<!--
  DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 
  Copyright 2009 Sun Microsystems, Inc. All rights reserved.
  
  Use is subject to License Terms
--> 

<!ENTITY % boolean "(yes | no | on | off | 1 | 0 | true | false)">
<!ENTITY % severity "(FINEST|FINER|FINE|CONFIG|INFO|WARNING|SEVERE|ALERT|FATAL)">

<!-- iAS Application client container configuration 
    send-password   Specifies whether client authentication credentials should 
                    be sent to the server. Without credential all accesses to 
                    protected EJBs will result in exceptions.
-->
<!ELEMENT client-container (target-server, auth-realm?, client-credential?, log-service?, property*)>
<!ATTLIST client-container send-password %boolean; "true"> 

<!-- Target server's IIOP listener configuration 
    name        Application server instance name 
    address     ip address or hostname (resolvable by DNS) of the ORB
    port        port number of the ORB
-->
<!ELEMENT target-server (description?, security?)>
<!ATTLIST target-server name             CDATA     #REQUIRED
                        address          CDATA     #REQUIRED
                        port             CDATA     #REQUIRED>
                                                  
<!ELEMENT description (#PCDATA)>

<!-- Default client credentials that will be sent to server. If this element 
     is present, then it will be automatically sent to the server, without
     prompting the user for usename and password on the client side. 
     user-name  User name credential   
     password   Password credential
     realm      The realm (specified by name) where credentials are to be 
                resolved.
 -->
<!ELEMENT client-credential (property*)>
<!ATTLIST client-credential user-name CDATA   #REQUIRED
                            password  CDATA   #REQUIRED
                            realm     CDATA   #IMPLIED>
                                
<!-- Logging service configuration. 

     file   By default log file will be at $APPCLIENT_ROOT/logs/client.log
            Can use this attribute to specify an alternate location.
     level  sets the base level of severity. Messages at or above this 
            setting get logged into the log file.
 -->
<!ELEMENT log-service (property*)>
<!ATTLIST log-service  file                      CDATA      #IMPLIED
                       level                     %severity; "SEVERE">

<!-- SSL security  configuration for IIOP/SSL communication with 
     the target-server.
 -->
<!ELEMENT security (ssl, cert-db)>

<!-- Define SSL processing parameters

     cert-nickname nickname of the server certificate in the certificate database 
                   or the PKCS#11 token. In the certificate, the name format is
                   tokenname:nickname. Including the tokenname: part of the name 
                   in this attribute is optional. 

     ssl2-enabled  (optional) Determines whether SSL2 is enabled. 

     ssl3-enabled  (optional) Determines whether SSL3 is enabled. 

                   If both SSL2 and SSL3 are enabled for a virtual server, the server 
                   tries SSL3 encryption first. If that fails, the server tries SSL2
                   encryption. 

    ssl2ciphers    (optional) A space-separated list of the SSL2 ciphers used, with 
                   the prefix + to enable or - to disable, for example +rc4. Allowed 
                   values are rc4, rc4export, rc2, rc2export, idea, des, desede3. 

    ssl3-tls-ciphers (optional) A space-separated list of the SSL3 ciphers used, with 
                     the prefix + to enable or - to disable, for example +rsa_des_sha.
                     Allowed SSL3 values are rsa_rc4_128_md5, rsa3des_sha, rsa_des_sha, 
                     rsa_rc4_40_md5, rsa_rc2_40_md5, rsa_null_md5. Allowed TLS values 
                     are rsa_des_56_sha, rsa_rc4_56_sha. 

    tls-enabled     (optional) Determines whether TLS is enabled. 

    tls-rollback-enabled  (optional) Determines whether TLS rollback is enabled. TLS 
                          rollback should be enabled for Microsoft Internet Explorer 
                          5.0 and 5.5. 

    client-auth-enabled   (optional) Determines whether SSL3 client authentication is 
                          performed on every request, independent of ACL-based access 
                          control.
--> 
<!ELEMENT ssl EMPTY>
<!ATTLIST ssl cert-nickname        CDATA    #IMPLIED
              ssl2-enabled         CDATA    "false"
              ssl2-ciphers         CDATA    #IMPLIED
              ssl3-enabled         CDATA    "true"
              ssl3-tls-ciphers     CDATA    #IMPLIED
              tls-enabled          CDATA    "true"
              tls-rollback-enabled CDATA    "true">

<!-- Location and password to read the Certificate Database. iAS
     (actually NSS) will provide utilities with which a certificate 
     database can be created.

     path     Specifies the absolute path where the cert database (cert7.db) 
              is stored. 
     password needed to open and read a cert database
 -->
<!ELEMENT cert-db EMPTY>
<!ATTLIST cert-db path       CDATA #REQUIRED
                  password   CDATA #REQUIRED>

<!-- JAAS is available on Application Client Container. 
     Optional configuration for JAAS authentication realm.
     
     name       defines the name of this realm
     classname  defines the java class which implements this realm
 -->
<!ELEMENT auth-realm (property*)>
<!ATTLIST auth-realm name            CDATA   #REQUIRED
                     classname       CDATA   #REQUIRED>
               
<!-- Syntax for supplying properties as name value pairs -->
<!ELEMENT property EMPTY>
<!ATTLIST property name  CDATA  #REQUIRED
                   value CDATA  #REQUIRED>
