<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC
   "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
   "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>
   <description>Security Tests Using FORM Authentication</description>

   <!-- The Welcome File List -->
   <welcome-file-list>
      <welcome-file>index.html</welcome-file>
   </welcome-file-list>

   <!-- ### Security -->
   <security-constraint>
      <web-resource-collection>
         <web-resource-name>Restricted</web-resource-name>
         <description>Declarative security tests</description>
         <url-pattern>/*</url-pattern>
         <http-method>HEAD</http-method>
         <http-method>GET</http-method>
         <http-method>POST</http-method>
         <http-method>PUT</http-method>
         <http-method>DELETE</http-method>
      </web-resource-collection>
      <auth-constraint>
         <description>Only authenticated users can access secure content</description>
         <role-name>ExternalAuthUser</role-name>
      </auth-constraint>

      <user-data-constraint>
         <transport-guarantee>NONE</transport-guarantee>
      </user-data-constraint>
   </security-constraint>

   <login-config>
      <auth-method>BASIC</auth-method>
      <realm-name>JBossTest Servlets</realm-name>
   </login-config>

   <security-role>
      <description>A user validated by an X-MyAuthentication</description>
      <role-name>ExternalAuthUser</role-name>
   </security-role>

</web-app>
