs>
</right>

<right name="setDomainAdminDistributionListAttrs" type="setAttrs" targetType="dl">
  <desc>distribution list attrs modifiable by domain admins for domain based access manager</desc>
  <attrs>    
    <a n="cn"/>
    <a n="description"/>
    <a n="displayName"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraLocale"/>
    <a n="zimbraMailCanonicalAddress"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraNotes"/>
    <a n="zimbraPrefAllowAddressForDelegatedSender"/>
    <a n="zimbraPrefReplyToAddress"/>
    <a n="zimbraPrefReplyToDisplay"/>
    <a n="zimbraPrefReplyToEnabled"/>

  </attrs>
</right>

<right name="setDomainAdminDomainAttrs" type="setAttrs" targetType="domain">
  <desc>domain attrs modifiable by domain admins for domain based access manager</desc>
  <attrs>
    <a n="zimbraDomainDefaultCOSId"/> 
    <a n="description"/>
    <a n="zimbraAdminConsoleLoginURL"/>
    <a n="zimbraAdminConsoleLogoutURL"/>
    <a n="zimbraAvailableSkin"/>
    <a n="zimbraDNSCheckHostname"/>
    <a n="zimbraExternalImapHostname"/>
    <a n="zimbraExternalImapPort"/>
    <a n="zimbraExternalImapSSLHostname"/>
    <a n="zimbraExternalImapSSLPort"/>
    <a n="zimbraExternalPop3Hostname"/>
    <a n="zimbraExternalPop3Port"/>
    <a n="zimbraExternalPop3SSLHostname"/>
    <a n="zimbraExternalPop3SSLPort"/>
    <a n="zimbraExternalShareDomainWhitelistEnabled"/>
    <a n="zimbraExternalShareWhitelistDomain"/>
    <a n="zimbraExternalSharingEnabled"/>
    <a n="zimbraFreebusyExchangeServerType"/>
    <a n="zimbraGalAlwaysIncludeLocalCalendarResources"/>
    <a n="zimbraGalSyncMaxConcurrentClients"/>
    <a n="zimbraHelpAdminURL"/>
    <a n="zimbraHelpAdvancedURL"/>
    <a n="zimbraHelpDelegatedURL"/>
    <a n="zimbraHelpStandardURL"/>
    <a n="zimbraHideInGal"/>
    <a n="zimbraLocale"/>
    <a n="zimbraMailCanonicalAddress"/>
    <a n="zimbraMailForwardingAddress"/>
    <a n="zimbraMailStatus"/>
    <a n="zimbraMailTrustedSenderListMaxNumEntries"/>
    <a n="zimbraMobileItemsToTrackPerFolderMaxSize"/>
    <a n="zimbraMobileMetadataMaxSizeEnabled"/>
    <a n="zimbraNotes"/>
    <a n="zimbraPrefColorMessagesEnabled"/>
    <a n="zimbraPrefMailTrustedSenderList"/>
    <a n="zimbraPrefSkin"/>
    <a n="zimbraPrefSpellIgnoreWord"/>
    <a n="zimbraPrefTimeZoneId"/>
    <a n="zimbraPublicSharingEnabled"/>
    <a n="zimbraReverseProxyUseExternalRoute"/>
    <a n="zimbraReverseProxyUseExternalRouteIfAccountNotExist"/>
    <a n="zimbraSkinBackgroundColor"/>
    <a n="zimbraSkinFavicon"/>
    <a n="zimbraSkinForegroundColor"/>
    <a n="zimbraSkinLogoAppBanner"/>
    <a n="zimbraSkinLogoLoginBanner"/>
    <a n="zimbraSkinLogoURL"/>
    <a n="zimbraSkinSecondaryColor"/>
    <a n="zimbraSkinSelectionColor"/>
    <a n="zimbraWebClientAdminReference"/>
    <a n="zimbraWebClientLoginURL"/>
    <a n="zimbraWebClientLoginURLAllowedIP"/>
    <a n="zimbraWebClientLoginURLAllowedUA"/>
    <a n="zimbraWebClientLogoutURL"/>
    <a n="zimbraWebClientLogoutURLAllowedIP"/>
    <a n="zimbraWebClientLogoutURLAllowedUA"/>

  </attrs>
</right>


<!--
  =========================================================
  generated by zmprov -d grd and copy/paste the SOAP output
  good enough for now
  =========================================================
-->
    <right name="domainAdminAccountRights" type="combo">
      <desc>domain admin account right</desc>
      <rights>
        <r n="addAccountAlias"/>
        <r n="adminLoginAs"/>
        <r n="checkPasswordStrength"/>
        <r n="deleteAccount"/>
        <r n="getAccount"/>
        <r n="getAccountInfo"/>
        <r n="getAccountMembership"/>
        <r n="getMailboxInfo"/>
        <r n="listAccount"/>
        <r n="reindexMailbox"/>
        <r n="removeAccountAlias"/>
        <r n="renameAccount"/>
        <r n="setAccountPassword"/>
        <r n="setAdminSavedSearch"/>
        <r n="setDomainAdminAccountAndCalendarResourceAttrs"/>
        <r n="viewAccountAdminUI"/>
        <r n="viewAdminSavedSearch"/>
      </rights>
    </right>
    <right name="domainAdminCalendarResourceRights" type="combo">
      <desc>domain admin calresource right</desc>
      <rights>
        <r n="addCalendarResourceAlias"/>
        <r n="adminLoginCalendarResourceAs"/>
        <r n="checkCalendarResourcePasswordStrength"/>
        <r n="deleteCalendarResource"/>
        <r n="getCalendarResource"/>
        <r n="getCalendarResourceInfo"/>
        <r n="listCalendarResource"/>
        <r n="reindexCalendarResourceMailbox"/>
        <r n="removeCalendarResourceAlias"/>
        <r n="renameCalendarResource"/>
        <r n="setAdminSavedSearch"/>
        <r n="setCalendarResourcePassword"/>
        <r n="setDomainAdminAccountAndCalendarResourceAttrs"/>
        <r n="setDomainAdminCalendarResourceAttrs"/>
        <r n="viewAdminSavedSearch"/>
      </rights>
    </right>
    <right name="domainAdminCosRights" type="combo">
      <desc>domain admin cos right</desc>
      <rights>
        <r n="assignCos"/>
        <r n="getCos"/>
        <r n="listCos"/>
      </rights>
    </right>
    <right name="domainAdminDistributionListRights" type="combo">
      <desc>domain admin dl right</desc>
      <rights>
        <r n="addDistributionListAlias"/>
        <r n="addDistributionListMember"/>
        <r n="deleteDistributionList"/>
        <r n="getDistributionList"/>
        <r n="getDistributionListMembership"/>
        <r n="listDistributionList"/>
        <r n="removeDistributionListAlias"/>
        <r n="removeDistributionListMember"/>
        <r n="renameDistributionList"/>
        <r n="setDomainAdminDistributionListAttrs"/>
        <r n="viewDistributionListAdminUI"/>
      </rights>
    </right>
    <right name="domainAdminDomainRights" type="combo">
      <desc>domain admin domain right</desc>
      <rights>
        <r n="accessGAL"/>
        <r n="checkDomainMXRecord"/>
        <r n="countAccount"/>
        <r n="createAccount"/>
        <r n="createAlias"/>
        <r n="createCalendarResource"/>
        <r n="createDistributionList"/>
        <r n="deleteAlias"/>
        <r n="getDomain"/>
        <r n="listDomain"/>
        <r n="setDomainAdminDomainAttrs"/>
      </rights>
    </right>
    <right name="domainAdminServerRights" type="combo">
      <desc>domain admin server right</desc>
      <rights>
        <r n="flushCache"/>
      </rights>
    </right>
    <right name="domainAdminZimletRights" type="combo">
      <desc>domain admin zimlet right</desc>
      <rights>
        <r n="getZimlet"/>
        <r n="listZimlet"/>
      </rights>
    </right>
    
<!--
  =========================================================
                         end generated
  =========================================================
-->

<!--
  =======================================================
    The domain admin combo right for domain-ed objects
  =======================================================
-->

<right type="combo" name="domainAdminRights">
  <desc>domain admin rights</desc>
  <rights>
    <r n="domainAdminAccountRights"/>
    <r n="domainAdminCalendarResourceRights"/>
    <r n="domainAdminDistributionListRights"/>
    <r n="domainAdminDomainRights"/>
    
    <!-- not generated, put here manually -->
    <r n="listAlias"/>
  </rights>
</right>
      

</rights>


zimbra-rights-roles.xml


<?xml version="1.0" encoding="UTF-8"?>


<!-- 
========================================================
     combo rights
========================================================
-->

<rights>

<include file="zimbra-rights.xml"/>

<right type="combo" name="crossMailboxSearchRights">
  <desc>rights for managing cross mailbox search tasks in admin console</desc>
  <rights>
    <r n="manageCrossMailboxSearchTask"/>
    <r n="listServer"/>
    <r n="get.server.description"/>
    <r n="get.server.zimbraServiceEnabled"/>
    <r n="get.server.zimbraServiceInstalled"/>
    <r n="get.server.zimbraServiceHostname"/>
    <r n="get.server.zimbraId"/>
  </rights>
</right>
      
<right type="combo" name="mailQueueRights">
  <desc>rights for managing Mail Queue in admin console</desc>
  <rights>
    <r n="manageMailQueue"/>
    <r n="listServer"/>
    <r n="get.server.description"/>
    <r n="get.server.zimbraServiceEnabled"/>
    <r n="get.server.zimbraServiceInstalled"/>
    <r n="get.server.zimbraServiceHostname"/>
    <r n="get.server.zimbraId"/>
  </rights>
</right>


<!-- 
    ======================
    migration admin rights
    ======================
 -->
<help name="migrationAdminHelp">
  <desc>Instruction on granting rights for running the migration wizard</desc>
  <item>
    Grant migrationAdminDomainRights right on each domain the admin needs to run the migration wizard for.
    e.g. if a delegated admin needs to run the wizard for domain1.com and domain2.com
         zmprov grr domain domain1.com usr ma@test.com migrationAdminDomainRights
         zmprov grr domain domain2.com usr ma@test.com migrationAdminDomainRights
  </item>
  <item>
    Grant migrationAdminCosRights right on each cos the admin needs to access.
    e.g. if a delegated admin needs to access cos1 and cos2
         zmprov grr cos cos1 usr ma@test.com migrationAdminCosRights
         zmprov grr cos cos2 usr ma@test.com migrationAdminCosRights
  </item>
</help>

<right type="combo" name="migrationAdminDomainRights">
  <desc>rights targeted on domain-ed entries for running the migration wizard</desc>
  <help name="migrationAdminHelp"/>
  <rights>
    <r n="listDomain"/>
    <r n="createAccount"/>
    <r n="modifyAccount"/>
    <r n="createAlias"/>
    <r n="addAccountAlias"/>
    <r n="getAccountInfo"/>
    <r n="adminLoginAs"/>
  </rights>
</right>

<right type="combo" name="migrationAdminCosRights">
  <desc>cos rights for running the migration wizard</desc>
  <help name="migrationAdminHelp"/>
  <rights>
    <r n="assignCos"/>
    <r n="listCos"/>
  </rights>
</right>



<!-- 
    =================
    BES admin rights
    =================
 -->
<help name="besAdminHelp">
  <desc>Instruction on granting rights to a BES admin</desc>
  <item>Grant besAdminDomainRights right on each domain the admin needs to access.</item>
  <item>Grant besAdminServerRights right on each server the admin needs to access.</item>
</help>

<right type="combo" name="besAdminDomainRights">
  <desc>rights targeted on domain-ed entries for BES admin</desc>
  <help name="besAdminHelp"/>
  <rights>
    <r n="adminLoginAs"/>
  </rights>
</right>

<right type="combo" name="besAdminServerRights">
  <desc>server rights for BES admin</desc>
  <help name="besAdminHelp"/>
  <rights>
    <r n="getServer"/>
  </rights>
</right>

</rights>

zmprov grd



[zimbra@zcs804 docs]$ zmprov grd
#
#  Generated by: zmprov grd
#
#  Date: November 23, 2013
# 
#  Pacakges:
#       com.zimbra.cs.service.admin
#       com.zimbra.bp
#       com.zimbra.cert
#       com.zimbra.cs.network
#       com.zimbra.cs.network.license.service
#       com.zimbra.cs.service.backup
#       com.zimbra.cs.service.hsm
#       com.zimbra.xmbxsearch
# 


========================================
Package: com.zimbra.bp
========================================

------------------------------
BulkIMAPDataImportRequest

    Related rights:
        createMigrationTask
        modifyAccount
        adminLoginAs

    Notes:
        Admin has to have modifyAccount and adminLoginAs rights for each
        account that is being migrated.

        com.zimbra.cs.account.accesscontrol.PresetRight@30bb7235 right is
        required in order to access this SOAP handler.


------------------------------
BulkImportAccountsRequest

    Related rights:
        createAccount
        listAccount
        createTopDomain
        createSubDomain

    Notes:
        Only accounts on which the authed admin has listAccount right will be
        provisioned.

        com.zimbra.cs.account.accesscontrol.PresetRight@28370f7b right is
        required in order to automatically create top level domains.

        com.zimbra.cs.account.accesscontrol.PresetRight@47ba8be7 right is
        required in order to automatically create sub-domains.


------------------------------
GenerateBulkProvisionFileFromLDAPRequest

    Related rights:
        accessGAL

    Notes:

------------------------------
GetBulkIMAPImportTaskListRequest

    Related rights:

    Notes:
        TDB


------------------------------
PurgeBulkIMAPImportTasksRequest

    Related rights:

    Notes:
        TDB


========================================
Package: com.zimbra.cert
========================================

------------------------------
GenCSRRequest

    Related rights:
        generateCSR

    Notes:

------------------------------
GetCSRRequest

    Related rights:
        getCSR

    Notes:

------------------------------
GetCertRequest

    Related rights:
        getCertificateInfo

    Notes:

------------------------------
InstallCertRequest

    Related rights:
        installCertificate

    Notes:

------------------------------
UploadDomCertRequest

    Related rights:

    Notes:
        TDB


------------------------------
UploadProxyCARequest

    Related rights:

    Notes:
        TDB


------------------------------
VerifyCertKeyRequest

    Related rights:

    Notes:
        TDB


========================================
Package: com.zimbra.cs.network
========================================

------------------------------
GetSMIMEConfigRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyDomain right, which allows
        setting all attributes on domain, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.

        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyGlobalConfig right, which allows
        setting all attributes on global config, or grant the set attrs right
        just for the attributes the admin needs to set while creating an
        entry.


------------------------------
ModifySMIMEConfigRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyDomain right, which allows
        setting all attributes on domain, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.

        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyGlobalConfig right, which allows
        setting all attributes on global config, or grant the set attrs right
        just for the attributes the admin needs to set while creating an
        entry.


------------------------------
SearchMultiMailboxRequest

    Related rights:
        adminLoginAs

    Notes:
        Do not need any right, all admins are allowed.

        Will only search mailboxes on which the authed admin has effective:
        adminLoginAs right.


========================================
Package: com.zimbra.cs.network.license.service
========================================

------------------------------
ActivateLicenseRequest

    Related rights:
        installZCSLicense

    Notes:

------------------------------
GetLicenseRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
InstallLicenseRequest

    Related rights:
        installZCSLicense

    Notes:

========================================
Package: com.zimbra.cs.service.admin
========================================

------------------------------
AddAccountAliasRequest

    Related rights:
        addCalendarResourceAlias
        addAccountAlias
        createAlias

    Notes:
        Need createAlias right on the domain in which the alias is to be
        created.

        Need addAccountAlias right if adding alias for an account.

        Need addCalendarResourceAlias right if adding alias for a calendar
        resource.


------------------------------
AddAccountLoggerRequest

    Related rights:
        manageAccountLogger

    Notes:

------------------------------
AddDistributionListAliasRequest

    Related rights:
        addDistributionListAlias
        addGroupAlias
        createAlias

    Notes:

------------------------------
AddDistributionListMemberRequest

    Related rights:
        addDistributionListMember
        addGroupMember

    Notes:

------------------------------
AddGalSyncDataSourceRequest

    Related rights:
        createAccount

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyAccount right, which allows
        setting all attributes on account, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
AdminCreateWaitSetRequest

    Related rights:

    Notes:
        If allAccounts is specified, Only system admins are allowed.

        Otherwise, for each requested account, If the target is an account,
        need the adminLoginAs right; If the target is a calendar resource,
        need the R_adminLoginCalendarResourceAs right.


------------------------------
AdminDestroyWaitSetRequest

    Related rights:

    Notes:
        If the waitset is on all accounts, Only system admins are allowed.

        Otherwise, must be the owner of the specified waitset


------------------------------
AdminWaitSetRequest

    Related rights:

    Notes:
        If the waitset is on all accounts, Only system admins are allowed.

        Otherwise, must be the owner of the specified waitset


------------------------------
AuthRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
AutoCompleteGalRequest

    Related rights:
        accessGAL

    Notes:

------------------------------
AutoProvAccountRequest

    Related rights:
        autoProvisionAccount

    Notes:

------------------------------
AutoProvTaskControlRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
CheckAuthConfigRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
CheckBlobConsistencyRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
CheckDirectoryRequest

    Related rights:
        checkDirectoryOnFileSystem

    Notes:

------------------------------
CheckDomainMXRecordRequest

    Related rights:
        checkDomainMXRecord

    Notes:

------------------------------
CheckExchangeAuthRequest

    Related rights:
        checkExchangeAuthConfig

    Notes:

------------------------------
CheckGalConfigRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
CheckHealthRequest

    Related rights:
        checkHealth

    Notes:
        The checkHealth is needed only when the client making the SOAP request
        is localhost.


------------------------------
CheckHostnameResolveRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
CheckPasswordStrengthRequest

    Related rights:
        checkPasswordStrength
        checkCalendarResourcePasswordStrength

    Notes:

------------------------------
CheckRightRequest

    Related rights:
        checkRightUsr

    Notes:

------------------------------
ClearCookieRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
CompactIndexRequest

    Related rights:
        reindexMailbox
        reindexCalendarResourceMailbox

    Notes:

------------------------------
ComputeAggregateQuotaUsageRequest

    Related rights:

    Notes:
        TDB


------------------------------
ConfigureZimletRequest

    Related rights:

    Notes:
        TDB

        Currently the soap gets a uploaded blob containing metadata. The
        zimlet name is encoded in in the blob and is decoded in ZimletUtil. We
        need a way to know the zimlet name (and cos name if any, currently it
        seems to always only update the default cos) in the SOAP handler in
        order to check right.


------------------------------
CopyCosRequest

    Related rights:
        createCos
        getCos

    Notes:
        Need the getCos right on the source cos.


------------------------------
CountAccountRequest

    Related rights:
        countAccount

    Notes:

------------------------------
CountObjectsRequest

    Related rights:

    Notes:
        TDB


------------------------------
CreateAccountRequest

    Related rights:
        createAccount

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyAccount right, which allows
        setting all attributes on account, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.

        Notes on zimbraCOSId: If setting zimbraCOSId, needs the assignCos
        right on the cos.


------------------------------
CreateCalendarResourceRequest

    Related rights:
        createCalendarResource

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyCalendarResource right, which
        allows setting all attributes on calendar resource, or grant the set
        attrs right just for the attributes the admin needs to set while
        creating an entry.


------------------------------
CreateCosRequest

    Related rights:
        createCos

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyCos right, which allows setting
        all attributes on cos, or grant the set attrs right just for the
        attributes the admin needs to set while creating an entry.


------------------------------
CreateDataSourceRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
CreateDistributionListRequest

    Related rights:
        createDistributionList
        createGroup

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyDistributionList right, which
        allows setting all attributes on distribution list, or grant the set
        attrs right just for the attributes the admin needs to set while
        creating an entry.

        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyGroup right, which allows
        setting all attributes on group, or grant the set attrs right just for
        the attributes the admin needs to set while creating an entry.


------------------------------
CreateDomainRequest

    Related rights:
        createTopDomain
        createSubDomain

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyDomain right, which allows
        setting all attributes on domain, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
CreateGalSyncAccountRequest

    Related rights:
        createAccount

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyAccount right, which allows
        setting all attributes on account, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
CreateServerRequest

    Related rights:
        createServer

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyServer right, which allows
        setting all attributes on server, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
CreateSystemRetentionPolicyRequest

    Related rights:

    Notes:
        Need set attr right on attribute zimbraMailPurgeSystemPolicy


------------------------------
CreateUCServiceRequest

    Related rights:
        createUCService

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyUCService right, which allows
        setting all attributes on ucservice, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
CreateVolumeRequest

    Related rights:
        manageVolume

    Notes:

------------------------------
CreateXMPPComponentRequest

    Related rights:
        createXMPPComponent

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyXMPPComponent right, which
        allows setting all attributes on XMPP component, or grant the set
        attrs right just for the attributes the admin needs to set while
        creating an entry.


------------------------------
CreateZimletRequest

    Related rights:
        createZimlet

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyZimlet right, which allows
        setting all attributes on zimlet, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
DedupeBlobsRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
DelegateAuthRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
DeleteAccountRequest

    Related rights:
        deleteAccount

    Notes:

------------------------------
DeleteCalendarResourceRequest

    Related rights:
        deleteCalendarResource

    Notes:

------------------------------
DeleteCosRequest

    Related rights:
        deleteCos

    Notes:

------------------------------
DeleteDataSourceRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
DeleteDistributionListRequest

    Related rights:
        deleteDistributionList
        deleteGroup

    Notes:

------------------------------
DeleteDomainRequest

    Related rights:
        deleteDomain

    Notes:

------------------------------
DeleteGalSyncAccountRequest

    Related rights:
        deleteAccount

    Notes:

------------------------------
DeleteMailboxRequest

    Related rights:
        deleteAccount

    Notes:

------------------------------
DeleteServerRequest

    Related rights:
        deleteServer

    Notes:

------------------------------
DeleteSystemRetentionPolicyRequest

    Related rights:

    Notes:
        Need set attr right on attribute zimbraMailPurgeSystemPolicy


------------------------------
DeleteUCServiceRequest

    Related rights:
        deleteUCService

    Notes:

------------------------------
DeleteVolumeRequest

    Related rights:
        manageVolume

    Notes:

------------------------------
DeleteXMPPComponentRequest

    Related rights:
        deleteXMPPComponent

    Notes:

------------------------------
DeleteZimletRequest

    Related rights:
        deleteZimlet

    Notes:

------------------------------
DeployZimletRequest

    Related rights:
        deployZimlet

    Notes:
        If deploying on all servers, need the deployZimlet right on all
        servers or on global grant. If deploying on local server, need the
        deployZimlet on the local server.


------------------------------
DumpSessionsRequest

    Related rights:
        getSessions

    Notes:

------------------------------
ExportAndDeleteItemsRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
FixCalendarEndTimeRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
FixCalendarPriorityRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
FixCalendarTZRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
FlushCacheRequest

    Related rights:
        flushCache

    Notes:

------------------------------
GetAccountInfoRequest

    Related rights:
        getAccountInfo
        getCalendarResourceInfo

    Notes:

------------------------------
GetAccountLoggersRequest

    Related rights:
        manageAccountLogger

    Notes:

------------------------------
GetAccountMembershipRequest

    Related rights:
        getAccountMembership

    Notes:
        If the authed admin has get attr right on distribution list attr
        zimbraIsAdminGroup, it is returned in the response if set.


------------------------------
GetAccountRequest

    Related rights:
        getAccount

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getAccount right


------------------------------
GetAdminConsoleUICompRequest

    Related rights:
        viewAccountAdminUI
        viewDistributionListAdminUI

    Notes:
        If account/dl is not specified, Do not need any right, all admins are
        allowed.

        If an account is specified, need the viewAccountAdminUI right.

        If a dl is specified, need the viewDistributionListAdminUI right.

        Note, this call does not check for the get attr right for
        zimbraAdminConsoleUIComponents attribute on the account/dl, nor on the
        admin groups they belong. It simply checks the viewAccountAdminUI or
        viewDistributionListAdminUI right.


------------------------------
GetAdminExtensionZimletsRequest

    Related rights:
        listZimlet
        getZimlet

    Notes:
        Only zimlets on which the authed admin has effective listZimlet and
        getZimlet rights will appear in the response.

        e.g. there are zimlet1, zimlet2, zimlet3, if an admin has effective
        listZimlet and getZimlet rights on zimlet1, zimlet2, then only
        zimlet1, zimlet2 will appear in the GetAdminExtensionZimletsResponse.
        The GetAdminExtensionZimletsRequest itself will not get PERM_DENIED.


------------------------------
GetAdminSavedSearchesRequest

    Related rights:
        viewAdminSavedSearch

    Notes:

------------------------------
GetAggregateQuotaUsageOnServerRequest

    Related rights:

    Notes:
        TDB


------------------------------
GetAllAccountLoggersRequest

    Related rights:
        manageAccountLogger

    Notes:

------------------------------
GetAllAccountsRequest

    Related rights:
        listAccount
        getAccount

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllAdminAccountsRequest

    Related rights:
        listAccount
        getAccount

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllCalendarResourcesRequest

    Related rights:
        listCalendarResource
        getCalendarResource

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllConfigRequest

    Related rights:
        getGlobalConfig

    Notes:

------------------------------
GetAllCosRequest

    Related rights:
        listCos
        getCos

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllDistributionListsRequest

    Related rights:
        listDistributionList
        getDistributionList

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllDomainsRequest

    Related rights:
        listDomain
        getDomain

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllEffectiveRightsRequest

    Related rights:
        checkRightUsr
        checkRightGrp

    Notes:
        If grantee to check for is an account, needs the checkRightUsr right

        If grantee to check for is a group, needs the checkRightGrp right


------------------------------
GetAllFreeBusyProvidersRequest

    Related rights:
        getAllFreeBusyProviders

    Notes:

------------------------------
GetAllLocalesRequest

    Related rights:

    Notes:
        Allow all admins


------------------------------
GetAllMailboxesRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
GetAllRightsRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetAllServersRequest

    Related rights:
        listServer
        getServer

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllSkinsRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetAllUCProvidersRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetAllUCServicesRequest

    Related rights:
        listUCService
        getUCService

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllVolumesRequest

    Related rights:
        manageVolume

    Notes:

------------------------------
GetAllXMPPComponentsRequest

    Related rights:
        listXMPPComponent
        getXMPPComponent

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAllZimletsRequest

    Related rights:
        listZimlet
        getZimlet

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
GetAttributeInfoRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetCalendarResourceRequest

    Related rights:
        getCalendarResource

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getCalendarResource right


------------------------------
GetConfigRequest

    Related rights:

    Notes:
        Need get attr right for the specified attribute.


------------------------------
GetCosRequest

    Related rights:
        getCos

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getCos right


------------------------------
GetCreateObjectAttrsRequest

    Related rights:
        checkRightUsr

    Notes:

------------------------------
GetCurrentVolumesRequest

    Related rights:
        manageVolume

    Notes:

------------------------------
GetDataSourcesRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
GetDelegatedAdminConstraintsRequest

    Related rights:

    Notes:
        Need set attr right on attribute zimbraConstraint


------------------------------
GetDistributionListMembershipRequest

    Related rights:
        getDistributionListMembership

    Notes:

------------------------------
GetDistributionListRequest

    Related rights:
        getDistributionList
        getGroup

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getDistributionList right

        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getGroup right


------------------------------
GetDomainInfoRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetDomainRequest

    Related rights:
        getDomain

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getDomain right


------------------------------
GetEffectiveRightsRequest

    Related rights:
        checkRightUsr

    Notes:

------------------------------
GetFreeBusyQueueInfoRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
GetGrantsRequest

    Related rights:
        viewGrants

    Notes:
        Needs a get attr right of zimbraACE on each the target entry. Granting
        the viewGrants is one way to do it, which will give the right on all
        target types. Use inline right if more granularity is needed. See doc
        for the viewGrants right in zimbra-rights.xml for more details.


------------------------------
GetIndexStatsRequest

    Related rights:
        reindexMailbox
        reindexCalendarResourceMailbox

    Notes:

------------------------------
GetLicenseInfoRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetLoggerStatsRequest

    Related rights:
        getServerStats

    Notes:

------------------------------
GetMailQueueInfoRequest

    Related rights:
        manageMailQueue

    Notes:

------------------------------
GetMailQueueRequest

    Related rights:
        manageMailQueue

    Notes:

------------------------------
GetMailboxRequest

    Related rights:
        getMailboxInfo

    Notes:

------------------------------
GetMailboxStatsRequest

    Related rights:
        getMailboxStats

    Notes:

------------------------------
GetMemcachedClientConfigRequest

    Related rights:

    Notes:
        TDB


------------------------------
GetQuotaUsageRequest

    Related rights:
        getDomainQuotaUsage

    Notes:
        If a domain is specified, need the the domain right
        getDomainQuotaUsage. If domain is not specified, only system admins
        are allowed.


------------------------------
GetRightRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetRightsDocRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetServerNIfsRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetServerRequest

    Related rights:
        getServer

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getServer right


------------------------------
GetServerStatsRequest

    Related rights:
        getServerStats

    Notes:

------------------------------
GetServiceStatusRequest

    Related rights:
        getServiceStatus

    Notes:

------------------------------
GetSessionsRequest

    Related rights:
        getSessions

    Notes:

------------------------------
GetShareInfoRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
GetSystemRetentionPolicyRequest

    Related rights:

    Notes:
        Need get attr right on attribute zimbraMailPurgeSystemPolicy


------------------------------
GetUCServiceRequest

    Related rights:
        getUCService

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getUCService right


------------------------------
GetVersionInfoRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
GetVolumeRequest

    Related rights:
        manageVolume

    Notes:

------------------------------
GetXMPPComponentRequest

    Related rights:
        getXMPPComponent

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getXMPPComponent right


------------------------------
GetZimletRequest

    Related rights:
        getZimlet

    Notes:
        Attributes that are not allowed to be get by the authenticated admin
        will be returned as <a n="{attr-name}"
        pd="1"/>.To allow an admin to get all attributes, grant
        the getZimlet right


------------------------------
GetZimletStatusRequest

    Related rights:
        listZimlet
        listCos
        getZimlet

    Notes:
        Only zimlets on which the authed admin has effective listZimlet and
        getZimlet rights will appear in <zimlets> in the response.

        Only zimlets on which the authed admin has effective listCos right
        will be appear in <cos> in the response.

        e.g. there are zimlet1, zimlet2, zimlet3 and cos1, cos2 , if an admin
        has effective listZimlet and getZimlet rights on zimlet1, zimlet2,
        then only zimlet1, zimlet2 will appear in <zimlets> in
        GetZimletStatusResponse, and only cos1 will appear in <cos> in
        the resposne. The GetZimletStatusRequest itself will not get
        PERM_DENIED.


------------------------------
GrantRightRequest

    Related rights:

    Notes:
        Grantor must have the same or more rights on the same target or on a
        larger target set.


------------------------------
MailQueueActionRequest

    Related rights:
        manageMailQueue

    Notes:

------------------------------
MailQueueFlushRequest

    Related rights:
        manageMailQueue

    Notes:

------------------------------
MigrateAccountRequest

    Related rights:
        adminLoginAs

    Notes:

------------------------------
ModifyAccountRequest

    Related rights:
        assignCos

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyAccount right, which allows
        setting all attributes on account, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.

        Notes on zimbraCOSId: If setting zimbraCOSId, needs the assignCos
        right on the cos.If removing zimbraCOSId, needs the assignCos right on
        the domain default cos. (in domain attribute
        zimbraDomainDefaultCOSId).


------------------------------
ModifyAdminSavedSearchesRequest

    Related rights:
        setAdminSavedSearch

    Notes:

------------------------------
ModifyCalendarResourceRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyCalendarResource right, which
        allows setting all attributes on calendar resource, or grant the set
        attrs right just for the attributes the admin needs to set while
        creating an entry.


------------------------------
ModifyConfigRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyGlobalConfig right, which allows
        setting all attributes on global config, or grant the set attrs right
        just for the attributes the admin needs to set while creating an
        entry.


------------------------------
ModifyCosRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyCos right, which allows setting
        all attributes on cos, or grant the set attrs right just for the
        attributes the admin needs to set while creating an entry.


------------------------------
ModifyDataSourceRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
ModifyDelegatedAdminConstraintsRequest

    Related rights:

    Notes:
        Need set attr right on attribute zimbraConstraint


------------------------------
ModifyDistributionListRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyDistributionList right, which
        allows setting all attributes on distribution list, or grant the set
        attrs right just for the attributes the admin needs to set while
        creating an entry.


------------------------------
ModifyDomainRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyDomain right, which allows
        setting all attributes on domain, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.

        Notes on zimbraDomainDefaultCOSId: If setting
        zimbraDomainDefaultCOSId, needs the assignCos right on the cos.


------------------------------
ModifyServerRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyServer right, which allows
        setting all attributes on server, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
ModifySystemRetentionPolicyRequest

    Related rights:

    Notes:
        Need set attr right on attribute zimbraMailPurgeSystemPolicy


------------------------------
ModifyUCServiceRequest

    Related rights:

    Notes:
        All attrs provided in the attribute list have to settable by. the
        authed admin. You can grant the modifyUCService right, which allows
        setting all attributes on ucservice, or grant the set attrs right just
        for the attributes the admin needs to set while creating an entry.


------------------------------
ModifyVolumeRequest

    Related rights:
        manageVolume

    Notes:

------------------------------
ModifyZimletRequest

    Related rights:
        manageZimlet
        modifyZimlet

    Notes:
        For acl: needs manageZimlet on cos.

        For status: needs right to set zimbraZimletEnabled on the zimlet

        For priority: needs right to set zimbraZimletPriority on *all*
        zimlets, because potentially the attribute can be modified on all
        zimlets.


------------------------------
NoOpRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
PingRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
PurgeAccountCalendarCacheRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
PurgeFreeBusyQueueRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
PurgeMessagesRequest

    Related rights:
        purgeMessages

    Notes:
        If account ids are specified, needs effective purgeMessages right for
        each account. If account ids are not specified, the authed account has
        to be a system admin.


------------------------------
PushFreeBusyRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
QueryWaitSetRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
ReIndexRequest

    Related rights:
        reindexMailbox
        reindexCalendarResourceMailbox

    Notes:

------------------------------
RecalculateMailboxCountsRequest

    Related rights:
        adminLoginAs
        adminLoginCalendarResourceAs

    Notes:
        If the target is an account, need the adminLoginAs right; If the
        target is a calendar resource, need the R_adminLoginCalendarResourceAs
        right.


------------------------------
ReloadLocalConfigRequest

    Related rights:

    Notes:
        TDB


------------------------------
ReloadMemcachedClientConfigRequest

    Related rights:

    Notes:
        TDB


------------------------------
RemoveAccountAliasRequest

    Related rights:
        removeAccountAlias
        removeCalendarResourceAlias
        deleteAlias

    Notes:

------------------------------
RemoveAccountLoggerRequest

    Related rights:
        manageAccountLogger

    Notes:

------------------------------
RemoveDistributionListAliasRequest

    Related rights:
        removeDistributionListAlias
        removeGroupAlias
        deleteAlias

    Notes:

------------------------------
RemoveDistributionListMemberRequest

    Related rights:
        removeDistributionListMember
        removeGroupMember

    Notes:

------------------------------
RenameAccountRequest

    Related rights:
        renameAccount
        createAccount

    Notes:

------------------------------
RenameCalendarResourceRequest

    Related rights:
        renameCalendarResource
        createCalendarResource

    Notes:

------------------------------
RenameCosRequest

    Related rights:
        renameCos

    Notes:

------------------------------
RenameDistributionListRequest

    Related rights:
        renameDistributionList
        createDistributionList

    Notes:

------------------------------
RenameUCServiceRequest

    Related rights:
        renameUCService

    Notes:

------------------------------
ResetAllLoggersRequest

    Related rights:

    Notes:
        TDB


------------------------------
RevokeRightRequest

    Related rights:

    Notes:
        Grantor must have the same or more rights on the same target or on a
        larger target set.


------------------------------
RunUnitTestsRequest

    Related rights:

    Notes:
        Do not need any right, all admins are allowed.


------------------------------
SearchAccountsRequest

    Related rights:
        getAccount
        getCalendarResource
        getDistributionList
        getDomain
        listAccount
        listCalendarResource
        listDistributionList
        listDomain

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
SearchAutoProvDirectoryRequest

    Related rights:
        autoProvisionAccount

    Notes:

------------------------------
SearchCalendarResourcesRequest

    Related rights:
        getCalendarResource
        listCalendarResource

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
SearchDirectoryRequest

    Related rights:
        getAccount
        getCalendarResource
        getDistributionList
        getDomain
        getCos
        listAccount
        listCalendarResource
        listDistributionList
        listDomain
        listCos

    Notes:
        If the authenticated admin does not have the corresponding list{Entry}
        right for an entry, the entry is skipped in the
        getAllXXX/searchXXX/searchDirectoryResponse, no PERM_DENIED exception
        will be thrown. Attributes that are not allowed to be get by the
        authenticated admin will be returned as <a
        n="{attr-name}" pd="1"/>.


------------------------------
SearchGalRequest

    Related rights:
        accessGAL

    Notes:

------------------------------
SetCurrentVolumeRequest

    Related rights:
        manageVolume

    Notes:

------------------------------
SetPasswordRequest

    Related rights:
        setAccountPassword
        changeAccountPassword
        setCalendarResourcePassword
        changeCalendarResourcePassword

    Notes:

------------------------------
SyncGalAccountRequest

    Related rights:

    Notes:
        TDB


------------------------------
UndeployZimletRequest

    Related rights:
        deployZimlet

    Notes:
        Need the deployZimlet right on all servers.


------------------------------
UpdatePresenceSessionIdRequest

    Related rights:

    Notes:
        Need set attr right on attribute zimbraUCPresenceSessionId


------------------------------
VerifyIndexRequest

    Related rights:
        reindexMailbox
        reindexCalendarResourceMailbox

    Notes:

------------------------------
VerifyStoreManagerRequest

    Related rights:

    Notes:
        TDB


========================================
Package: com.zimbra.cs.service.backup
========================================

------------------------------
BackupAccountQueryRequest

    Related rights:
        backupAccount

    Notes:

------------------------------
BackupQueryRequest

    Related rights:
        backupAccount

    Notes:

------------------------------
BackupRequest

    Related rights:
        backupAccount

    Notes:

------------------------------
ExportMailboxRequest

    Related rights:
        moveAccountMailbox
        moveCalendarResourceMailbox
        moveMailboxFromServer
        moveMailboxToServer

    Notes:
        If the account is a calendar resource, need
        moveCalendarResourceMailbox right on the calendar resource.

        If the account is a regular account, need moveAccountMailbox right on
        the account.

        Need moveMailboxFromServer right on the source server

        Need moveMailboxToServer right on the target server


------------------------------
GetMailboxVersionRequest

    Related rights:
        moveAccountMailbox
        moveCalendarResourceMailbox
        moveMailboxFromServer

    Notes:
        If the account is a calendar resource, need
        moveCalendarResourceMailbox right on the calendar resource.

        If the account is a regular account, need moveAccountMailbox right on
        the account.

        Need moveMailboxFromServer right on the source server


------------------------------
GetMailboxVolumesRequest

    Related rights:
        moveAccountMailbox
        moveCalendarResourceMailbox
        moveMailboxFromServer

    Notes:
        If the account is a calendar resource, need
        moveCalendarResourceMailbox right on the calendar resource.

        If the account is a regular account, need moveAccountMailbox right on
        the account.

        Need moveMailboxFromServer right on the source server


------------------------------
MoveMailboxRequest

    Related rights:
        moveAccountMailbox
        moveCalendarResourceMailbox
        moveMailboxFromServer

    Notes:
        If the account is a calendar resource, need
        moveCalendarResourceMailbox right on the calendar resource.

        If the account is a regular account, need moveAccountMailbox right on
        the account.

        Need moveMailboxFromServer right on the source server


------------------------------
PurgeMovedMailboxRequest

    Related rights:
        moveAccountMailbox
        moveCalendarResourceMailbox
        moveMailboxFromServer

    Notes:
        If the account is a calendar resource, need
        moveCalendarResourceMailbox right on the calendar resource.

        If the account is a regular account, need moveAccountMailbox right on
        the account.

        Need moveMailboxFromServer right on the source server


------------------------------
QueryMailboxMoveRequest

    Related rights:

    Notes:
        TDB


------------------------------
RegisterMailboxMoveOutRequest

    Related rights:

    Notes:
        TDB


------------------------------
ReloadAccountRequest

    Related rights:

    Notes:
        TDB


------------------------------
RestoreRequest

    Related rights:
        restoreAccount

    Notes:

------------------------------
RolloverRedoLogRequest

    Related rights:
        rolloverRedoLog

    Notes:

------------------------------
ScheduleBackupsRequest

    Related rights:
        backupAccount

    Notes:

------------------------------
UnloadMailboxRequest

    Related rights:

    Notes:
        TDB


------------------------------
UnregisterMailboxMoveOutRequest

    Related rights:

    Notes:
        TDB


========================================
Package: com.zimbra.cs.service.hsm
========================================

------------------------------
AbortHsmRequest

    Related rights:

    Notes:
        Only system admins are allowed.


------------------------------
GetApplianceHSMFSRequest

    Related rights:
        manageVolume

    Notes:
        Requires manageVolume right on the target server

        Lists file systems under /opt/zimbra/data/mailboxd/hsm/ by parsing the
        output of df -x tmpfs -P -T -B 1024 command

        Currently applicable only to Zimbra Appliance


------------------------------
GetHsmStatusRequest

    Related rights:
        getHSMStatus

    Notes:
        Requires getHSMStatus right on the target server


------------------------------
HsmRequest

    Related rights:
        moveBlobs

    Notes:
        Requires moveBlobs right on the target server


------------------------------
MoveBlobsRequest

    Related rights:
        moveBlobs

    Notes:
        Requires moveBlobs right on the target server
Verified Against: Zimbra Collaboration 8.0 Date Created: 04/16/2014
Article ID: https://wiki.zimbra.com/index.php?title=Ajcody-System-Documentation-For-Rights-Included-In-ZCS-Install Date Modified: 2016-06-21



Try Zimbra

Try Zimbra Collaboration with a 60-day free trial.
Get it now »

Want to get involved?

You can contribute in the Community, Wiki, Code, or development of Zimlets.
Find out more. »

Looking for a Video?

Visit our YouTube channel to get the latest webinars, technology news, product overviews, and so much more.
Go to the YouTube channel »




Jump to: navigation, search