<?xml version="1.0" encoding="ISO-8859-1"?>
<!--
Copyright Red Hat, Inc.

SPDX-License-Identifier: GPL-2.0-or-later
-->
<web-app>

    <display-name>ACME Responder</display-name>

    <listener>
        <listener-class>org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap</listener-class>
    </listener>

    <context-param>
        <param-name>resteasy.resource.method-interceptors</param-name>
        <param-value>org.jboss.resteasy.core.ResourceMethodSecurityInterceptor</param-value>
    </context-param>

    <servlet>
        <servlet-name>ACME</servlet-name>
        <servlet-class>org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher</servlet-class>
        <init-param>
            <param-name>javax.ws.rs.Application</param-name>
            <param-value>org.dogtagpki.acme.server.ACMEApplication</param-value>
        </init-param>
    </servlet>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/login</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/logout</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/enable</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/disable</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/directory</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/new-nonce</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/new-account</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/new-order</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/authz/*</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/chall/*</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/order/*</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/acct/*</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/cert/*</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>ACME</servlet-name>
        <url-pattern>/revoke-cert</url-pattern>
    </servlet-mapping>

    <security-constraint>
        <display-name>Allow somebody with credentials to log in</display-name>
        <web-resource-collection>
            <url-pattern>/login</url-pattern>
            <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
            <role-name>*</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

    <security-constraint>
        <display-name>Allow anybody to get login information</display-name>
        <web-resource-collection>
            <url-pattern>/login</url-pattern>
            <http-method-omission>POST</http-method-omission>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

    <security-constraint>
        <display-name>Allow anybody to log out</display-name>
        <web-resource-collection>
            <web-resource-name>Logout Service</web-resource-name>
            <url-pattern>/logout</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

    <security-constraint>
        <display-name>Allow administrators to enable ACME services</display-name>
        <web-resource-collection>
            <url-pattern>/enable</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>Administrators</role-name>
            <role-name>Enterprise ACME Administrators</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

    <security-constraint>
        <display-name>Allow administrators to disable ACME services</display-name>
        <web-resource-collection>
            <url-pattern>/disable</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>Administrators</role-name>
            <role-name>Enterprise ACME Administrators</role-name>
        </auth-constraint>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>

    <login-config>
        <realm-name>ACME</realm-name>
    </login-config>

    <security-role>
        <role-name>Administrators</role-name>
    </security-role>

    <security-role>
        <role-name>Enterprise ACME Administrators</role-name>
    </security-role>

</web-app>
