<!--
 DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
 
 Copyright 1997-2007 Sun Microsystems, Inc. All rights reserved.
 
 The contents of this file are subject to the terms of either the GNU
 General Public License Version 2 only ("GPL") or the Common Development
 and Distribution License("CDDL") (collectively, the "License").  You
 may not use this file except in compliance with the License. You can obtain
 a copy of the License at https://glassfish.dev.java.net/public/CDDL+GPL.html
 or glassfish/bootstrap/legal/LICENSE.txt.  See the License for the specific
 language governing permissions and limitations under the License.
 
 When distributing the software, include this License Header Notice in each
 file and include the License file at glassfish/bootstrap/legal/LICENSE.txt.
 Sun designates this particular file as subject to the "Classpath" exception
 as provided by Sun in the GPL Version 2 section of the License file that
 accompanied this code.  If applicable, add the following below the License
 Header, with the fields enclosed by brackets [] replaced by your own
 identifying information: "Portions Copyrighted [year]
 [name of copyright owner]"
 
 Contributor(s):
 
 If you wish your version of this file to be governed by only the CDDL or
 only the GPL Version 2, indicate your decision by adding "[Contributor]
 elects to include this software in this distribution under the [CDDL or GPL
 Version 2] license."  If you don't indicate a single choice of license, a
 recipient has the option to distribute your version of this file under
 either the CDDL, the GPL Version 2 or to extend the choice of license to
 its licensees as provided above.  However, if you add GPL Version 2 code
 and therefore, elected the GPL Version 2 license, then the option applies
 only if the new code is made subject to such option by the copyright
 holder.
-->


<!ENTITY % boolean "(yes | no | on | off | 1 | 0 | true | false)">
<!ENTITY % severity "(FINEST|FINER|FINE|CONFIG|INFO|WARNING|SEVERE|ALERT|FATAL)">

<!-- iAS Application client container configuration 
    send-password   Specifies whether client authentication credentials should 
                    be sent to the server. Without credential all accesses to 
                    protected EJBs will result in exceptions.
-->
<!ELEMENT client-container (target-server, auth-realm?, client-credential?, log-service?, property*)>
<!ATTLIST client-container send-password %boolean; "true"> 

<!-- Target server's IIOP listener configuration 
    name        Application server instance name 
    address     ip address or hostname (resolvable by DNS) of the ORB
    port        port number of the ORB
-->
<!ELEMENT target-server (description?, security?)>
<!ATTLIST target-server name             CDATA     #REQUIRED
                        address          CDATA     #REQUIRED
                        port             CDATA     #REQUIRED>
                                                  
<!ELEMENT description (#PCDATA)>

<!-- Default client credentials that will be sent to server. If this element 
     is present, then it will be automatically sent to the server, without
     prompting the user for usename and password on the client side. 
     user-name  User name credential   
     password   Password credential
     realm      The realm (specified by name) where credentials are to be 
                resolved.
 -->
<!ELEMENT client-credential (property*)>
<!ATTLIST client-credential user-name CDATA   #REQUIRED
                            password  CDATA   #REQUIRED
                            realm     CDATA   #IMPLIED>
                                
<!-- Logging service configuration. 

     file   By default log file will be at $APPCLIENT_ROOT/logs/client.log
            Can use this attribute to specify an alternate location.
     level  sets the base level of severity. Messages at or above this 
            setting get logged into the log file.
 -->
<!ELEMENT log-service (property*)>
<!ATTLIST log-service  file                      CDATA      #IMPLIED
                       level                     %severity; "SEVERE">

<!-- SSL security  configuration for IIOP/SSL communication with 
     the target-server.
 -->
<!ELEMENT security (ssl, cert-db)>

<!-- Define SSL processing parameters

     cert-nickname nickname of the server certificate in the certificate database 
                   or the PKCS#11 token. In the certificate, the name format is
                   tokenname:nickname. Including the tokenname: part of the name 
                   in this attribute is optional. 

     ssl2-enabled  (optional) Determines whether SSL2 is enabled. 

     ssl3-enabled  (optional) Determines whether SSL3 is enabled. 

                   If both SSL2 and SSL3 are enabled for a virtual server, the server 
                   tries SSL3 encryption first. If that fails, the server tries SSL2
                   encryption. 

    ssl2ciphers    (optional) A space-separated list of the SSL2 ciphers used, with 
                   the prefix + to enable or - to disable, for example +rc4. Allowed 
                   values are rc4, rc4export, rc2, rc2export, idea, des, desede3. 

    ssl3-tls-ciphers (optional) A space-separated list of the SSL3 ciphers used, with 
                     the prefix + to enable or - to disable, for example +rsa_des_sha.
                     Allowed SSL3 values are rsa_rc4_128_md5, rsa3des_sha, rsa_des_sha, 
                     rsa_rc4_40_md5, rsa_rc2_40_md5, rsa_null_md5. Allowed TLS values 
                     are rsa_des_56_sha, rsa_rc4_56_sha. 

    tls-enabled     (optional) Determines whether TLS is enabled. 

    tls-rollback-enabled  (optional) Determines whether TLS rollback is enabled. TLS 
                          rollback should be enabled for Microsoft Internet Explorer 
                          5.0 and 5.5. 

    client-auth-enabled   (optional) Determines whether SSL3 client authentication is 
                          performed on every request, independent of ACL-based access 
                          control.
--> 
<!ELEMENT ssl EMPTY>
<!ATTLIST ssl cert-nickname        CDATA    #IMPLIED
              ssl2-enabled         CDATA    "false"
              ssl2-ciphers         CDATA    #IMPLIED
              ssl3-enabled         CDATA    "true"
              ssl3-tls-ciphers     CDATA    #IMPLIED
              tls-enabled          CDATA    "true"
              tls-rollback-enabled CDATA    "true">

<!-- Location and password to read the Certificate Database. iAS
     (actually NSS) will provide utilities with which a certificate 
     database can be created.

     path     Specifies the absolute path where the cert database (cert7.db) 
              is stored. 
     password needed to open and read a cert database
 -->
<!ELEMENT cert-db EMPTY>
<!ATTLIST cert-db path       CDATA #REQUIRED
                  password   CDATA #REQUIRED>

<!-- JAAS is available on Application Client Container. 
     Optional configuration for JAAS authentication realm.
     
     name       defines the name of this realm
     classname  defines the java class which implements this realm
 -->
<!ELEMENT auth-realm (property*)>
<!ATTLIST auth-realm name            CDATA   #REQUIRED
                     classname       CDATA   #REQUIRED>
               
<!-- Syntax for supplying properties as name value pairs -->
<!ELEMENT property EMPTY>
<!ATTLIST property name  CDATA  #REQUIRED
                   value CDATA  #REQUIRED>
