Maybe a "code" attribute like the security subsystem ? So we can handle two situations:

1) User-defined types with "class-name" + "module"(optional)
2) Built-in types with "code"

Where in #2, we resolve the proper type based on a alias like: Partition, IdentityType or Relationship. Which are core concepts in PL IDM.

FYI, the configuration above can be easily replaced by:

supported-types supports-all="true"

So no additional supported-type is necessary in order to support all PL IDM types and their corresponding sub-types.

The supported-type will be mostly used when users want a more fine-grained configuration, where only some specific types are supported by a specific store. Eg.:

ldap-store may support only User (which is a sub-type of IdentityType) and Grant (which is a sub-type of Relationship). And no Partition type is support.

jpa-store may support only GroupRole (which is a subtype of Relationship).