<def-group>
  <definition class="compliance" id="account_unique_id" version="1">
    {{{ oval_metadata("All accounts on the system should have unique IDs for proper accountability.") }}}
      <criteria comment="There should not exist duplicate user IDs entries in /etc/passwd">
        <criterion test_ref="test_etc_passwd_no_duplicate_user_ids" />
      </criteria>

  </definition>

  <!-- collect information about all users -->
  <unix:password_object id="obj_all_uids" version="1">
    <unix:username operation="pattern match">.*</unix:username>
  </unix:password_object>

  <!-- variable storing count of all uids - including duplicates -->
  <local_variable id="variable_count_of_all_uids" datatype="int" version="1"
  comment="Count of all uids (including duplicates if any)">
    <count>
      <object_component item_field="user_id" object_ref="obj_all_uids" />
    </count>
  </local_variable>

  <!-- Turn the OVAL variable representing count of user ids into OVAL object
       (for use in <variable_test> below)-->
  <ind:variable_object id="obj_count_of_all_uids" version="1">
    <ind:var_ref>variable_count_of_all_uids</ind:var_ref>
  </ind:variable_object>

  <!-- OVAL variable to hold the count of unique user ids defined in /etc/passwd -->
  <local_variable id="variable_count_of_unique_uids" datatype="int" version="1"
  comment="Count of unique uids">
    <count>
      <unique>
        <object_component item_field="user_id" object_ref="obj_all_uids" />
      </unique>
    </count>
  </local_variable>

  <!-- this state checks that both counts (unique and non-unique) are the same -->
  <ind:variable_state id="state_no_duplicate_uids" version="1">
    <ind:value var_ref="variable_count_of_unique_uids" datatype="int"
    operation="equals" var_check="at least one" />
  </ind:variable_state>

  <ind:variable_test id="test_etc_passwd_no_duplicate_user_ids" check="all" check_existence="all_exist"
  comment="There should not exist duplicate user ids in /etc/passwd" version="1">
    <ind:object object_ref="obj_count_of_all_uids" />
    <ind:state state_ref="state_no_duplicate_uids" />
  </ind:variable_test>

</def-group>
